03. Reversibility and One-Way Doors — Speed where rollback is cheap¶
~12 min read. Move fast on two-way doors. Add ceremony when the door may lock behind you.
Built on the ELI5 in 00-eli5.md. the weather check —
reminder of risk assessment — tells you how much process a decision actually deserves.
1) First see the door, then choose the speed¶
Look. A captain changes sail angle quickly.
If the adjustment feels wrong, the captain changes it back.
That is a two-way door. But selling the ship,
signing a long contract, or rebuilding the engine room is different.
Those are one-way doors. AI teams must learn this distinction early.
Because not every decision deserves the same ceremony.
┌──────────────────────┬──────────────────────────┐
│ Two-way door │ One-way door │
├──────────────────────┼──────────────────────────┤
│ easy rollback │ costly rollback │
│ low blast radius │ wider blast radius │
│ fast decision │ deeper review │
│ lighter ceremony │ stronger documentation │
└──────────────────────┴──────────────────────────┘
A small retrieval tweak is often a two-way door. A vendor contract can be a one-way door.
Building your own serving stack can be a one-way door. Moving regulated data into a new provider can be a one-way door.
Simple, no? Speed should match reversibility.
Not anxiety. Not seniority theatre.
Not calendar pressure.
2) Reversibility times blast radius¶
So what to do? Use two axes.
First axis is reversibility. Second axis is blast radius.
That combination decides process weight.
┌───────────────────────────────┐
│ low blast + reversible │
│ move quickly │
├───────────────────────────────┤
│ high blast + reversible │
│ test carefully, then move │
├───────────────────────────────┤
│ low blast + irreversible │
│ review narrowly │
├───────────────────────────────┤
│ high blast + irreversible │
│ deep weather check and ADR │
└───────────────────────────────┘
Move fast. A model switch affecting all paying customers may still be reversible,
but the blast radius is broad. Test more.
A year-long vendor commitment for sensitive workloads may be hard to reverse, even before scale arrives.
Review carefully. A self-hosted training pipeline touching product, infra, finance, and compliance is both heavy and sticky.
That needs the full weather check. It also needs the ship's log.
Yes? Now process starts feeling fair.
Not random.
3) Match ceremony to risk, not to habit¶
Many teams over-process tiny choices. Many teams under-process life-changing ones.
Both are expensive. See the common mistake.
Some teams demand a meeting for every prompt edit. That kills learning speed.
Other teams casually approve expensive vendor lock-in in chat. That kills future freedom.
The compass should stop both mistakes. Ask these questions.
Can we undo this in a day? Can we undo this in a sprint?
Who feels the impact if it fails? Will users notice immediately?
Will operations notice for months? Will legal or security constraints get tighter later?
These are weather check questions. They are not paperwork for its own sake.
They are steering questions. Simple, no?
A good team has light rituals for two-way doors. Maybe a quick owner review.
Maybe an experiment note. A good team has stronger rituals for one-way doors.
Maybe a written ADR. Maybe cross-functional sign-off.
Maybe explicit revisit triggers. The goal is not bureaucracy.
The goal is proportion.
4) AI examples that teams misclassify all the time¶
See a few practical cases.
- Changing prompt examples for one internal analyst flow is usually a two-way door.
- Adjusting eval thresholds for a preview feature can be a two-way door with moderate blast radius.
- Moving from hosted embeddings to a self-run vector stack may be a one-way door operationally.
- Signing a discounted annual inference commitment may be financially one-way.
- Training domain-specific weights around sensitive data may be technically and governance-wise one-way. Look. Teams often misclassify because they look only at code.
But reversibility is broader than code rollback. It includes contracts.
Data migration. On-call burden.
Compliance exposure. Team skill depth.
Even crew morale matters. If only one engineer can operate the new stack,
that choice is less reversible than it looks. Yes?
So keep the full picture. The course tells you why the change matters.
The weather check tells you how dangerous the commitment is. The ship's log records why the team accepted that danger.
That trio keeps speed intelligent. Not reckless.
Where this lives in the wild¶
- AI search platform — principal engineer must separate reversible ranking tweaks from sticky infrastructure shifts.
- Fintech assistant — compliance lead must treat data residency changes as one-way doors even when code changes look small.
- Support bot — product manager can move quickly on tone prompts, but not on refund-policy automation thresholds.
- Developer tools copilot — staff engineer can ship eval-set changes fast, yet must slow down on new hosting commitments.
- Healthcare summariser — engineering director must demand deeper ceremony before fine-tuning on sensitive internal corpora.
Pause and recall¶
- What makes a decision a two-way door rather than a one-way door?
- Why is blast radius a second axis, not an optional detail?
- Name one AI choice that looks reversible in code, but not in operations.
- Which placeholder pushes you to examine risk before deep commitment?
Interview Q&A¶
Q: Why should reversible decisions move faster?
A: Their downside is capped because rollback is cheap. Slow process there mainly burns learning time without reducing much risk.
Common wrong answer to avoid: Reversible decisions matter less, so quality checks are unnecessary.
Q: Why is reversibility alone not enough to set process weight?
A: A change can be reversible yet still affect many users or workflows. Blast radius changes how carefully you test and communicate.
Common wrong answer to avoid: If rollback is possible, launch speed should always be maximal.
Q: Give an AI example of a one-way door.
A: A long vendor contract, a self-hosted serving stack, or a sensitive-data fine-tune can all be one-way doors because rollback is costly.
Common wrong answer to avoid: Only database schema changes count as one-way doors.
Q: Why do one-way doors need documentation?
A: Because their consequences outlive memory, staffing changes, and meeting context. Future teams need the reasoning, not just the outcome.
Common wrong answer to avoid: Documentation is useful only when the first launch fails.
Apply now (5 min)¶
Exercise: List five recent AI decisions from your team.
Mark each one as two-way or one-way. Then add a blast radius label: low, medium, or high.
Sketch from memory: Draw the four-box matrix from this file.
Place one real decision from your context inside each box.
Bridge. Once a decision becomes one-way, memory matters. The team now needs documentation that survives shifting people and fading context.