The rollback affordance
Undoing what the agent did, when undo is possible.
Every agent product is one overconfident run away from a trust crisis. The antidote isn't to slow the agent down. It's to make undo a first-class citizen of the product. A timeline of what the agent did, with the ability to roll back to any point, changes how safely a user is willing to let the thing loose.
"Undo is a promise. Mark what can't be taken back, then let people step confidently everywhere else."
A visible timeline, reversible by default.
Every action the agent takes gets a timestamped event on a visible timeline. Clicking any event asks "roll back to here?" and, on confirmation, reverses everything after it. Irreversible events (emails sent, external webhooks fired) are marked, and rollback clearly explains that those will be flagged, not undone.
Undo is a promise. Mark what can't be taken back, then let people step confidently everywhere else.
Users explore more when they can retreat.
The reason users hesitate to give agents real work is that every action feels terminal. A confident undo reverses that calculation. It's not about undoing things often — it's about knowing you could, which turns cautious use into exploratory use. That's where the product actually becomes useful.
Timeline details worth getting right.
- Irreversible chips. Flag external side effects at the event, not in a sidebar. The user should see the warning before they try to undo.
- Confirm with consequences. "Roll back 4 events? 1 irreversible will be flagged, not reversed." No surprises.
- Timeline always visible. Not a drawer, not a modal. Users should feel the trail building under every run.
Undo that pretends it undid.
A rollback that silently leaves external side effects in place — sent emails, posted messages — while visually undoing the row is worse than no rollback at all. The user thinks the world has been reset and is blindsided by the leftover effects days later.
What this pattern gets wrong when it gets wrong.
- Runaway agent
- An agent that loops, spends, or edits past the user's intent with no visible cap.
- Silent truncate
- The response ran out of room or tokens and the product didn't tell the user where it stopped.
Three shipping variants worth copying.
- A 30-second undo strip at the bottom of a completed run
- Each step shows its own 'reversible until…' deadline
- Irreversible steps are marked at plan time, not at run time