Identify what can and cannot be undone
List each step’s side effects, whether it is reversible, and the time window for reversal. A database write may be reversible while a delivered email, external payment, or physical action may require a follow-up rather than literal rollback.
Define the compensating behavior with the business owner: refund versus void, cancellation versus deletion, or a correction record. Make the action idempotent and tie it to the original operation so retries do not compensate twice.
Keep recovery visible
Record the original step, compensation attempt, and final state with correlation identifiers. If compensation fails, route the workflow to a reviewable state instead of marking the entire process successful or silently abandoning it.
Test failures at every boundary, including after the original side effect succeeded but before its response was stored. Document which outcomes require human review and how operators safely resume the process.