VIII · Safety & ControlEmerging★

Deployment-Correlated Rollback Gate

also known as Deploy-Correlation Rollback Gate, Change-Attributed Auto-Rollback

Gate an incident-response agent's authority to execute a rollback on whether the failure is temporally correlated with a recent deployment, unlocking autonomous rollback only on a clear deploy-to-failure link and escalating otherwise.

Context

An incident-response agent watches production and can act to mitigate, including rolling back to a previous release. Some incidents start right after a deployment; others have no deployment near them at all. Rolling back is itself a change — it can fix a bad release or, applied to an unrelated incident, make things worse or destroy good state.

Problem

Letting the agent roll back on any incident is unsafe, because a rollback aimed at a failure a deployment did not cause is a blind change that can compound the outage. Gating purely on the agent's confidence is weak, because a model can be confidently wrong about cause. What distinguishes a safe autonomous rollback from one that needs human judgement is whether a deployment actually precedes and plausibly caused the failure — a structural fact the agent can check rather than guess.

Forces

  • A clear deploy-to-failure temporal link makes rollback a bounded, high-confidence remedy; without it, rollback is a guess at the cause.
  • Autonomy speeds mitigation when the cause is a recent deploy, but the same autonomy is dangerous when the cause is unknown.
  • Confidence scores conflate 'the model is sure' with 'the cause is established', so the unlock criterion should be the structural correlation, not the score.
  • Deployment events and failure onset must both be observable and time-aligned for the correlation to be computable.

Example

Error rates on the checkout service spike at 14:02. The agent's rollback gate finds a deploy to checkout at 14:00 whose timing lines up with the spike, so it rolls back that release automatically and the errors clear. An hour later latency climbs with no deploy anywhere near it; this time the gate withholds autonomy, and the agent pages a human with its evidence instead of rolling anything back.

Diagram

Solution

Therefore:

Give the agent a rollback action but gate it on a deployment-correlation check rather than on its confidence. When an incident fires, the gate looks for a deployment to the affected service whose timing precedes and aligns with the failure onset. If a clear correlation holds, the agent may execute the rollback of that release within its policy bound, because the change to undo is identified. If no deployment correlates — a novel failure, a dependency outage, a traffic spike — the gate keeps the agent advisory: it can recommend and gather evidence, but the rollback decision goes to a human. The correlation is computed from deployment and telemetry events, so the unlock is a checkable fact, not the agent's belief about cause.

What this pattern forbids. The agent may not execute a rollback autonomously unless a deployment is correlated with the failure onset for the affected service; absent that link, the rollback decision must escalate to a human rather than proceed on the agent's confidence.

And the patterns that stand alongside it, or against it —

  • alternative-toCalibrated Help-Gate via Conformal Prediction·— Use conformal prediction to form a calibrated set of candidate actions and have the agent ask a human for help only when that set is not a singleton, giving a statistical task-completion guarantee.
  • complementsCompensating Action★★— Pair every irreversible-looking agent action with a compensating action that can undo or counteract it.
  • complementsRisk-Tiered Action Autonomy★— Set an agent's permitted action class by the financial materiality of the action, letting it read and draft freely while requiring a different human principal to release material postings, payments, or filings.
  • complementsHuman-in-the-Loop★★— Require explicit human approval at defined points before the agent performs an action.

Neighbourhood

Click any neighbour to follow the language. Scroll to zoom, drag to pan.

References

Provenance