ع
Learn Tracks Reference Guides Saved
Level 5: Trust & Safety · Lesson 4 · DESKTOP TRACK

One-way doors

short read

You can let Claude edit a file, hate the result, and roll it back to before. You cannot un-send an email. You cannot un-push a force-push that someone else already pulled. You cannot un-delete a database table.

A one-way door is an action you can’t easily undo. Once it’s through, it’s through.

The phrase comes from a memo by Jeff Bezos about decision-making: two-way doors you can walk back through; one-way doors close behind you. The framing is even more useful for approving Claude’s actions than it is for company strategy.

What goes through which door

Two-way (reversible, take your time but don’t agonize):

  • Editing a file. You can roll it back to the saved version.
  • Creating a file or folder. Delete it later if you don’t want it.
  • Running a build, a test, a check. Output, no permanent change.
  • Installing a package. You can uninstall it.

One-way (slow down, read twice):

  • Sending — email, Slack, anything that goes to another person or system.
  • Pushing to a branch other people use, especially a force-push.
  • Deleting things you don’t have a backup of.
  • Deleting or wiping database tables.
  • Anything that costs money — paid services, cloud resources spun up.
  • Anything that crosses the network into someone else’s system.

The one question

Before you approve anything that doesn’t feel like a plain file edit, ask:

If this turns out to be wrong, can I take it back?

If yes, approve and move on — speed is fine in a hallway full of two-way doors. If no, slow down. Read what it’s about to do. Maybe ask Claude to explain why it’s doing it that way. Maybe decline and ask if there’s a safer version.

This single question catches almost every “oh no” moment you’ve ever heard a developer tell a story about.

Blast radius vs. one-way

Easy to confuse the two. They sort your decisions differently:

  • Blast radius = how much could be affected.
  • One-way-ness = whether you can get it back.

A failed test has zero blast radius and is fully reversible. Deleting your only copy of an unsaved file has small blast radius (one file) but is fully one-way. The two questions stack — both worth asking.

What’s next

You can now read a request and judge its danger. Time to learn the other lever you have: not whether to approve a single action, but the mode you’re working in.