Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesA saga cannot automatically roll back committed work across services. Each service commits its own local transaction; if a later step blocks the business process, the saga may retry, take an alternate route, or run application-specific compensating transactions for work already completed. Those compensations can fail and do not guarantee restoration of the exact original state. The key to safe saga rollback mechanics is durable step tracking, deliberate compensation ordering, and a recovery path for partial execution.
What “rollback” means in a saga
A saga coordinates a business process as a sequence of local transactions, each committed by the service that owns its data. Coordination can happen through events exchanged by participants or through an orchestrator that directs the steps. If the process cannot continue, compensating transactions perform business operations intended to counteract completed steps. They are not a distributed ACID rollback: they do not erase earlier commits or provide a single all-or-nothing transaction across databases. Microsoft’s saga guidance and Microservices.io’s saga pattern overview describe this local-transaction model.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters for failure atomicity. Each participant can make its own local transaction atomic, but the saga does not make the entire multi-service workflow globally atomic or isolated. After one service commits and before later work or recovery completes, different services can represent different stages of the business operation. This temporary inconsistency is part of the eventual-consistency model; losing track of it or reporting recovery as complete when it is not turns it into a correctness problem.
Compensation is a domain operation, not necessarily the inverse of a database write. For example, releasing a reservation may be appropriate, while restoring an old snapshot could overwrite legitimate changes that occurred after the reservation. Microsoft states: “A compensating transaction doesn’t necessarily return the system data to its state at the start of the original operation.” — Microsoft Azure Architecture Center, Compensating Transaction pattern.
#1 Best Overall
How to reason about compensating transaction ordering
Start with the dependency graph and business invariants, not the rule “always reverse the steps.” For every forward action, identify what it depends on, what other work depends on it, whether customers or external systems can already see its effect, whether it can be repeated, and whether it can be undone at all.
- Map effects and dependencies. Record the forward sequence, dependencies between effects, and the invariant the business process must preserve.
- Choose the compensating action for each effect. Specify the domain-correct corrective operation and retain the context it needs, such as the reservation or authorization being released.
- Order recovery by dependency and risk. Reverse forward order is a useful starting point for dependent steps, but not a universal requirement. Prioritize actions according to the risk of leaving a participant inconsistent; independent compensations may run in parallel if their dependencies and consistency risks permit it. Microsoft’s compensation guidance explicitly allows the undo order to differ from the original order.
- Mark points of no return. Where possible, delay irreversible, externally visible, or legally binding actions until critical validations are complete. If an action cannot be compensated, define an alternate resolution or review path rather than implying that a full unwind is possible.
- Account for concurrent changes. Apply corrective operations against current, validated state; do not blindly restore a stale snapshot. Use controls such as version checks or rereads where the domain requires them.
A compensation can itself fail or be delayed. Track each compensation separately from its corresponding forward step, and do not mark the overall recovery complete until the required actions have succeeded or the workflow has been explicitly handed off for resolution.
Retry, compensate, continue, or pause?
The recovery direction depends on whether forward progress remains valid, not merely on whether a step returned an error. AWS distinguishes failure handling that continues, retries, or compensates; Microsoft also describes alternate services and human intervention as possible choices. AWS Prescriptive Guidance and Microsoft’s compensation pattern provide the underlying guidance.
| Situation | Recovery direction | Key constraint |
|---|---|---|
| Temporary network or infrastructure failure | Retry the local transaction and continue forward if the operation remains valid. | Repeated execution must be safe; design participants to handle duplicate attempts idempotently. (AWS saga patterns; Microsoft saga pattern) |
| Nontransient business failure, such as invalid payment | If the process cannot proceed, compensate the completed work that must be counteracted. | Compensation follows domain rules and may not restore the exact prior state. (AWS saga patterns; Microsoft compensating transaction pattern) |
| A valid substitute or alternate route exists | Continue through the fallback path if it still satisfies the intended business outcome. | Do not trigger a full unwind automatically when a customer choice or domain rule should determine the route. (Microsoft compensating transaction pattern) |
| Outcome is ambiguous or high impact | Pause for human review where appropriate. | Preserve workflow state so an operator can resume or compensate with the necessary context. (Microsoft compensating transaction pattern) |
| A compensation fails | Retry safely, record the recovery status, alert, and escalate when needed. | The affected services may remain inconsistent until recovery succeeds or a manual resolution is completed. (Microsoft saga pattern; Microsoft compensating transaction pattern) |
The partial execution trap: order, inventory, then payment
Suppose an order service creates an order, an inventory service reserves stock, and a payment service then rejects the authorization. The first two local transactions have already committed. The payment failure does not delete the order or automatically release inventory; it creates a partially executed business process that needs a deliberate next action. AWS uses this kind of order, inventory, and payment sequence to illustrate saga recovery. AWS Prescriptive Guidance.
If the payment failure is transient, the workflow can retry while forward progress is still appropriate. If payment is invalid or retries cannot restore progress, the business may decide to cancel or amend the order and release the inventory reservation. A different business may offer another payment method, substitute a product, or pause for review. The right choice depends on the process rules; “compensate” is not itself a decision about which customer outcome is correct.
The trap is not simply that services can disagree temporarily. It is treating that in-between state as if it had disappeared, or losing the information required to resolve it. A safe recovery design needs durable records of completed steps and compensation attempts, correlation across services, and a visible state for work that is retrying, compensating, blocked, or awaiting intervention.
Designing recovery that survives retries and failures
Every participant and coordinator should assume messages or operations may be delivered more than once and that a process may stop between any two steps. Microsoft recommends recording execution state and compensation information, retrying transient failures, and escalating compensation that repeatedly fails. AWS also highlights idempotency and observability as orchestration concerns. Microsoft saga guidance; Microsoft compensating transaction guidance; AWS saga orchestration guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Persist progress. Keep durable workflow state for each forward action and its corresponding recovery action so the process can resume after a service or coordinator restart.
- Make retries safe. Use idempotent operations or equivalent duplicate detection for both forward transactions and compensations; distinguish a repeated request from a new business action.
- Publish state changes reliably. A service that updates local data and emits an event must avoid losing one side of that pair. Microservices.io identifies the transactional outbox and event sourcing as related approaches to reliable state and message publication. Microservices.io: Saga.
- Correlate and monitor both flows. Carry a workflow identifier through participant logs and events; alert on stuck forward steps and incomplete compensation rather than only on service errors.
- Provide escalation and resumption. Define who or what receives repeated failures, what evidence they need, and how an operator can safely continue or resolve the workflow.
Sagas do not provide isolation
Local atomic commits and compensations do not stop concurrent sagas from observing or changing data in conflicting ways. Potential anomalies include lost updates, dirty reads, and fuzzy or nonrepeatable reads. AWS and Microsoft describe this lack of isolation as a saga concern. AWS saga orchestration guidance; Microsoft saga guidance.
Choose controls that fit the business invariant rather than assuming compensation will repair every conflict. Options include semantic locks that mark a resource as involved in an in-progress workflow, versioning or recording operation order, rereading values before updates, and commutative updates where operations can safely be applied in different orders. These measures reduce the chance that an otherwise valid compensation overwrites newer work.
Choreography or orchestration?
Both approaches coordinate local transactions; neither turns the saga into a cross-service ACID transaction. Their practical trade-offs are about where workflow decisions and state live.
| Dimension | Choreography | Orchestration |
|---|---|---|
| Coordination | Participants react to events and publish events that other participants handle. (AWS saga patterns; Microsoft saga pattern) | A coordinator directs participants and interprets workflow state. (AWS saga patterns; Microsoft saga pattern) |
| Workflow visibility | Can be difficult to follow as event dependencies and participants grow. (AWS saga patterns; Microsoft saga pattern) | Central workflow logic can make a complex process easier to inspect, while concentrating coordination logic. (AWS saga patterns; Microsoft saga pattern) |
| Main operational concern | Understanding and testing the distributed event dependency graph. | Maintaining the coordinator and handling its availability as well as participant failures. AWS identifies orchestrator availability as a concern. (AWS saga orchestration pattern) |
| Common fit | A relatively small participant set where event-driven coordination remains understandable. (AWS saga patterns; Microsoft saga pattern) | Flows with enough steps or branches that explicit workflow state and direction improve clarity. (AWS saga patterns; Microsoft saga pattern) |
AWS documents AWS Step Functions as one way to implement saga orchestration across multiple databases, including order, inventory, and payment compensation. It is an implementation example, not a requirement for using the saga pattern. AWS saga orchestration pattern.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
