What does a system need during the first hour after an automated action goes wrong?
Controls before action decide whether a system may proceed. They do not freeze later actions, reconstruct what changed, contain downstream effects, or restore damaged state.
A recovery layer
Recovery needs its own machinery. The affected scope must stop changing. The system must preserve the inputs, identities, tool calls, policy decisions, and state changes that led to the failure. Reversal must be tested before an incident, and compensation must be defined where reversal is impossible.
A trace that cannot help stop further action is only a record. A rollback procedure that has not been tested against real state is only a guess.
Questions to carry forward
What can be frozen without stopping unrelated work? Which actions can be reversed? Which can only be compensated for? Which downstream systems trusted the result? How long does containment take?
Authority to act should depend partly on whether the system can survive a wrong action.