UNDO — Alexa+ Action Governance & Reversibility Layer

UNDO DASHBOARD

Inspiration

AI assistants are becoming more capable of understanding natural language and performing tasks for users. However, as AI agents gain the ability to take actions, an important question arises: what happens when an AI misunderstands a request, attempts an unsafe operation, or makes a change the user later regrets?

I wanted to explore how AI assistants could become safer and more trustworthy by introducing risk assessment, human approval, and reversibility into the action-taking process.

This inspired me to build UNDO — Alexa+ Action Governance & Reversibility Layer, a project designed around a simple principle: an AI agent should not only understand what a user wants to do, but also evaluate whether the action is safe and how recovery could work if something goes wrong.

I chose the Alexa+ track because UNDO demonstrates how a conversational assistant experience can be extended with a safety and governance layer. I implemented it as a simulated web experience rather than a physical Alexa device integration.

What it does

UNDO acts as a safety and governance layer between an AI assistant's proposed actions and their execution.

Its key features include:

Natural-language action planning: Users can express requests in everyday language, and Gemini helps interpret them into proposed actions.
Risk-based policy enforcement: A deterministic policy engine classifies actions as ALLOW, REQUIRE_APPROVAL, or BLOCK.
Human-in-the-loop approval: Sensitive actions require explicit user approval before execution.
Test Before Execute: The UNDO Safety Simulator tests proposed actions in an isolated sandbox before they are considered for execution.
Failure scenario analysis: The simulator examines potential issues such as invalid inputs, state conflicts, persistence failures, policy restrictions, and rollback recovery.
Undo and recovery: Supported actions can be reversed, with state comparisons used to help verify recovery.
Action history and auditing: The application records actions to improve transparency and help users understand what happened.
MCP tool integration: A Model Context Protocol server exposes tools for household state, grocery management, reminders, simulated door locks, action history, and undo operations.

UNDO also distinguishes simulation from authorization: passing a safety simulation does not bypass the normal policy checks or approval requirements.

How we built it

I built UNDO using a full-stack architecture that combines AI-based planning with deterministic governance.

The frontend uses React, TypeScript, Vite, and Tailwind CSS to provide an interactive dashboard for submitting requests, reviewing policy decisions, testing actions, approving sensitive operations, and viewing action history.

The backend uses Python and FastAPI to handle requests, enforce policies, execute supported actions, and manage application state. SQLite stores household-style data and action history, while Google Gemini, integrated through the official Google GenAI SDK, helps interpret natural-language requests and generate action plans. A fallback parser supports basic request handling when the AI service is unavailable.

The policy engine remains separate from the language model so that an AI-generated plan cannot independently override safety rules. Supported actions pass through policy evaluation before execution.

For the Safety Simulator, I implemented an isolated in-memory SQLite sandbox. It starts with a copy of the relevant baseline state, evaluates a proposed action, examines possible failure scenarios, and checks whether rollback restores the expected state without directly changing the live application database during simulation.

I also developed an MCP server using the Python MCP SDK and Streamable HTTP to expose seven tools for interacting with the application's supported capabilities.

The project was tested through backend tests, frontend production builds, and an end-to-end verification workflow during development.

Challenges we ran into

One of the biggest challenges was separating the AI's ability to propose an action from the authority to execute it. An LLM can interpret a request, but its output should not be the only factor deciding whether an operation is safe. I addressed this by using a deterministic policy engine and keeping approval requirements separate from AI planning.

Another challenge was designing a simulator that would test proposed actions without accidentally modifying live application data. I used an isolated in-memory database and state comparisons to help evaluate changes and rollback behavior.

Undo functionality also required careful consideration. Not every operation is reversible, and a successful rollback attempt should not automatically be treated as proof of recovery. I therefore limited undo support to supported actions and explicitly blocked destructive or unsupported operations.

Integrating the frontend, backend, Gemini API, SQLite, MCP tools, and deployment environments introduced additional configuration and connectivity challenges. These experiences reinforced the importance of verifying the complete workflow instead of relying only on individual service health indicators or a successful build.

Accomplishments that we're proud of

Built a working full-stack prototype that combines natural-language planning with explicit action governance.
Implemented three clear policy outcomes: ALLOW, REQUIRE_APPROVAL, and BLOCK.
Developed the Test Before Execute safety simulation workflow to examine proposed actions before execution.
Separated simulation, authorization, execution, and recovery into distinct stages.
Added support for reversing selected actions and maintaining an action history.
Integrated MCP tools to expose the application's capabilities through a structured tool interface.
Built an interactive web experience that demonstrates the concepts of a conversational assistant without requiring physical Alexa+ hardware.
Developed the project with a focus on safety boundaries, transparency, and failure handling rather than treating successful execution as the only measure of an AI agent's quality.

What we learned

This project helped me understand how to combine LLM-based natural-language understanding with deterministic software controls. I learned more about backend API development, database state management, MCP tool integration, sandboxing, approval workflows, and rollback verification.

I also learned that AI safety needs to be considered throughout the action lifecycle. A model can generate a useful plan, but the system still needs to validate the request, enforce policies, request approval when necessary, record what happened, and handle failures carefully.

Another important lesson was that testing failure cases is just as important as testing successful actions. Simulations, audit trails, and recovery mechanisms can make an agent easier to inspect and more predictable, but they must be designed with clear limitations.

The biggest takeaway is that trustworthy AI is not just about making agents more capable; it is also about controlling how they act and making failures easier to detect and recover from.

What's next for UNDO — Alexa+ Action Governance & Reversibility Layer

My next goal is to make UNDO more robust and extend its governance capabilities.

Planned improvements include:

Stronger rollback verification: Improve recovery checks and clearly report when an action cannot be fully reversed.
More realistic safety testing: Expand the simulator with additional failure scenarios, conflicting requests, and edge cases.
Better explanations: Show users why an action was allowed, requires approval, or was blocked.
More granular permissions: Introduce configurable policies based on action type, impact, and risk.
Improved auditability: Strengthen action records and provide clearer explanations of the steps taken.
Broader integrations: Explore connections with real assistant platforms and additional tools while maintaining explicit safety boundaries.
More comprehensive testing: Continue testing the complete workflow, including API connectivity, approval enforcement, execution, and recovery.

The long-term vision is for UNDO to serve as a reusable governance and reversibility layer for AI agents—not only conversational assistants, but any system that can take actions on a user's behalf.

UNDO aims to make AI actions safer by testing before execution, requiring human oversight when needed, blocking prohibited operations, and supporting recovery wherever reversal is possible.