COMMON PITFALL
Two-way door decisions: price the undo first
The test is not whether the code can be reverted. It is what it costs to undo for customers, data, and promises.
By Michael Tor · October 2026
A two-way door decision is one you can walk back: if it turns out wrong, you can get back to where you were. Jeff Bezos called these Type 2 decisions in his 2015 Amazon shareholder letter, noting a one-way door is one you cannot (Type 1). The useful test is not whether the code can be reverted. It is what it would cost to undo for customers, data, prices, and promises - what Shane Parrish at Farnam Street calls the cost-to-undo test. Price the undo first, pull out any one-way piece hidden inside the change, and then pick the speed: fast and small for two-way doors, slow and consulted for one-way doors.
Who is this for?
Product managers and engineering leads who use "it's a two-way door" or "that's a one-way door" to set how fast a product call gets made, whether it is a deprecation, a pricing change, a data-model shift, or a promise to a customer. The tension is structural. The label decides the speed and who gets consulted, but it is usually picked by whoever wants that speed. The cost of undoing it lands on people who are not in the room.
What is the revert-button failure mode?
The team calls it a two-way door because the code can be rolled back. But the parts that cannot go back to where they were - a public announcement, migrated data, a price customers saw, a promise sales made - are never priced. As Bezos noted, a one-way door means you cannot get back to where you were before. The inverse is just as bad. A nervous sponsor calls everything one-way, and small reversible calls get the slow, consult-everyone process Bezos warned about. He called this "one-size-fits-all" decision making.
A hypothetical example: A team decides to retire an old CSV export that a newer reporting screen replaced. In the revert-button version, they say "it's a two-way door, the code stays in the repo." They announce the removal to all customers and delete the stored export history. Customers who built a weekly workflow on the export file complain. Turning the button back on does not bring back the deleted history or un-send the announcement. In the priced version, the team names the one-way pieces: the public announcement and deleting stored history. They keep the history, hide the export for new accounts only, watch who asks for it, and make the announcement a separate, slower call.
How do you tell which door you're at?
Check the undo price before you pick the speed.
-
"Going back" is spelled out for this call.
It means back to where customers and data were, not back to the last commit, as Bezos defined it.
-
The undo has a rough price and a named payer.
Following Parrish's cost-to-undo test, the payer is often support, sales, or customers, not the team making the call.
-
The one-way piece inside the two-way change is pulled out.
You handle the irreversible part slowly while the rest ships fast.
-
The team looked for a way to make the door two-way first.
Martin Fowler from IEEE Software advises eliminating irreversibility in software designs - using a flag, a few accounts first, keeping the old path, or a migration that runs backward.
-
The process matches the door.
Two-way calls are made quickly by one person or a small group (Bezos), while one-way calls get wider consultation and are made as late as possible (Parrish).
-
The label came from the undo price, not from who wants to move.
If the person calling it a two-way door is the one who wants to ship it, someone else checks the undo price, and you write down which door you called in your product decision log.
When does the door test help?
It helps when a team is slow on small calls and needs permission to move. Bezos warned that heavy-weight process on Type 2 calls leads to slowness and unthoughtful risk aversion. It also helps when a change touches customers, prices, data, or public interfaces and someone needs to find the piece that cannot go back. Finally, it works when an architect or engineering lead can make a door two-way with a flag or a reversible migration, as Fowler suggested.
When does it hurt?
It hurts when "two-way door" becomes a phrase that ends the discussion. The label gets used as a status claim to bypass sign-off. Conversely, it fails when every call gets labeled one-way and nothing ships. If the undo is never priced and the label is just a guess, the label becomes a reason to skip the thinking, which shows why fast shipping is your biggest liability.