能不能撤回：为什么决策的第一种分类不是对错
Accuracy cannot repair a mistake that cannot be undone; most institutions route reversible and irreversible choices through the same approval process, making experiments timid and commitments careless
I. Two Kinds of Error Do Not Sit on the Same Axis
A feature that can be rolled back usually passes a requirements review, a test report, a staged rollout plan and three signatures. The same organisation will close a production line, sign a ten-year exclusive supply agreement, or clear a site for a single irreversible rebuild in one meeting. The consequences differ by more than an order of magnitude; the time spent arguing is often inversely related.
The question worth pressing is this: if judgement means getting things right, why does the decision that most needs to be right receive the least thought? Three ready explanations can be set aside. It is not lack of information — irreversible choices typically have less of it, yet that scarcity does not trigger more searching or more questions. It is not temperament — the same people behave quite differently in the two settings. Nor is the organisation broadly risk-seeking: its caution over reversible matters borders on paralysis, so caution is not in short supply; it is simply deployed in the wrong place.
What remains is the temporal structure of the choice: whether a mistake can be undone. Being right and being able to try again are separate axes, and most decision procedures are built along only the first. Once the two are conflated, a small error that leaves a record looks expensive, while a vast error that surfaces years later looks cheap.
II. Reversibility Is Not a Matter of Degree but of Three Distinct Locks
"Can this be undone" is usually treated as a matter of degree: how much cost, how much time, how much embarrassment. A more useful move is to treat it as three independent locks.
The first is a state lock: does the original state still exist? Deleted code can be restored; capital that has gone to zero cannot; a cleared habitat cannot; a position stated in public cannot. The second is a coordination lock: have other people already changed their plans around the decision? Once an internal standard is published, procurement, contract terms and training materials adjust to it, and "changing it back" no longer means editing one document but moving everyone who has acted on it. The third is a window lock: some openings occur once, and after they close even standing still is no longer available as an option.
Most misjudgements come from checking only the first lock. Technical rollback is read as actual reversibility, while the coordination and window locks quietly transfer the cost to other people and to later years. The systems-thinking tradition has long insisted that feedback arrives with delay and that the effects of an intervention tend to appear elsewhere and much later; Thinking in Systems is precisely an attempt to put those lags and feedback loops on the table. That also explains a contrast: "let us try it and see" is nearly free in software, yet inside an organisation it can be an expensive commitment that cannot be recalled.
In Against the Gods, Peter Bernstein traces how the concept of risk took shape, locating the boundary between the modern world and earlier ones in whether the future came to be seen as something that could be grasped and chosen, and describing risk as a choice rather than a fate. One step further from that claim reveals an assumption: a choice only counts as a choice if a wrong one can be made again. That assumption usually sits in the background of risk management, and it is exactly the part that deserves separate inspection. Turning the future into a choice and turning a choice into a revisable choice are two different achievements.
III. Why Reversible Matters Are Over-Approved
Reversible decisions share one feature: their mistakes are visible, near-term and attributable. When a release goes wrong, logs, timelines and named owners are all present, and a post-mortem can be very specific. The error leaves a record, and the institution responds by adding approvals, signatures and checklists.
The consequences of irreversible decisions run the other way: delayed, dispersed, hard to attribute. By the time the effects appear, the original proposal, its sign-off and the people in the room have scattered, and the cost is spread across many hands, so it is difficult to point to a single wrong judgement. Approval intensity therefore does not track the size of the consequence; it tracks the way an error gets recorded. Errors that are easily documented are defended against repeatedly; errors that are not easily documented are let through lightly.
Two neighbouring arguments should be kept distinct here. This is not the dilution of responsibility, where many people share a task and in the end nobody has to answer — that is a question of organisational form. Here authority is perfectly clear; the evidence simply arrives too late. Nor is it the problem of warnings issued too early, which concerns correct advice meeting the wrong moment. The issue here is a time lag in attributability. All three concern who should answer, but their causes differ and cannot substitute for one another.
In Superforecasting, Philip Tetlock argues for expressing judgements as probabilities and revising them continuously as evidence arrives, describing the best forecasters as being in a state of permanent revision, with no final version. The value of that method depends on a condition: a judgement can be revised, and the revision can still change what happens next. Once a decision has been executed and cannot be withdrawn, continuous revision retains only documentary value — the forecast grows more accurate while the outcome stops responding to it. The pursuit of accuracy presupposes that accuracy can still be converted into a second chance. Applying calibration to a one-shot, all-or-nothing choice puts a tool designed for repeatable environments into an environment that does not repeat.
IV. Pricing Reversibility: One Threshold, Two Prices
A reversible decision is equivalent to holding a right to start over; the more uncertain the future, the more that right is worth. An irreversible decision is equivalent to selling that right once, in exchange for present certainty. The two should not be measured by the same approval threshold or the same discount rate, yet most organisations do exactly that: every proposal queues for the same process, graded by amount or by rank, never by whether it can be undone.
The consequence is double. On reversible matters, attention and approval capacity are consumed, and experiments that could have traded small errors for information are stretched into long arguments. On irreversible matters, "let us start and adjust later" hands away the most valuable right for nothing. This is not a failure of judgement but a failure of pricing.
In Margin of Safety, Seth Klarman puts the weight on buying well below intrinsic value and leaving room for the downside. In Antifragile, Nassim Taleb distinguishes structures that gain from volatility from those that exit the game the moment a boundary is touched, and insists that those who bear the consequences should be the ones who decide. The two books take different routes to the same plain arithmetic: where the risk of being knocked out exists, the gain from improving one's hit rate is far smaller than the gain from keeping the right to stay in the game. However accurate a single call may be, if being wrong ends participation, the difference between accurate and inaccurate matters much less than intuition suggests.
Two other themes should also be separated here. The disappearance of slack concerns redundancy being squeezed out by efficiency; the illusion of control concerns how the drive to master outcomes produces over-intervention. The present point is about neither how much reserve to hold nor how much to intervene, but about one procedure being applied to two structurally asymmetric kinds of decision, and thereby tagging them with the same price.
V. The Countercase: Irreversibility Is Also a Device for Commitment
The strongest objection is this: if the argument above holds, an institution should always prefer the reversible, and then nothing that requires other people's cooperation could ever be built. Marriages, constitutions, long-horizon investments, public positions and published standards derive their value precisely from not being easily withdrawn. Others commit and rearrange their plans because they judge that the decision will not be reopened. Giving up reversibility in a deliberate, institutional way is one of the preconditions of cooperation. "Keep everything reversible" is therefore not a general optimum; elevated into a rule, it produces an organisation that never commits and is therefore never followed.
A second objection is closer to daily work: reversibility is routinely overestimated. After the first decision is announced, other people have signed contracts, retooled lines and trained staff. Rolling back code is easy; rolling back those adjustments is not. Treating "technically reversible" as "actually reversible" is, in effect, a transfer of the cost of withdrawal to people who were not in the room. What gets overlooked is not technology but distribution: who quietly paid for the claim that this could be undone.
A further limit has to be conceded. Some irreversibilities cannot be identified in advance and can only be narrated afterwards as "it could have been avoided". Demanding an exhaustive pre-mortem on reversibility breeds another formal checklist and encourages hindsight to be mistaken for foresight; the fuller the form, the easier it is to believe the risk has been handled. The aim, then, is neither to maximise reversibility nor to abolish review, but to ensure that irreversibility is chosen explicitly once rather than occurring by default.
VI. A Judgement: Three Questions and Three Procedures
Three questions belong before the decision. First, when this is withdrawn, will the original state still be there? Second, how many people have already changed their plans because of it? Third, who bears the cost of withdrawal, and is that the same person who made the call? The three map onto the state lock, the coordination lock and the ownership of consequences; omit any one of them and irreversibility gets misread as "we can always change it back".
On that basis, decisions fall into three classes, each with its own procedure:
- Try it: all three answers are light. Lower the approval level, shorten the cycle, and write down a stopping condition and a rollback trigger in advance. The goal here is not to avoid mistakes but to buy information with small ones.
- Commit: a state lock or a coordination lock is present. Raise the evidential bar, lengthen the cooling-off period, state explicitly in the document that this decision cannot be withdrawn, and require a named answer to what happens if the call proves wrong.
- Pre-arrange an exit: the window lock dominates. Do not aim to be right once; agree in advance on review dates and an exit path, breaking a single irreversible step into several revisable segments.
What matters is the basis of classification. Amount, seniority and headcount are easy fields to fill in; reversibility is not, which is why the column is usually missing from the form. Without it, the first two classes pass through the same threshold. Adding the column does more than adding another round of argument. Each procedure also carries a cost: the first class generates more small failures, the second slows down genuine opportunities, and the third depends on someone actually showing up at the review date. Admitting those costs is more honest than claiming the classification eliminates error.
Back to the opening contrast. Judgement is usually understood as improving accuracy, but accuracy compounds only where a second attempt is possible. The question that needs answering first is not "is this decision right" but "if it is wrong, is there another go". Put that question in the first column of the process, and reversible matters become safe to try, while irreversible ones finally receive the slower and more deliberate procedure they deserve.
