Only if you built it so you could. Nothing about an AI agent makes its actions reversible by default, and most of what an agent touches in a CRM has no undo: an email is sent, a deal stage is changed, a contact is merged, an invoice goes out. Australia's own cyber security guidance now tells you to design for this before you deploy, and to treat reversibility as a feature you build rather than a property you inherit.

This is the question a CTO asks about ten minutes into a conversation about agents, usually after everyone else has finished talking about how much time it will save. It is a fair question and most vendors answer it badly.

What Australia's cyber agency actually says

On 1 May 2026 the Australian Signals Directorate's Australian Cyber Security Centre published Careful adoption of agentic AI services, jointly with CISA, the NSA and the Canadian, New Zealand and UK cyber centres. It is the current Australian word on agents and it is easy to miss, because the 2024 page on engaging with AI still looks canonical.

Three of its recommendations are about exactly this problem, and they are worth reading in the original:

  • "Implement versioning and rollback mechanisms to safely revert a system to known-good agent behaviours when unpredictability is observed"
  • "Embed agentic AI systems with fail-safe defaults and containment mechanisms that limit the blast radius of unexpected behaviours"
  • "Strengthen agentic AI system resilience to allow for graceful degradation and reduce damage should erroneous behaviour occur"

The guidance also says something more uncomfortable, which is that you should assume these systems will sometimes behave in ways you did not plan for, and design the deployment on that basis.

Undo is not one thing, it is three

When someone asks whether you can undo what an agent did, they are usually asking three separate questions at once. Separating them is most of the work.

Can you stop it? An agent mid-task needs an interruption point. The ACSC guidance calls for "live monitoring and interruption during task execution". If the only way to stop a run is to disable the integration, you do not have a stop button, you have a circuit breaker for the whole system.

Can you reverse the individual action? This depends entirely on what the action was, and the honest answer is that some of them cannot be reversed at all. A changed field can be restored. A merged record is painful. A sent email is gone.

Can you roll the agent back? Different question again. This is about reverting the agent's own behaviour, its prompt, its tools and its permissions, to a version that was working. The guidance is explicit about wanting "versioning and rollback mechanisms", and this is the one most teams skip, because it feels like a deployment concern rather than a safety one.

The actions that cannot be undone, and what to do about them

Some things an agent can do in a CRM have no reverse gear. Once you accept that, the design changes: you stop trying to make everything reversible and you start sorting actions by whether they are.

Roughly, in a HubSpot portal:

  • Reversible with a record of the old value. Property updates, deal stage changes, list membership, task creation, internal notes.
  • Painful but recoverable. Associations, record merges, bulk imports. Recoverable in the sense that someone spends a day on it.
  • Gone. Anything that left the building. Sent email, SMS, an invoice, a Slack message, a webhook that fired into another system, a booking confirmation.

The design rule that falls out of this is simple. Anything in the third group gets a human approval step before it happens, because after it happens there is nothing to undo. The ACSC guidance puts the same idea as "mandatory human approval for decision-making steps".

That is also why the second group matters more than it looks. An agent that can merge records unsupervised is one bad match away from a day of manual repair, and nothing about it will look like an error at the time.

Why "just log everything" is not the answer

Logging tells you what happened. It does not put anything back.

A log is necessary and it is not sufficient, and the gap between those two is where most of the pain sits. If an agent updated 400 records overnight on a wrong assumption, a log tells you which 400. Restoring them needs the previous values, which is a different thing to store, and it needs a way to apply them in bulk, which is a thing to build.

We wrote about the related failure in the failure nobody builds for, your AI agent stops being useful and says nothing. Silent wrongness is worse than loud breakage, because nobody goes looking.

The Australian wrinkle: you may have to explain the decision

From 10 December 2026, the Privacy and Other Legislation Amendment Act 2024 requires an Australian privacy policy to disclose automated decision-making that significantly affects an individual.

That matters here for a reason that is not obvious. Being able to undo an action and being able to explain it are the same underlying capability: you need a record of what the agent decided, on what information, and what the state was before. A system built so it can be reversed is usually a system that can answer the disclosure question too. One built without that has to solve the problem twice.

We covered what has to go in your privacy policy from 10 December separately.

What we do on client builds

Three things, every time, before an agent touches production.

We sort the actions first. Every action the agent can take goes into one of the three groups above, on paper, before anything is built. The ones in the third group either get a human approval step or they get cut from version one.

We store the before state. For anything the agent can change, we keep the previous value with the run that changed it. Not in a log, in something you can read back and reapply. This is unglamorous and it is the entire difference between a bad night and a bad fortnight.

We give it a stop that is not the off switch. A way to halt the current run and a way to revert the agent to its last known-good configuration, separately from disabling the integration.

Then we test it, which is how we test an AI agent before it goes near a customer. Part of that test is deliberately letting it do something wrong and putting it back.

In short

Undo is a feature you build. An agent's actions are not reversible by default, and a meaningful share of what an agent does in a CRM cannot be reversed at all.

Sort the actions by whether they can be undone, put a human in front of the ones that cannot, store the previous state for the ones that can, and give yourself a way to roll the agent's own configuration back. Australia's cyber security guidance asks for all four, and it asks for them at design time, because none of them can be retrofitted comfortably.

Frequently asked questions

Can you undo an AI agent's actions in HubSpot? Some of them. Property changes, deal stage moves and list membership can be restored if you stored the previous value. Merges and associations are recoverable with effort. Anything that was sent, such as an email, an SMS or an invoice, cannot be undone at all.

What does the ACSC say about AI agent rollback? Its Careful adoption of agentic AI services guidance, published 1 May 2026, recommends implementing versioning and rollback mechanisms to revert a system to known-good agent behaviours, embedding fail-safe defaults and containment mechanisms that limit the blast radius of unexpected behaviour, and building in human control points including interruption during execution.

Is an audit log enough to undo what an agent did? No. A log records what happened but does not store what the values were beforehand, so it tells you what to fix without giving you the means to fix it. Reversibility needs the previous state stored and a way to reapply it.

Which agent actions should need human approval? Any action that cannot be reversed once taken. In practice that means anything leaving your systems, such as email, SMS, invoices, booking confirmations and webhooks into other platforms.

Sources

Thinking about putting an agent into your CRM and want the undo question answered before you start? Talk to us.