ANSWER
What is a rollback when retiring a legacy system?
Reviewed · Reviewed by Paulo Pierrondi, founder.
A rollback, in Legacy Exit, restores the previous operation and reconciles state. It is not the Brake. It is not the dual-run and it is not a rewrite of the system. Brake and rollback are not the same exit. Brake stops the new execution immediately, without a ticket and without depending on the provider. Rollback restores the previous operation and reconciles state, and it can require additional steps. A document alone is not a ready plan. It is ready when the return was rehearsed, access works and the decision has an owner. Rollback comes before the cut, not after the surprise. The checklist defines the return trigger, who can invoke it, data state, maximum recovery time, communication, dependencies and proof that the legacy operation can still resume. An ambiguous trigger does not count: the authority who can return is named. The rehearsal records the restore point, synchronization, reconciliation and the treatment of in-flight transactions, and it confirms that legacy access, infrastructure, staff and vendor remain available in the window. Validity is explicit. The plan expires when access, data, dependencies, staff or architecture change, and it must be reviewed before each cutover. The return is tested in a representative environment. Evidence, contacts, communication, the go or no-go decision and the plan validity enter the same pack. Cutover stays blocked until the rehearsal and the evidence are in the Trail. Authorization is human. The agent does not shut the legacy system down by itself. During dual-run both sides receive the same inputs, produce comparable outputs and the replacement has no production effect. Writes stay off. The legacy system stays in command, as the live operation, and the candidate runs beside it, in shadow. If equivalence is not proven, the valid outcome is not to cut over. The checklist is at /en/answers/rollback-checklist-before-cutover/. What a cutover is is at /en/answers/what-is-a-cutover/. None of that replaces human approval of the cut.
Step by step
- Define objective rollback triggers and the authority that can invoke them without ambiguous escalation.
- Record restore point, synchronization, reconciliation and treatment of in-flight transactions.
- Confirm legacy access, infrastructure, staff and vendor availability during the window.
- Test the return in a representative environment and measure RTO, accepted loss and manual steps.
- Attach evidence, contacts, communication, go/no-go and validity to the Evidence Pack.
How an agent does this
In AgenticosCore, Brake stops the new execution while rollback follows the approved process plan. Cutover remains blocked until the rehearsal and evidence are recorded in Trail. The checklist is at /en/answers/rollback-checklist-before-cutover/.
Frequently asked questions
Are Brake and rollback the same?
No. Brake stops the new execution. Rollback restores the previous operation and reconciles state, which can require additional steps.
Is a rollback plan ready when the document exists?
No. A document alone is not a ready plan. It is ready when the return was rehearsed, access works and the decision has an owner. Without that, cutover stays blocked.
Primary sources
- AI RMF Core — NIST
- Retiring service components securely — UK Government Security