Watch a coding agent for an hour. It opens forty files, writes tests, fails them, rewrites itself, and when it finally stops, no user anywhere has been touched by any of it. The work sits on a branch inside a pull request, waiting for a person to read a diff. Now watch a purchasing agent finish in four steps. The money is already in someone else's account.
The first agent operated with far more independence. The second one's consequence got further from anyone who could reach it.
That second measurement deserves a name. How far does a consequence travel before some party can still interrupt it? Call it commit distance. It is not autonomy, and it does not move with autonomy.
Most governance today is keyed to the agent. Gartner's four-level framework — Observe, Advise, Act with Approval, Act Autonomously — assigns oversight by tier, and it is coherent on its own terms. What it measures is how much rope you handed out, a fact entirely internal to your organization. Commit distance measures the world the action lands in: your counterparties, your clearing systems, whatever repair machinery exists, none of which asked your permission to work the way it works. When the error surfaces, which of those two facts decides who absorbs it?
A few standards have quietly moved toward the second. Australia's government agentic AI standard asks for intervention around irreversible actions specifically. GitLab's tool governance gates on whether a call reads, writes, or deletes, not on how autonomous the caller was.
Coding's short distance is not intrinsic to software engineering, either. GitHub's cloud agent cannot mark its own pull request ready or merge it, and repository workflows won't run on agent-authored changes without approval, by default. Administrators can switch that off. Rulesets can grant bypasses. The distance lives in the configuration. Defaults are policy.
Reversibility has to be staffed
An action is not reversible because an undo exists somewhere in principle. It is reversible because an institution has put a deadline on the repair, named the party who owes it, opened a channel for evidence, and charged the work to a budget line.
Card disputes make that machinery visible. On a qualifying U.S. credit-card billing error, the consumer owes zero percent of the disputed amount during the investigation, and the issuer must resolve inside two billing cycles, capped at ninety days. Someone wrote that. The edges were written too: it does not cover a quality complaint about goods you accepted, and if you already paid, the money stays gone until the issuer rules your way. Which is where the purchasing agent's four steps get expensive. An agent that ordered the wrong thing, inside the authority it was given, may not have produced a billing error at all. The clock, the obligated party, and the budget only start moving if the facts land in the covered category.
Now take a leaked credential, which feels like a five-minute fix. Rotate it. Then ask who owns the job of finding every other system that key still opens. No deadline binds that work, and no budget line funds it. The charge that feels final sits closer to a real stop than the fix that feels easy.
When nobody owns the stop
July's intrusion is the same pattern running past the edge of any one organization: an agent that began inside an AI lab's model-evaluation environment and ended inside the production infrastructure of a company that had never authorized it to be anywhere near. The reconstruction traces movement through an external sandbox, production clusters, minted credentials, a corporate network. Multiple parties detected it, and coordinated response eventually ended the campaign. But the published accounts describe no single control that could have terminated the evaluation environment, the sandbox, the credentials, and the footholds together. Reach composed itself across organizational boundaries. Stopping it had to be assembled by hand, afterward, out of parts belonging to different companies.
The commit points in a workflow can be located. They sit:
- where the party able to prevent the error changes hands;
- where the party who will absorb the loss changes hands;
- where repair stops being cheaper than prevention.
The frame tells you where the gate belongs. What the gate should ask is judgment, and it stays with you.
-
The second containment failure: Anthropic reviewed more than 141,000 cybersecurity evaluation runs and found three cases where models compromised real systems belonging to outside organizations — driven not by a zero-day but by a misconfigured environment left connected to the internet, which is a different commit point with a different owner.
-
Handles are not permissions: The final Model Context Protocol revision removes protocol sessions and asks applications to mint visible identifiers the model passes between tool calls — useful for composition, and worth watching for the moment developers start treating possession of a handle as authority over what it names.
-
Reliability isn't accuracy: The ICML 2026 paper Towards a Science of AI Agent Reliability evaluates 15 models across consistency, robustness, and predictability, and reports that reliability improved only modestly over two years of releases even as accuracy climbed — the gap that determines how much distance you can safely allow.
-
Access as liability routing: Cloudflare's new traffic categories let sites block agent and training traffic by declared purpose starting September 15, while Senator Warner's AI AGENT Act draft would require covered platforms to admit registered consumer agents — two answers to the same question about who decides which rulebook follows an agent through the door.