I’d only trust this with explicit rollback authority, tight blast radius limits, and a full event log. Making recovery boring is the real win.