Guides
One-way door
A consequential action that is hard or impossible to reverse — held for human judgment rather than auto-run with a receipt alone.
Last updated 2026-07-26
A one-way door is an action whose blast radius or reversibility makes silent auto-execution unsafe: customer-facing sends, production merges with high impact, destructive deletes, price or legal commitments, and similar external commitments. HiveBase holds these for human judgment instead of treating every action as the same confirm dialog.
Blast radius, not binary theater
Trustworthy autonomy tiers work by reversibility and blast radius, not a single “approve all agents” switch:
| Kind | Examples | Default posture |
|---|---|---|
| Reversible internal | Record a decision, re-rank a backlog | Often runs with a receipt |
| Reversible external | Draft email held before send | Prepare freely; commit gated (draft ≠ commit) |
| One-way door | Live customer send, prod merge, irreversible delete | Always hold for a human |
You can still grant standing approval for low-risk categories; one-way doors stay held by design until you change policy deliberately.