What happens if an agent makes a bad change?
Every phase has a typed boundary + an approval checkpoint. Rollback is a Merkle-chain walk, not a git revert.
A “bad change” has to survive eight human checkpoints + a typed DAG of phase boundaries before it lands in your main branch. That’s not a claim we make lightly — each checkpoint writes an approval row to the Merkle chain, and the pipeline refuses to proceed until the checkpoint is green. If a reviewer is unsure, they click “Request changes”; the pipeline halts and the agent is re-invoked with the review comment as context.
The second defence is rollback. Shakti’s rollback isn’t a git revert; it’s a walk up the
Merkle chain to the last known-good approval state and a re-execution of the downstream
phases from that anchor. Because every phase is deterministic about its inputs, the rollback
produces a predictable result; because every rollback is itself an audit entry, compliance
sees the full picture.
The third defence is blast radius. Axon shows reviewers the full downstream impact of every change before it’s approved, so reviewers see what they’d be endorsing before they click “Approve.”
We don’t claim agents are infallible. We claim every decision they make is observable, reviewable, and reversible.