Saga compensation design
Continue a saga with one irreversible effect
When a completed step cannot be undone, stop describing recovery as rollback. Establish the remaining business options and preserve the effects already known to exist.
In this article
Confirm the irreversible state
Locate the saga and each operation result. Verify the claimed irreversible effect with its owning service. A timeout or a vague status message is not enough to conclude that a shipment was collected or a notification delivered.
Resolve uncertain calls before choosing a recovery path. The difference between a rejected carrier booking and an accepted booking with a lost response changes the options available.
Keep the original identifiers and evidence. Do not reset the saga to its first step in an attempt to make the state machine easier to read.
Reassess the business outcome
Work with the designated owner to choose among continuing fulfilment, issuing a corrective action or handling a manual exception. The original compensation plan may no longer be valid after an external state change.
For example, releasing all reserved stock while a shipment is already in progress can create another inconsistency. Recovery should be scoped to the actual remaining effect, not a blanket reversal of every earlier step.
Record the decision and authority for any new corrective operation. A support intervention is still a business action with consequences.
Execute through supported operations
Use the service's normal correction or reconciliation endpoints where possible, with stable operation identifiers. Avoid direct data edits that leave downstream systems and audit records out of agreement.
Prevent concurrent automated recovery from racing with the manual action. Put the saga into an owned intervention state or use the platform's supported coordination mechanism.
If a correction itself becomes uncertain, preserve that uncertainty and reconcile it. Manual initiation does not eliminate the lost-response problem.
Close with the actual final state
Verify the outcome across participating services and update the saga record with the resolution. Explain to the user what completed and what corrective work occurred without claiming that history was erased.
Capture why the irreversible state was not anticipated or handled automatically. It may require a different step order, a reservation phase or a clearer business exception process.
A successful incident response reaches an acceptable present state and leaves a truthful trail. It does not need to pretend the distributed workflow returned to an identical past state that is no longer possible.
Primary sources
Microsoft Learn: compensating transactionsOWASP: logging guidanceReferences checked 11 September 2026.