Use when building or changing a system whose actions are irreversible — moving money, trading, production deploys, data deletion, external sends. Gate every live action behind dry-run, explicit go-live signoff, a kill switch, and blast-radius limits, and default to the reversible path.
