Should AI agents ever be allowed to perform non-reversible customer actions?

We used to think the safest rule for AI permissions was letting agents execute any task that could be easily undone in the database.

But we learned the hard way that database rollbacks don't fix customer relationships like when an agent automatically sends an incorrect status update or marks a feature request as "planned" without human context. Once the customer sees it the damage is already done.

How does your team handle permission boundaries for agents handling live product decisions?