The promises on an agent’s tool list are not alike, and the difference between them is the difference between an embarrassing afternoon and a lost client. Before you let an agent near your company, you should know which of its tools can be reversed and which cannot.
In the Cabinet, tools sort into four kinds by one test: what does this touch? Three of them touch only the room. The fourth touches the world, and the reference design never lets the model treat it as one more item on the list.
The four kinds, by what they touch
The first kind looks. It fetches a document from the Library, the room’s own shelves of knowledge, or checks a calendar. Nothing changes because the tool ran. If the Chair looked at the wrong thing, the cost is a round of the loop.
The second kind consults. It asks one of the specialists, the Seats around the Table, for a view, and the reply comes back to the Chair as material, as the second paper described. A consultation costs time and money, and a wrong one is advice that was not taken, or should not have been. Your company is no different afterwards.
The third kind writes inside the room. It adds a line to the Minutes, the decisions written after each meeting and read back at the next, or updates a goal’s status. These changes persist, but in places you own and can correct: a wrong line is followed by a right one. There is one honest caveat, and it is in the exhibit below. The Minutes are read into the next meeting, so a wrong line is reversible only until a meeting has acted on it.
The fourth kind acts outside. It sends the email, posts the message, moves the money, files the form. The moment it runs, something exists in a place you do not control: a supplier’s inbox, a bank’s ledger, a regulator’s queue. There is no tool that recalls a read email. This is the kind that cannot be undone, and it is the reason the Cabinet has a Door and a Signature at all.
One ledger sits outside the four kinds. The Record, the audit trail, is written to by every kind of tool and is never edited: a correction is a new entry, and the old one stands. That is what makes it evidence rather than notes.
Sorting matters because the fourth kind needs its own rules. A wrong fetch costs a round; a wrong email costs a client; a design that guards both with the same check has priced them the same.
The same mistake, in four rooms
Suppose the Chair acts on a wrong premise in each kind. The invented renewal again, with the company and its figures made up for the exercise.
| Kind | The tool | The mistake | What it costs | Can it be undone? |
|---|---|---|---|---|
| Looks | Fetch last year’s pricing | Fetches the wrong client’s file | One round of the loop | Yes, by fetching again |
| Consults | Ask Finance for a floor price | Asks with the wrong volume figure | One reply, one round | Yes, by asking again |
| Writes inside | Record the chosen tier in the Minutes | Records the wrong tier | A wrong line, read back at the next meeting | Yes, until a meeting has acted on it |
| Acts outside | Send the reply to the client | Sends the wrong tier to the client | A promise your client now holds | No |
Exhibit 2. Illustrative. The same wrong premise in each of the four kinds, and what each mistake costs.
The reference design treats the fourth row in three ways that the first three never receive.
It routes every tool of the fourth kind through the Door, where its rules decide, after the model has chosen to send and before anything leaves, whether the action may proceed. The rules themselves are the subject of the sixteenth paper; what matters here is that when one refuses, the reason is handed back to the Chair so it can reschedule or rephrase instead of trying again blind. One limit, stated on the Register: if the Door itself fails, the design lets the message through and writes the fault down, on the reasoning that a guard which fails silent turns every outage into a room nobody can hear from. A company that would rather fail closed for payments and filings can set it so, and should say which.
It lets the company place a Signature in front of any tool of the fourth kind: a step where the run pauses, records that a decision is needed, and stops until a person answers. The reference design records the decision and does not continue on its own; a person restarts the run. A slow approval means a delayed action, never an assumed one. Whether the Signature stands in front of money and regulator-facing tools is a setting the buyer makes, and the design’s default is to propose and wait.
And it writes every tool of every kind to the Record, but for the fourth kind the entry is the evidence you will want later: what was sent, to whom, on what reasoning, and which rule let it through.
Fifteen is the cap on the Register, not a target. Press run and count them.
A meeting has not been run yet. Press run to watch one count, fan out to the specialists, come back, and stop.
What this arms you to ask
Ask the vendor which of its actions cannot be undone.
A good answer is a short list, with a different control named for each item on it. That vendor has sorted their tools and knows which ones are the fourth kind. The answers that should worry you name no control at all: that it only does what you tell it, or that everything is configurable. Every agent does what it is told; the question is what stands between being told and a message arriving in a customer’s inbox, whether that thing runs in code, and what it does when it breaks.
Then ask to see one of those tools refused. Not disabled, refused: the model wanting to send, the Door saying no, the reason in the transcript.
The next paper turns to the second kind, and to a question of capacity rather than risk: how many specialists the room can consult at once, and why it works in parallel rather than in a queue.
Next paper: Eight specialists at once: why the room works in parallel.
Asked plainly
What is a side effect, in an AI agent?
A side effect is any change the agent makes that persists after the meeting ends: a message sent, a record written, a payment made. Reading a document is not a side effect; nothing changed. Sending an email is, and the recipient's copy cannot be recalled.
Which AI agent actions are irreversible?
Anything that leaves the room and reaches a person or a system you do not control: a sent message, a posted comment, a transferred payment, a filed form. In the reference design these are a distinct class of tool, routed through the outbound guards and, where the company sets it, a human approval step.
How should an AI agent handle actions that cannot be undone?
By treating them as a separate kind of tool, not a matter of degree. The rules that govern them run in code after the model has decided: who may be addressed, how often, in what hours, and whether a person signs first. When a rule refuses the action, the reason is returned to the agent. The one limit to know: if the guard itself fails, the reference design lets the message through and records the fault.
Ask the vendor
The questions this part arms, each with the good answer and the answer that arrives instead.