Reversibility & Blast Radius Assessment
Classifies a proposed change by what it would cost to undo and how far it reaches — and sets the scrutiny accordingly, in both directions.
Deliverable
One Markdown document, reversibility-assessment.md, in the structure set out under Output below. Its classification and rollback plan go into Decision Record Authoring.
Required inputs
- The proposed decision or change — what would be done, stated concretely enough to be undone.
- What it touches — the systems, data, people, contracts and commitments in reach, as supplied rather than inferred.
- The state before the change — what would have to be restored for the change to count as undone.
If any of the three is absent, stop and report it. Never infer the reach of a change from the change itself: what a change touches is a property of the environment, and the environment has to be described by someone who can see it.
Optional inputs
- The stages the change passes through: release, migration, announcement, signature, public commitment
- Existing rollback tooling, backups, feature flags or contractual exit clauses
- Who would have to be told if the change were undone
- Earlier attempts to reverse a comparable change, and what they cost
- The deadline the decision is under, and what is lost by delaying it
Where no stage list is supplied, the assessment treats the change as a single stage and says so. Where rollback tooling is unknown, the rollback plan is written as manual and unverified. Neither gap is filled with an assumption about what exists.
Execution
1 — State the change as an action that could be undone. One sentence, in the form of the thing a person would have to reverse. A change that cannot be phrased that way — an announcement, a published commitment, a message sent — is already partly irreversible, and that is the first finding.
2 — Classify reversibility. reversible when undoing restores the prior state, costly when it restores it at a price someone must pay, partial when some effects persist, irreversible when they all do. Classify from what the inputs state about tooling and commitments, not from how large the change feels.
3 — Map what it touches. One line per system, data store, team, customer group, contract or public commitment in reach. Mark each direct where the change acts on it, or indirect where it acts through something else. Anything nobody supplied is not on the map; it is in the gaps section.
4 — Establish who it reaches. For each affected group: how many where an input states it and unknown where none does, whether they would notice, and whether they must be told. Never estimate a population.
5 — Cost the undo at each stage. Per stage: what undoing it takes, who has to do it, what stays changed afterwards, and what has to be communicated. A cost nobody supplied reads unknown; the shape of the cost is still recorded.
6 — Find the point of no return. The last stage at which undoing still restores the prior state, and what crossing it commits. Everything before that point can be decided quickly; everything after it cannot be decided a second time.
7 — Set the scrutiny the decision deserves. A reversible change with narrow reach is decided by whoever owns it, immediately, and the assessment says so. An irreversible change with wide reach names the review it needs and who must sit in it. Deliberation is itself a cost, and this step spends it where undoing is expensive.
Output
reversibility-assessment.md, in this order:
- 1. Change assessed — the action, who proposed it, and when
- 2. Classification —
reversible, costly, partial or irreversible, with the input that makes it so
- 3. Reach — one line per item touched: name,
direct or indirect, and what happens to it
- 4. People reached — group, how many or
unknown, whether they would notice, whether they must be told
- 5. Stages and undo cost — per stage: what undoing takes, who does it, what stays changed
- 6. Point of no return — the stage that crosses it, and what crossing it commits
- 7. Rollback plan — the steps, their owner, and whether each is
confirmed or unverified
- 8. Scrutiny required — the review this decision warrants, who must be in it, and what may be decided without it
- 9. Gaps — what could not be mapped or costed, and who can supply it
Validation
The assessment is ready when all of these hold:
- Section 2 carries one of the four classifications and the input that supports it
- Every item in section 3 came from an input; none was inferred from the change
- Section 4 reads
unknown wherever no population was supplied
- Section 6 names a stage, or states that the change has no point of no return
- Section 7 marks every rollback step
confirmed or unverified
- Section 8 matches scrutiny to classification and reach, and says what may proceed without review
Fail the run if a population or cost figure appears that no input supplied, or if section 8 demands review of a change section 2 classified as reversible with narrow reach.
Failure handling
- No description of what the change touches — stop. Report that reach cannot be derived from the change itself, and name who can describe the environment.
- Rollback tooling unknown — write the rollback plan as manual steps, mark every step
unverified, and state in section 8 that an unverified rollback raises the scrutiny the decision needs.
- No access to the affected systems — map only what was reported, mark section 3
reported, and state that nothing was checked.
- Inputs disagree on what is affected — record both, name both sources, and set section 8 from the wider map while showing the narrower one beside it. Scrutiny set from the smaller map is the failure this assessment exists to prevent.
- Partial material — assess the stages the material covers, mark the rest
NOT ASSESSED — pending <material>, and deliver rather than wait.