← Back to concept explainers

Concept Fable

Rollback plan

Conclusion first:A Rollback Plan is a recovery plan defined in advance before a change goes live, including trigger conditions, owners, recovery steps, time limits, verification methods, and communication channels. It is more complete than a simple rollback action, emphasizing when to roll back, who decides, how to execute, and how to confirm recovery succeeded. For Agent systems, a rollback plan lets changes to models, prompts, tools, or processes quickly revert to a safe state when problems arise.

Rollback Plan · Operations

Read the story first. There is no rush to give a definition here; let the question grow on its own first.

Fable

Before the stage changed scenery, the troupe leader first wrote out the exit route

The opera troupe in Liyuan Town was preparing a new show. The new set was bigger, the lights brighter, and the stage machinery more complex. The young performers were all excited, believing that as soon as the new show premiered, the audience would certainly applaud.

But the troupe leader did not first rehearse the opening; instead, he had everyone rehearse the exit. What if the light rope breaks, what if the mechanism jams, what if the new set blocks the exit, what if the curtain is found hung backward after the audience is already seated. The actors felt it was unlucky: the play has not even been performed, so why think about failure first?

The troupe leader said the stage's greatest fear isn't a bad new play, but that when the new play fails in front of the audience, the whole troupe doesn't know who moves first, where to retreat, or which old set to bring up as backup. Without an exit route, one small mistake on stage turns into total chaos.

So they wrote an exit sheet. The first column listed trigger conditions: the lights fail to come on three times, a mechanism jams for more than ten breaths, the main set tilts, audience safety is affected. The second column listed the responsible people: lighting technician, props master, deputy troupe leader, front-of-house manager. The third column listed actions: stop the lights, lower the curtain, switch to the old set, change to a shorter opera excerpt, explain to the audience. The fourth column listed time limits: a decision must be made within half a quarter-hour, with no arguing on stage.

On the night of the new play's premiere, the mechanism really jammed. The young actor went pale, but the deputy troupe leader saw the trigger condition and immediately lowered the curtain; the prop master swapped in the old scenery according to the exit list; the front-of-house manager explained to the audience that an extra scene would be added. The audience waited only a moment, and the play went on.

Afterward, some people said it was lucky the response was fast. The troupe leader said it was not fast response, but having rehearsed the actions for failure in advance. What truly saved the day was not on-the-spot cleverness, but the route written before failure occurred.

From then on, whenever Pear Garden Town staged a new play, it first rehearsed the exit. Because the confidence to try new stage sets came not only from believing it would succeed, but from knowing that if it failed, it would not drag down the whole performance.

Later the troupe posted the exit checklist backstage, but found that newcomers only looked at it and did not practice. So the troupe leader deliberately scheduled a small failure once a month: a dim light, a wrong drumbeat, a stuck curtain. Whoever should call stop, whoever should steady the frame, whoever should speak to the audience, all had to actually walk through it. A route on paper only avoids becoming decoration in a panic if it has been rehearsed. The bolder the new play, the clearer the exit must be. Later, the audience did not even know the backstage had gone through a small failure; they only felt that the play had not broken. The troupe leader said a good exit is best kept unseen, but it must always be available.

Reveal

This story is about: rollback plan

A Rollback Plan is a recovery plan defined in advance before a change goes live, including trigger conditions, owners, recovery steps, time limits, verification methods, and communication channels. It is more complete than a simple rollback action, emphasizing when to roll back, who decides, how to execute, and how to confirm recovery succeeded. For Agent systems, a rollback plan lets changes to models, prompts, tools, or processes quickly revert to a safe state when problems arise.

What matters is that it is not just a term, but a structural problem that repeatedly appears in real AI / Agent systems. Understanding it lets you judge when to add a model, when to change a process, and when to add governance.

Metaphor mapping

  • New play and new stage set: new models, prompts, tools, workflows, or system versions
  • Mechanism jams, lamp cord snaps: post-launch failures, quality degradation, latency anomalies, or risk events
  • Plan the exit first: design the rollback plan before launch
  • Trigger conditions: clarify when rollback is mandatory, rather than relying on on-the-spot debate
  • Owner: who has the authority to decide and execute rollback
  • Lights out, curtain down, old scenery swapped: specific recovery steps and alternatives
  • Must decide within half a quarter-hour: the time boundary for rollback decisions
  • The audience only waited a moment: a good rollback plan reduces user-perceptible impact
  • Failure will not bring down the whole show: a rollback plan lets the system dare to iterate while controlling change risk

Andy Ren Xu's judgment

The practical value of this concept is that it helps you break "AI features that look smart" into deliverable, verifiable, and governable units of work.

change managementrelease managementincident responseversioning

Related distinctions

This concept is easily confused with adjacent concepts; it is recommended to continue to the comparison page.

京ICP备2026014272号