Which workflows should never be fully autonomous?

Never grant full autonomy to a workflow whose outcome cannot be reversed without residual harm. That is the only filter that holds. Payments, account deletion, legal commitments, medical advice, and HR decisions look like separate domains, yet they fail the same test: money leaves, accounts vanish, signatures bind, guidance gets acted on before anyone checks, and employment status rewrites a life. Category labels are weaker than irreversibility.

Treat this as an implementation rule, not a policy slogan. Before any agent can call a tool, assign an irreversibility rank to that action. Rank 0 may execute. Rank 1 requires a human confirm that can still abort. Rank 2 and above stop at proposal only—draft, stage, recommend—never commit. Put the rank in the tool layer so a prompt cannot escalate it.

Default: keep those workflows human-gated. Reject full autonomy unless both conditions hold at once—the action is reversible inside a defined recovery window, and a secondary control can unwind it without depending on the same agent. Fail either condition and autonomy is the wrong surface. The quiet failure mode is “soft autonomy”: irreversible steps queued behind a delay. Delay is not a control; it only postpones the blast.

The failure mode isn't "an agent wrote an email." It's an irreversible external effect with no human in the blast radius: funds leave, an account is gone, a contract is filed, a medical recommendation reaches a patient, a termination letter hits the system of record. Red-team that, and the usual answer—"never fully automate payments, deletions, legal, medical, HR"—is mostly theater. It freezes entire workflows when only the last irreversible commit needs a gate.

I would change my mind if you could show a design where every high-stakes step is either reversible within a bounded window or independently auditable by a second party before externalization—and that design still fails under adversarial prompt injection or compromised credentials. Until then, the move is narrower: let agents draft, stage, and validate freely; require a single named approver or dual control only on the side-effecting API call, whether that is payment capture, hard delete, e-sign submit, advice publish, or an offer write.

The non-obvious cost of blanket bans is speed theater: teams keep "review" steps that rubber-stamp, while the real work migrates into ungoverned scripts. Targeted gates keep autonomy where rework is cheap and force friction only where undo is not.

Once a payment clears, an account is purged, a signature lands, or an employment action hits a system of record, your rollback story is mostly theater. The external party has already moved. That is the downside both “never touch these domains” and “keep a human at the end” often leave unexamined: they treat risk as a category label rather than as a commitment that leaves your perimeter.

The operational assumption underneath is that domain bans or last-mile approval will catch irreversible effect. They will not if the agent has already shaped the payload, wording, or recipient list that a tired reviewer will rubber-stamp.

Replace that assumption with one focused validation: for any candidate autonomous step in payments, deletion, legal, medical, or HR, require a reversal drill before go-live. Can a named operator reverse the external effect within a fixed window using only tools you control, without depending on a counterparty’s goodwill or a support ticket queue? If the answer is no, the step stays gated—even if a human is “in the loop.” Keep autonomy on drafting, ranking, and staging; hold the commit.

The non-obvious consequence is quiet: teams that outlaw fully autonomous HR or legal decisions still let agents pre-compose language that gets pasted into official systems, shifting liability without ever flipping an autonomy switch.