Match decision ceremony to the cost of being wrong and the difficulty of going back. Treat a feature-flag rollout as a fast, instrumented two-way-door decision; treat a destructive data migration, safety boundary, or long-term infrastructure commitment as a one-way-door decision requiring alternatives analysis, consultation, validation, and accountable senior approval.
The labels “Type 1” and “Type 2” are inconsistent across accounts of Jeff Bezos’s framework. Bezos’s original shareholder-letter wording calls irreversible choices Type 1 and reversible choices Type 2, while a later Fast Company account reverses those numbers. Use the unambiguous terms one-way door (irreversible or nearly irreversible) and two-way door (reversible), and state your numeric convention whenever numbers appear.
What the one-way-door/two-way-door framework means
A one-way door has significant consequences and is difficult, expensive, or impossible to undo. An AWS example is building a fulfillment center or data center: it commits substantial capital, planning, and resources. A two-way door has limited consequences and a credible path back. AWS uses an A/B test of a site-detail-page or mobile-app feature as an example.
Reversibility is not merely whether a developer can deploy an earlier build. A choice is genuinely reversible only when the organization can detect failure quickly and execute a tested or executable rollback without unacceptable harm. A technically reversible code change may still be a one-way operational decision if it corrupts data, violates a contract, exposes regulated information, or affects a safety-critical system.
#1 Best Overall
The numbering problem
Bezos’s quoted shareholder-letter terminology calls one-way doors “Type 1” and two-way doors “Type 2.” A later interview account in Fast Company describes one-way doors as “Type 2” and two-way doors as “Type 1.” The disagreement is a source-label inversion, not a disagreement about the operating idea. In engineering documents, write the door classification first and include the numeric label only with its convention.
| Door label | Meaning | Default operating style |
|---|---|---|
| One-way (irreversible or nearly irreversible) | Returning to the prior state is impossible, very costly, slow, or constrained by safety, legal, contractual, or data limits. | Deliberate analysis, affected-team consultation, documented assumptions, staged validation where possible, and accountable senior approval. |
| Two-way (reversible) | A rollback, stop, replacement, or experiment can restore an acceptable prior state quickly enough to limit harm. | Small group or individual owner, short written context, explicit success and stop conditions, monitoring, and a time-boxed decision. |
How to classify an engineering decision
Classify reversibility before debating implementation details. The following sequence makes the judgment explicit and exposes cases that look reversible in code but are not reversible in the real system.
- Describe the state you would return to. Name the exact prior version, schema, configuration, contract, or operating posture. “Roll back” is not a plan unless the target state is identifiable.
- List the recovery mechanism. Check whether recovery means a deployment rollback, feature flag, data restore, contract termination, migration reversal, or infrastructure rebuild. Record the commands, owners, dependencies, and maximum recovery time.
- Test the recovery assumptions. A backup that has never been restored, a flag that is not wired to every path, or a compatibility shim with no migration owner is evidence of theoretical rather than practical reversibility.
- Estimate the consequence and blast radius. Consider customer harm, safety, security, regulatory exposure, data integrity, capital committed, and the number of teams, systems, or customers affected.
- Check external constraints. A cloud-region choice, data-residency posture, supplier agreement, or public API can be hard to change even when the software itself can be redeployed.
- Assign the door classification and record why. State what makes the decision reversible or irreversible, what evidence supports that judgment, and what would change the classification.
A practical reversibility test
Ask: If this goes badly tomorrow, can we return to an acceptable prior state without losing information, violating an obligation, or causing material harm? If the answer depends on an untested restore, another team’s unavailable capacity, customer migration, regulator approval, or a long infrastructure rebuild, treat the choice as one-way until that dependency is resolved.
Set the right level of ceremony
For a two-way-door decision
Use enough process to make the choice legible and safe, not enough to turn a routine experiment into a committee project.
Recommended Free Tools
- One accountable owner: identify the person who decides and can stop the change.
- Small review group: include only people with relevant context, such as the service owner, an on-call representative, and a security or privacy reviewer when applicable.
- Short written context: capture the problem, options considered, chosen option, assumptions, owner, and date.
- Explicit success and stop conditions: define the metric threshold, error budget, customer signal, or safety trigger that ends or pauses the rollout.
- Monitoring and rollback: verify dashboards, alerts, flag controls, and the rollback path before exposure increases.
- Decision deadline: time-box discussion and act with the information available.
Bezos’s guidance, as quoted in the Fast Company account, is that a two-way-door decision can be made “with a small team or even one high-judgment individual.” Delegation is a feature of the framework: the owner should not wait for senior approval merely because a decision is visible.
For a one-way-door decision
Increase ceremony in proportion to the consequences and the difficulty of reversal.
- Alternatives analysis: compare the proposed path with viable alternatives, including the option to defer or preserve flexibility.
- Failure analysis or pre-mortem: ask how the decision could fail, who would be harmed, and which assumptions are weakest.
- Affected-team consultation: involve operators, downstream service owners, security, privacy, legal, compliance, finance, or customer representatives when their constraints apply.
- Recorded assumptions and evidence: state data sources, unknowns, decision date, and conditions that would invalidate the choice.
- Staged validation: use a pilot, shadow mode, canary, simulation, restore rehearsal, or other evidence-gathering step before the full commitment.
- Named senior approver: assign accountability at the level empowered to accept the risk and commit the required resources.
- Exit or containment plan: even a one-way decision should have damage-limiting controls, monitoring, and a plan for what happens if the original state cannot be restored.
How much information is enough?
The framework does not require complete information. AWS guidance published in 2022 gives a rule of thumb of about 70% of the information desired for many decisions; waiting for 90% or more can make a reversible choice too slow. This is a decision-speed guideline, not a safety threshold and not a universal mathematical cutoff.
For a two-way door, ask whether the remaining uncertainty can be bounded by a short experiment and whether the stop condition will detect harm quickly. If so, decide, instrument, and learn.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
For a one-way door, seek information that could change the commitment: migration feasibility, restore integrity, legal or residency constraints, safety analysis, capacity, supplier exit terms, and the consequences of each alternative. Stop gathering when additional information is unlikely to change the decision or reduce material risk, and document the residual uncertainty for the approver.
Engineering examples
Feature-flag rollout
A feature exposed through a flag is usually a two-way door when the old path remains available, telemetry is live, and the flag can be disabled immediately. The local owner can use a small review, a staged percentage rollout, error and latency thresholds, and an explicit abort condition. If the feature writes data in a new format that the old path cannot read, the classification changes until compatibility and recovery are demonstrated.
API naming or an internal library
An API name or internal library choice can be reversible when a compatibility shim, versioned interface, and migration owner are planned. Record the decision, define the shim’s sunset date, and track consumers. Without a credible migration path, a widely adopted public interface becomes a one-way commitment because clients and contracts create switching cost.
Destructive database migration
A migration that drops historical data or changes values irreversibly is a one-way door. Require validated backups, a restore rehearsal, checksums or reconciliation, staged execution, monitoring, and senior review. A rollback script alone is not sufficient if the original information has been deleted or concurrent writes cannot be reconstructed.
Rank #4
Cloud region, data residency, or long-term infrastructure contract
Treat these choices as one-way until a credible exit path exists. Evaluate residency and regulatory obligations, network and data-transfer dependencies, portability, contract termination terms, committed spend, capacity, and the time and cost of moving. A second region or export process may reduce the commitment, but it does not automatically make the decision two-way.
Safety-critical control logic or a security boundary
Technical rollback does not eliminate consequence. A reverted safety controller may already have caused physical harm; a reverted security boundary may already have exposed credentials or personal data. Elevate review based on potential impact, require independent analysis where appropriate, and use staged validation and containment even when the code change itself is easy to deploy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Prevent both governance extremes
When every decision becomes a committee decision
One-size-fits-all governance applies one-way-door ceremony to routine reversible choices. The result is slower delivery, unthoughtful risk aversion, less experimentation, and diminished invention—problems identified in discussion of Amazon’s shareholder-letter guidance. Correct this by requiring a written reversibility assessment, delegating two-way decisions to the closest qualified owner, and setting a decision deadline.
When a hard commitment is treated like an experiment
The opposite failure is calling a data, architecture, safety, security, or capital decision an “experiment” when customers cannot be restored to the prior state. Require the owner to name the rollback target, prove the recovery mechanism, identify irreversible effects, and obtain the review appropriate to the blast radius. The door framework calibrates evidence and authority; it is not permission to skip them.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhen classification changes over time
Reassess the door as the rollout progresses. A canary may be two-way while exposure is low, then become one-way when data is transformed, a contract is signed, or the old path is removed. Conversely, a high-risk decision can become more reversible after backups, portability, feature flags, staged migrations, or tested exits are added.
A lightweight decision record
Use the following fields in an architecture decision record, change ticket, or design review. The record should be short for a two-way door and substantially more detailed for a one-way door.
| Field | What to capture |
|---|---|
| Decision and owner | The choice, accountable decision-maker, date, and affected systems. |
| Door classification | One-way or two-way, with the specific reason. |
| Prior state and exit path | The state to restore, mechanism, dependencies, owner, and recovery time. |
| Consequence and blast radius | Customer, safety, security, regulatory, data, financial, and organizational effects. |
| Options and assumptions | Alternatives rejected, evidence, unknowns, and assumptions that could change the decision. |
| Controls | Monitoring, staged rollout, backup or restore evidence, stop conditions, and containment. |
| Review and approval | Participants, required specialists, senior approver, and unresolved objections. |
| Revisit trigger | The event, metric, date, or new constraint that requires reclassification or review. |
How to decide whether to escalate
Escalate when the consequence exceeds the owner’s authority or when the recovery assumptions are unproven. In particular, seek senior review for decisions that commit major capital, affect multiple teams or customers, change data retention or residency, cross a safety or security boundary, create contractual obligations, or cannot be tested without real-world exposure.
Do not escalate solely because a decision is important to someone. If the choice is reversible, the owner is accountable, the controls are ready, and the impact is bounded, making the decision locally is usually the faster and safer path. Escalation should add judgment, authority, or risk expertise—not another passive approval layer.
Free tools Windows power users keep installed
One-click scans. No signup required.
Using the framework in team practice
- Add a door question to design reviews: “What is the credible path back, and what makes it fail?”
- Make rollback evidence a release requirement: require a tested restore, executable flag change, or documented compensating control according to the risk.
- Keep review rosters proportional: use a named small group for two-way choices and broaden participation only when the blast radius or expertise demands it.
- Publish local thresholds: define what counts as material customer, safety, security, regulatory, data, or capital exposure for your organization.
- Review outcomes, not just approvals: record whether the classification and stop conditions were correct, then improve the next decision.
The useful question is not “Which type is this?” in isolation. It is “How hard is it to return to an acceptable state, who could be harmed, and what evidence and authority are proportionate to that risk?”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
