The Red Button vs Blue Button Problem

The framework, briefly

Bezos has used the one-way-door / two-way-door framing in shareholder letters and interviews since the late 1990s. The argument runs as follows. Most decisions in a large organization are two-way doors: the cost of being wrong is low because the decision can be reversed at modest cost. For these, the right discipline is speed and delegation; high-quality decisions can be made with roughly 70 percent of the information you wish you had, and waiting for more is itself a cost. A smaller set of decisions are one-way doors. The cost of being wrong is high because the decision cannot be reversed at modest cost. For these, the discipline is the opposite: slow down, name senior accountability, write the reversibility cost down before deciding, and ensure the decision survives scrutiny from the people who will live with it.

The framework is symmetric. Treating a two-way-door decision as one-way is the slow-organization failure mode: meetings on meetings, decisions that should be made by managers escalated to executives, products that ship a quarter late because the reversibility analysis was unnecessary. Treating a one-way-door decision as two-way is the move-fast-and-break-things failure mode: a default-retention posture set in week two of a launch that becomes a regulatory event in year two. Both errors are common. AI governance in 2026 is unusually prone to the second one because the engineering surface feels malleable and the operational consequences land later.

Why model selection is conditional

The model selection decision is the gate where engineering instinct is closest to right. At most enterprise scales the model itself can be swapped in 60 to 120 days if the integration was architected with portability in mind. The conditional part is the architecture: if the prompts are hard-coded to a specific model’s instruction-tuning quirks, if the evaluation harness has been built for a specific output format, if the agent tooling has been wired to a specific function-calling syntax, the swap cost grows with each layer. The discipline is to make the model decision quickly and the architecture decision deliberately, because the second is what determines whether the door stays two-way.

For a CAIO running the governance side of this, the practical artifact is a portability spec: a written description of how the AI program could move to a different provider, with timelines and costs estimated at the current state. Re-audit the spec quarterly. A model selection decision that is two-way at launch can become one-way by year two if no one tracked the accumulating integration depth.

Why data retention is almost always one-way

The default data retention posture set on day one of a customer-facing AI feature is the gate most often misclassified. The engineering team treats it as a configuration value that can be changed in a future release. In operational reality it is one of the closest things to a one-way door in the framework. Customers form expectations about what is retained and for how long. Sales and marketing build the value proposition around the posture. Regulators may codify the position as a baseline expectation in the sector. Changing the default later requires a customer-communication event, often triggers attrition, and in some jurisdictions requires regulatory notification.

The reversibility cost of changing a retention default 18 months after launch is in the same order of magnitude as the cost of changing a public regulatory positioning. The framework treats it that way. The decision belongs at the CAIO and General Counsel level, with explicit written-down options and trade-offs, and a board awareness moment.

A review schedule that actually runs

A framework that is invoked only at the decision moment is a framework that misses the slow accumulation of reversibility cost. The schedule below is the cadence that makes the framework operational rather than ornamental.

The TBPN bit, and where it sits in the toolbox

The TBPN red-button-blue-button segment is a memory device that travels well across a leadership team. It is useful for that reason and not because it is the rigorous version of the framework. The rigorous version is Bezos, and the practical version for AI in 2026 is the six-gate mapping on this page. Use whichever metaphor your audience absorbs; do not let the metaphor do the work. The work is naming the door, writing the reversibility cost, and assigning the named owner before the decision goes through.

Cross-link: the framework feeds the broader governance work. The AI governance hub covers the top-level operating model; the AI governance roles page covers who owns which gate; the vendor capture risk page covers a related decision class where reversibility erodes silently over time.