On the evening of August 11, 2020, a checker on a Citibank payments team was taking the last step to release a payment. Two colleagues had already entered and signed off on it. It was meant to pass about $7.8 million in interest to the lenders on a loan to Revlon.
A warning came up on the screen: “Account used is Wire Account and Funds will be sent out of the bank. Do you want to continue?”
It didn’t say how much. The checker meant to release the interest payment and clicked yes.
Which way the door opened
Along with the interest went almost $900 million of the bank’s own money, which everyone involved believed was being parked in an internal account. Lenders holding about $504 million refused to send it back, and it took Citi more than two years in court to establish that it was entitled to the money.
Jeff Bezos drew the line in his letter to Amazon shareholders for 2015. Some decisions are one-way doors: “If you walk through and don’t like what you see on the other side, you can’t get back to where you were before.” Most are two-way doors: “You can reopen the door and go back through.” The first kind deserve slow, careful deliberation. The second, he wrote, can and should be made quickly by individuals or small groups with good judgment.
His bigger worry was the heavy process spreading. Large organizations, he wrote, tend to use it on most decisions, and the result is “slowness, unthoughtful risk aversion, failure to experiment sufficiently, and consequently diminished invention.”
Move fast through doors you can walk back through. Slow down at the ones you can’t.
A door that locks behind you
Three approvals still didn’t let anyone at Citi see where the money would go. Which way the door opened had been set by a software default, and the warning didn’t say how much was about to leave. A hotel room door works the same way: it looks like every other door until it clicks shut and your key is on the desk inside.
Something similar happened at Atlassian in 2022, when a maintenance script deleted 883 customer sites in 23 minutes. In its post-incident review, the company committed to universal “soft deletes,” so that customer data can’t be deleted without first going through a soft-delete process.
The idea has limits. Bezos’s split is a rule of thumb from one company, and a footnote in the same letter admits “there is undoubtedly some survivorship bias.” A door you can reopen still costs something to walk back through: Citi got its answer after two years in court. And many real decisions are mixed, with a two-way part and a one-way part inside the same project.
The email you can’t unsend
Imagine you’re moving 40,000 customers to a new billing system. Most of the move is a two-way door. You shift a batch of 500, watch a week of invoices, and switch them back if anything breaks.
Two steps are different. The email telling every customer to update their payment details can’t be unsent, and wiping the old system’s records can’t be undone. So you run the batches quickly and slow those two down. You send the email to 200 customers first. That doesn’t make it recallable, but if the wording confuses people, 200 are confused instead of 40,000. You keep the old system read-only for 90 days. The deletion will still be permanent when it comes; you have only moved it to a date when you know whether you still need a way back.
Agents at the door
An AI agent meets the same split every time it calls a tool. When OpenAI tested its Operator agent before adding safeguards, on 100 test prompts resembling tasks like purchases and email management, it found 13 errors. Eight could be reversed within a few minutes. The other five were, in the company’s words, “to some degree, irreversible or possibly severe,” including an email sent to the wrong recipient and email labels removed in bulk.
OpenAI’s main fix was to have the agent ask for confirmation before acting on the world, “before completing a purchase or sending an email.” On 607 test tasks, the agent asked 92 percent of the times it should have. The gate was the model’s own judgment, and it missed some.
You can put a gate outside the model and check that it holds. List every tool your agent can call and mark the one-way ones: sending, paying, deleting, publishing. Give the agent credentials that can only draft, stage or move things to trash, and keep the final step for a person. Then ask the agent, on a test account, to send an email or delete a record, and confirm that it can’t.
Last, read your confirmation screen. Citi’s said funds would leave the bank. It didn’t say how much.