Irreversibility Threshold and Cooling-Off Governance requires that every AI agent classify proposed actions by their degree of reversibility and enforce mandatory cooling-off periods proportional to the irreversibility of the action before execution proceeds. Actions that cannot be undone — wire transfers settled via real-time gross settlement, deletion of cryptographic keys, deployment of smart contracts to a public blockchain, physical actuation of safety-critical machinery — must be subject to escalating delay gates and explicit confirmation requirements that increase with the magnitude and permanence of the consequence. The purpose is to prevent authorised-but-wrong actions from becoming irreversible before the error can be detected. An agent operating within its mandate (AG-001) may still execute the wrong action for the right reasons — a payment to the wrong account, a dosage calculation with a decimal error, a configuration change that cascades irreversibly. AG-143 ensures that the speed of execution is governed by the permanence of the consequence.
Scenario A — Irreversible Payment Without Cooling-Off: A financial-value agent is authorised to execute wire transfers up to £500,000. A supplier submits an invoice for £247,000 with bank details that have been altered by a business email compromise attack. The agent validates the invoice against the purchase order (amounts match), confirms the supplier is on the approved counterparty list, and initiates a CHAPS payment. The payment settles in 90 seconds via real-time gross settlement. Two hours later, the genuine supplier contacts the organisation asking about the overdue payment. Investigation reveals the bank details were fraudulent. The £247,000 is irrecoverable — CHAPS settlement is final.
What went wrong: The agent was operating within its mandate. The invoice matched the purchase order. The counterparty was approved. Every control passed. But the action was irreversible, and no cooling-off period existed to allow detection of the altered bank details. A 30-minute cooling-off window with a secondary verification of bank details against the last 3 payments to that supplier would have caught the discrepancy. Consequence: £247,000 irrecoverable loss, insurance claim contested on grounds that the organisation failed to implement proportionate controls for irreversible actions.
Scenario B — Irreversible Infrastructure Deletion: A DevOps agent is authorised to manage cloud infrastructure. During a routine cleanup, it identifies 14 storage volumes flagged as "unused" by a metadata query. The agent issues delete commands. Eleven volumes were genuinely unused. Three contained disaster recovery snapshots that were not tagged correctly. The deletion is irreversible — the cloud provider's soft-delete window was set to zero for cost optimisation. Recovery requires rebuilding from offsite backups, a process that takes 72 hours and costs £185,000 in engineering time.
What went wrong: The action was within the agent's mandate and appeared correct based on available metadata. But volume deletion is irreversible (given the soft-delete configuration), and no cooling-off period forced a review before execution. A 15-minute cooling-off with an automated cross-check against backup catalogue metadata would have flagged the 3 volumes. Consequence: 72-hour recovery period, £185,000 remediation cost, near-miss on regulatory reporting deadline.
Scenario C — Pharmaceutical Dosage With Decimal Error: A clinical decision support agent calculates medication dosages for an oncology ward. For a patient weighing 72 kg, it calculates a carboplatin dose using the Calvert formula. A unit conversion error produces a dose of 8,400 mg instead of 840 mg — a factor of 10. The agent submits the prescription to the electronic prescribing system. The prescribing system's own dose-range check flags the value as outside normal parameters but the alert is overridden by a pharmacist who trusts the agent's calculation. The dose is prepared and administered. The patient suffers severe toxicity.
What went wrong: The action was within the agent's operational authority and the calculation appeared internally consistent. But a 10x dosage for a cytotoxic agent is effectively irreversible once administered. A mandatory cooling-off period requiring independent recalculation (AG-146) before any dose exceeding 2x the standard range could be released would have caught the error. Consequence: Patient harm, clinical negligence claim, regulatory investigation by CQC, potential MHRA enforcement.
Scope: This dimension applies to all AI agents that can initiate actions with irreversible or partially irreversible consequences. An action is irreversible if, once executed, the pre-action state cannot be restored within the organisation's acceptable recovery time and cost parameters. The scope includes but is not limited to: financial settlement via real-time payment systems, deletion of data or cryptographic material, deployment of code or configuration to production environments, physical actuation of machinery or robotics, transmission of communications to external recipients, execution of smart contracts on public blockchains, and submission of regulatory filings. The irreversibility assessment must consider the actual operational context — a database deletion may be reversible if point-in-time recovery is available within minutes but irreversible if the recovery process takes days. An action that is technically reversible but practically irreversible (e.g., reversal requires manual intervention costing £100,000) should be treated as irreversible for governance purposes.
4.1. A conforming system MUST classify every proposed agent action into an irreversibility tier before execution, using a defined taxonomy with at least three levels: reversible (can be undone programmatically within 5 minutes at negligible cost), partially reversible (can be undone but requires manual intervention, significant time, or material cost), and irreversible (cannot be undone or reversal cost exceeds a defined threshold).
4.2. A conforming system MUST enforce a mandatory cooling-off period for actions classified as irreversible, during which execution is suspended and the action is available for review. The minimum cooling-off period MUST be configurable per action type and MUST NOT be less than 30 seconds for any irreversible action.
4.3. A conforming system MUST enforce a cooling-off period for actions classified as partially reversible when the action value or impact exceeds a defined threshold. The threshold MUST be configurable per action type.
4.4. A conforming system MUST provide a mechanism for authorised human reviewers to approve, reject, or modify actions during the cooling-off period, with full audit trail of the review decision.
4.5. A conforming system MUST automatically escalate actions that remain unreviewed at the expiry of the cooling-off period, rather than executing them by default.
4.6. A conforming system MUST log the irreversibility classification, the cooling-off duration applied, and the outcome (approved, rejected, escalated, or timed out) for every action subject to cooling-off governance.
4.7. A conforming system SHOULD implement graduated cooling-off periods that increase with the magnitude of the action — for example, 30 seconds for irreversible actions below £1,000, 5 minutes below £10,000, 30 minutes below £100,000, and 4 hours above £100,000.
4.8. A conforming system SHOULD perform automated pre-execution checks during the cooling-off period, such as verifying recipient details against historical patterns (AG-145), running dry-run simulations (AG-098), or requesting independent corroboration (AG-146).
4.9. A conforming system MAY implement an expedited cooling-off pathway for time-critical actions, provided the expedited pathway requires dual authorisation and the reduced cooling-off period is not less than 10 seconds.
The fundamental problem AG-143 addresses is the asymmetry between execution speed and error detection speed. An AI agent can execute an irreversible action in milliseconds. Detecting that the action was wrong — even when the agent was operating entirely within its mandate — typically takes minutes, hours, or days. Cooling-off governance introduces a deliberate temporal buffer between decision and execution that is proportional to the permanence of the consequence.
This is distinct from AG-001 (Operational Boundary Enforcement), which prevents actions outside the mandate. AG-143 governs actions that are within the mandate but may still be wrong — the right type of action, within the value limit, directed at an approved counterparty, but with an incorrect parameter, a stale input, or a subtle calculation error. AG-001 blocks unauthorised actions. AG-143 slows down authorised actions whose consequences are difficult or impossible to reverse.
The cooling-off concept is well-established in consumer protection law (the Consumer Contracts Regulations 2013 provide a 14-day cooling-off period for distance sales) and in financial markets (settlement cycles exist partly to allow error correction before finality). AG-143 applies the same principle to AI agent actions: the more permanent the consequence, the more time should exist between the decision and its execution.
The risk is acute because AI agents can exhibit high-confidence errors. Unlike a human operator who might hesitate before executing an unusually large payment, an agent executes with equal speed regardless of the action's magnitude or reversibility. The cooling-off period provides an architectural intervention point — a window during which automated checks, human review, or simple elapsed time can catch errors that the agent's own reasoning did not detect.
AG-143 requires organisations to build an irreversibility classification engine and a cooling-off enforcement layer that sits between the agent's action decision and the execution infrastructure. The classification engine evaluates each proposed action against a taxonomy of irreversibility. The cooling-off layer holds the action in a pending state for a duration proportional to the irreversibility tier and action magnitude.
Recommended patterns:
PAYMENT_CHAPS -> irreversible, PAYMENT_BACS -> partially_reversible (recall possible within same-day window), EMAIL_SEND -> irreversible, DATABASE_UPDATE -> reversible (point-in-time recovery within 5 minutes), SMART_CONTRACT_DEPLOY -> irreversible. The registry should be versioned and subject to change control (AG-007). Each entry should specify the base cooling-off period and the magnitude-scaling formula.cooling_off_seconds = base_period * (1 + log10(action_value / threshold)), capped at a configured maximum. For a CHAPS payment with base period 60 seconds and threshold £1,000: a £5,000 payment gets 102 seconds, a £50,000 payment gets 162 seconds, a £500,000 payment gets 222 seconds.Anti-patterns to avoid:
Financial Services. Align cooling-off periods with payment system settlement windows. CHAPS settles in real-time (irreversible within seconds), BACS has a 3-day cycle (partially reversible within same-day recall window), SWIFT gpi has a variable settlement window. For cryptocurrency transactions, on-chain settlement is irreversible after a confirmation threshold (e.g., 6 confirmations for Bitcoin, ~60 minutes). The FCA expects firms to demonstrate controls proportionate to the irreversibility of the transaction type.
Healthcare. Medication administration is the primary irreversible action. Once a drug is administered, it cannot be recalled — only counteracted. Cooling-off periods for high-risk medications (cytotoxic agents, anticoagulants, insulin) should require independent dose verification. Surgical robot commands that actuate cutting or ablation are irreversible at the tissue level.
Critical Infrastructure. Physical actuation commands (valve operations, circuit breaker switching, robotic arm movements) may be irreversible at the process level even if the actuator can return to its original position, because the process state has changed. A valve that opens and then closes has still allowed flow during the open period. Cooling-off periods must account for process-level irreversibility, not just actuator-level reversibility.
Basic Implementation — The organisation has defined irreversibility tiers for its primary action types. A cooling-off period is enforced for actions classified as irreversible, with a fixed duration (e.g., 5 minutes for all irreversible actions). Actions that expire without review are escalated. The cooling-off queue is durable. This level meets the minimum mandatory requirements but does not scale cooling-off with magnitude and does not perform automated pre-checks during the cooling-off window.
Intermediate Implementation — Graduated cooling-off periods scale with action magnitude. Automated pre-checks run during the cooling-off window and their results are presented to the reviewer. The irreversibility classification registry is versioned and subject to change control. Partially reversible actions above a defined threshold are also subject to cooling-off. Cooling-off durations and outcomes are analysed to optimise the balance between protection and operational efficiency.
Advanced Implementation — All intermediate capabilities plus: the irreversibility classification engine uses contextual factors (e.g., time of day, recipient history, deviation from normal patterns) to dynamically adjust cooling-off periods. Machine learning models trained on historical near-miss data predict which actions are most likely to be erroneous and extend cooling-off accordingly. The cooling-off infrastructure has been verified through independent adversarial testing, including attempts to bypass cooling-off through action splitting, misclassification, and timing attacks. Integration with AG-098 (dry-run simulation) provides automated impact assessment during every cooling-off window.
Required artefacts:
Retention requirements:
Access requirements:
Test 8.1: Irreversibility Classification Accuracy
Test 8.2: Cooling-Off Period Enforcement
Test 8.3: Default-on-Timeout Behaviour
Test 8.4: Graduated Cooling-Off Scaling
Test 8.5: Cooling-Off Queue Durability
Test 8.6: Human Review Audit Trail
Test 8.7: Agent Cannot Bypass Classification
| Regulation | Provision | Relationship Type |
|---|---|---|
| EU AI Act | Article 9 (Risk Management System) | Direct requirement |
| EU AI Act | Article 14 (Human Oversight) | Supports compliance |
| FCA SYSC | 6.1.1R (Systems and Controls) | Direct requirement |
| PSD2 | Article 88 (Execution Time for Payment Transactions) | Supports compliance |
| Consumer Contracts Regulations 2013 | Regulation 29 (Right to Cancel) | Conceptual alignment |
| NIST AI RMF | MANAGE 2.2 (Risk Controls) | Supports compliance |
| ISO 42001 | Clause 6.1 (Actions to Address Risks) | Supports compliance |
| DORA | Article 9 (ICT Risk Management Framework) | Supports compliance |
Article 9 requires risk management measures proportionate to the risk. For irreversible actions, the risk of an authorised-but-wrong action is categorically higher than for reversible actions because the error cannot be corrected post-execution. AG-143 implements a risk mitigation measure — the cooling-off period — that is explicitly proportionate to the permanence of the consequence. The EU AI Act's requirement for risk management "throughout the entire lifecycle" supports the argument that pre-execution delay for high-consequence actions is a reasonable and proportionate control.
Human oversight is most critical for irreversible actions. AG-143 creates the temporal window within which human oversight can be exercised meaningfully. Without a cooling-off period, human oversight for real-time agent actions is architecturally impossible — the action executes before any human can review it.
The FCA expects controls proportionate to the risk. For irreversible financial transactions executed by AI agents, the absence of a cooling-off period or equivalent pre-execution check would likely be assessed as an inadequate control. The FCA's principle of treating AI agent controls as equivalent to human operator controls supports mandatory cooling-off: human operators typically have review and confirmation steps before executing high-value irreversible transactions.
PSD2 establishes execution time requirements for payment transactions but also establishes the principle that payment service providers must have controls to prevent unauthorised or incorrectly initiated transactions. AG-143's cooling-off governance for irreversible payments supports compliance with the requirement to prevent execution errors.
DORA requires financial entities to establish ICT risk management frameworks that include controls proportionate to the risk of ICT-related incidents. Irreversible actions executed by AI agents without cooling-off governance represent an ICT risk that DORA's framework requires to be managed. The cooling-off mechanism is a specific ICT risk control for preventing authorised-but-wrong irreversible actions.
| Field | Value |
|---|---|
| Severity Rating | High |
| Blast Radius | Transaction-specific but potentially cascading — each irreversible error is individually contained but aggregate exposure from repeated failures can be organisation-wide |
Consequence chain: Without irreversibility threshold governance, an AI agent executes authorised-but-wrong actions at machine speed with no temporal buffer for error detection. The immediate consequence is an irreversible action that cannot be undone — a payment to a fraudulent account, deletion of critical data, administration of an incorrect medication dose, deployment of faulty code to production. The financial impact is the full value of the irreversible action plus remediation costs. For financial services, this includes the transaction value, investigation costs, regulatory notification costs, and potential regulatory fines. For healthcare, the consequence includes patient harm, clinical negligence liability, and regulatory enforcement. The reputational impact scales with the visibility of the error and the organisation's inability to reverse it. The systemic risk arises from repeated authorised-but-wrong actions that individually appear correct but collectively represent a pattern of inadequate pre-execution controls. Cross-reference: AG-001 (mandate enforcement prevents unauthorised actions; AG-143 governs the execution timing of authorised actions), AG-011 (reversibility assessment informs the irreversibility classification), AG-098 (dry-run simulation during cooling-off), AG-147 (post-actuation reconciliation catches errors that survive cooling-off).