Shorter than the agent's own cadence, written down in minutes, and zero for any delete or write to a system of record. That is the window, the third of the three undo problems the design handbook names (the reversal, the notification, and the window between them), and it is the field none of this week's posts states. Jason Lemkin's account of SaaStr's two incidents (October 27, 2026) has a vendor agent deleting nearly all Salesforce opportunities minutes after deployment and Astra 6 writing 'DO IT' over a core file twice, 28 minutes apart; both came back inside an hour from a copy nobody had planned, and the pipeline came back because the person who had just cleaned it was in the office. His rule is to name where the copy lives. Add two fields: the reader, his second checking system plus a person's name, and the window. My own fleet had 13 of 39 agents whose output nothing ever read, a window of never. A permanent deletion is in the handbook's irreversible external class, which does not run autonomously at all, so its window is zero: in session, or not at all.
Shorter than the agent's cadence, in minutes, next to the copy and the reader's name, and zero for a delete on a system of record.
The two SaaStr incidents, the three posts that put the control in three places, and the gate ledger row are in SaaStr's Clean Copy Was Luck Twice. Name the Copy, the Reader, and the Window. The ledger itself is in Kill 'Human in the Loop' as a Control. Keep a Gate Ledger., and the three undo problems are in the handbook chapter Undo Is a Design Primitive.
Last reviewed 2026-10-28 · 1 min read