jj itself doesn't have a native ‘push’. `jj git push` and `jj piper upload`¹ operate on external systems that don't necessarily support undoing arbitrary operations. Pure speculation, but if I were ESRC I'd make my backend handle it (subject to enterprise audit policies).

¹ https://drive.google.com/file/d/1dVzug1lHoOxdbFu8gcCJCu-G_uV...