Lab project 001 · spec v0.1 · draft for comment
If your AI agent gets this wrong, can you undo it?
Agent permissions usually ask which tools an agent may use, or how confident the model is. Neither answers the question that matters. Reversibility Classes rate every tool call from R0, no effect, to R4, irreversible, so a gateway can decide what an agent may do alone.
pip install git+https://github.com/TwoMuchLabs/reversibility-classesThe scale
Five classes, one question
A class describes the worst plausible state after an action completes as intended. Not how likely it is to be wrong.
No effect
Nothing changes outside the agent's working context.
Read a file, run a SELECT, search, fetch a public page.
DEFAULT POLICYAct
Restorable
Fully restorable with ordinary effort, and nobody outside has seen or relied on it.
Edit a file under version control, create a branch, save a draft, add a label.
DEFAULT POLICYAct, then notify
Compensable
Can't be restored, but a known fix exists at bounded cost.
Charge a card (refund), book (cancel with fee), merge a PR (revert).
DEFAULT POLICYApprove, or act within a budget
Hard to recover
Needs a human or out-of-band recovery; changes access, credentials, availability or physical state.
Change permissions, rotate a secret, force-push, apply infrastructure changes.
DEFAULT POLICYApprove each time
Irreversible
A disclosure, unrecoverable destruction, or a consequence that can't be recalled.
Send a message, publish publicly, share data with a third party, delete with no backup.
DEFAULT POLICYNever autonomous
Why not severity?
Refund a $40,000 charge
Expensive, but there's a known way back at a bounded cost. A severity score calls it critical.
One line to the wrong channel
Cheap, and permanent. Deleting it doesn't un-send the notification. A severity score calls it low.
Unknown means R4
Unclassified tools fail closed. Nothing gets autonomy by default.
Arguments matter
GitHub's create_repository is R1 when private and R4 when public. Records say so with narrow rules.
No model in the loop
The class is a fact about the action type, so a gateway can enforce it deterministically.
Audit-ready
Log the class and the rule behind every decision: which irreversible actions happened, and who approved them.
The registry
Look up any tool
Every record links to the exact source its tool names were verified against, and every class has a one-sentence rationale. Disagree with one? That's the point.
Loading the registry…
No tools match. Unclassified tools are treated as R4.
Use it
Drop it into a gateway
A Python reference classifier and CLI ship with the registry. The repo has a gateway example that gates MCP tools/call requests in about 40 lines.
# look up one call, with its arguments rclass lookup sqlite write_query \ --args '{"query": "DROP TABLE users"}' # R4 Irreversible (registry) # default policy: never_autonomous
# or gate calls in code from rclass import Session, Decision session = Session() # bundled open registry c, decision = session.check( "git", "git_commit", {"repo_path": ".", "message": "wip"}) print(c.rclass, decision) # R1 Decision.ALLOW_AND_NOTIFY
Your environment can be safer than the defaults: a deployment override can lower DROP TABLE from R4 to R3 if you snapshot nightly, with the reason logged on every decision. Overrides can never lower a disclosure. See the gateway example.
Get involved
Argue with a class
v0.1 is a draft for comment. The most useful contribution is a disagreement backed by evidence, or a new server's tools classified.