The asymmetry is stated well: source code got branching, review and CI, and infrastructure state never did, so the safety we rely on is entirely a property of the artifact the agent happens to be editing. An agent changing an auth rule leaves a clean repo and a changed system, which is the worst possible combination for anyone trying to work out later what happened. Reversibility is the right primitive rather than a bigger prompt, and I would push on one thing: not everything is reversible in the same sense. Schema and policy changes can be branched and rolled back cleanly; data written under the wrong policy cannot be un-read, and an email sent by a deployed function cannot be recalled. So the boundary still needs a category of effects that require a human regardless of how good the undo story is. The other property worth demanding from a model like this is that a refusal is informative - if the agent is blocked, it should get enough structure back to narrow the request and retry, otherwise it routes around the boundary with a direct call and you are back where you started.