Evidence at each level
Ask for evidence at each level separately: a rollback test against the current build, a rehearsal at production volume, and a priced estimate of what withdrawal would cost in contracts and commitments.
Three kinds of reversibility
Technical, operational, and institutional reversibility are separate claims, and only the third decides whether a correction will ever be used.
Technical reversibility means the switch works. Operational reversibility means staff and fallback procedures can cope when it is used. Institutional reversibility means the organization can survive having used it.
Each level needs its own evidence. A system can pass the first and fail the other two.
A hypothetical case. A hospital scheduling system passes its rollback test in staging. A withdrawal rehearsal then shows the clinic cannot process a day of referrals by hand, and the contract carries an exit fee larger than the annual budget. The technical level passes. The other two fail.
In the glossary: Institutional reversibility.
Mechanism, drawn
Three levels of reversibility
A correction that would cause unacceptable damage will not be exercised, and a correction that will not be exercised is not part of the control system.
In practice
What to look for
A rollback test reported as reversibility
A passing rollback test is reported as reversibility. The switch works, but nobody has ever used it, so the two levels that matter are never measured.
Rollback, backlog, and exit cost
Publish the rollback success rate and recovery time, the backlog that built up per hour of fallback in the last rehearsal, and the estimated cost of withdrawal, tracked as dependence on the system grows.
Where the standards use it:
- Law VI: nominal is not operational reversibility (doctrine). The law behind the three levels, and the standards that apply it.
- Dependence and reversibility (eval). Test the three levels against a real deployment, including a withdrawal rehearsal.
- Dependence: reversibility. The branch of the taxonomy that lists owners and readiness for this work.
Can a system pass level three but fail level one?
Rarely, and it usually means nothing important depends on the system yet. The levels tend to fail from the top down. That is why teams that test only the switch report reversibility they do not have.
How often should a withdrawal be rehearsed?
On a stated schedule that holds in busy quarters. A rehearsal canceled because of load is evidence about operational reversibility. Record it as such.