How much autonomy should I give an AI coding agent? Wrong first question. The right one: how reversible is the agent’s worst output on this task? Classify the blast radius before you set the trust level.
The inversion most teams miss
The reflex is to restrict what the agent is allowed to do to make it safe. Restriction caps capability. Reversible Execution caps cost — and lets you raise capability. When every operation lives inside a boundary that’s cheap to undo, the cost of a mistake drops toward zero, and you can afford more ambitious work.
The principle: the agent doesn’t need to be perfect; the environment needs to be fault-tolerant.
Three levels of rollback
- Edit-level — undo a single change (the cheapest reversal).
- Branch-level — isolate the agent’s work on a branch you can discard.
- Session-level — revert to a checkpoint/plan and re-execute from there.
Installable pattern: read-only by default; destructive actions (terminal commands, DB writes, file deletes) request explicit approval. And treat the plan/PRD as a checkpoint — if implementation goes sideways, revert to the plan and re-execute, not to a pile of file edits. That’s rollback at a higher abstraction.
Why this comes before autonomy
Blast radius is one of the two axes that set an agent’s autonomy rung (the other is demonstrated reliability). An irreversible action caps autonomy low regardless of how good the agent has been. Reversibility is the infrastructure that makes trust affordable — it’s the precondition for the Autonomy Calibration Ladder.
How blast radius feeds the Autonomy Calibration Ladder: curiochat.ai/software-engineer