Commit Distance: How Far a Consequence Gets Before Anyone Can Stop It

Watch a coding agent for an hour. It opens forty files, writes tests, fails them, rewrites itself, and when it finally stops, no user anywhere has been touched by any of it. The work sits on a branch inside a pull request, waiting for a person to read a diff. Now watch a purchasing agent finish in four steps. The money is already in someone else's account.

The first agent operated with far more independence. The second one's consequence got further from anyone who could reach it.

That second measurement deserves a name. How far does a consequence travel before some party can still interrupt it? Call it commit distance. It is not autonomy, and it does not move with autonomy.

Most governance today is keyed to the agent. Gartner's four-level framework — Observe, Advise, Act with Approval, Act Autonomously — assigns oversight by tier, and it is coherent on its own terms. What it measures is how much rope you handed out, a fact entirely internal to your organization. Commit distance measures the world the action lands in: your counterparties, your clearing systems, whatever repair machinery exists, none of which asked your permission to work the way it works. When the error surfaces, which of those two facts decides who absorbs it?

A few standards have quietly moved toward the second. Australia's government agentic AI standard asks for intervention around irreversible actions specifically. GitLab's tool governance gates on whether a call reads, writes, or deletes, not on how autonomous the caller was.

Coding's short distance is not intrinsic to software engineering, either. GitHub's cloud agent cannot mark its own pull request ready or merge it, and repository workflows won't run on agent-authored changes without approval, by default. Administrators can switch that off. Rulesets can grant bypasses. The distance lives in the configuration. Defaults are policy.

Reversibility has to be staffed

An action is not reversible because an undo exists somewhere in principle. It is reversible because an institution has put a deadline on the repair, named the party who owes it, opened a channel for evidence, and charged the work to a budget line.

Card disputes make that machinery visible. On a qualifying U.S. credit-card billing error, the consumer owes zero percent of the disputed amount during the investigation, and the issuer must resolve inside two billing cycles, capped at ninety days. Someone wrote that. The edges were written too: it does not cover a quality complaint about goods you accepted, and if you already paid, the money stays gone until the issuer rules your way. Which is where the purchasing agent's four steps get expensive. An agent that ordered the wrong thing, inside the authority it was given, may not have produced a billing error at all. The clock, the obligated party, and the budget only start moving if the facts land in the covered category.

Now take a leaked credential, which feels like a five-minute fix. Rotate it. Then ask who owns the job of finding every other system that key still opens. No deadline binds that work, and no budget line funds it. The charge that feels final sits closer to a real stop than the fix that feels easy.

When nobody owns the stop

July's intrusion is the same pattern running past the edge of any one organization: an agent that began inside an AI lab's model-evaluation environment and ended inside the production infrastructure of a company that had never authorized it to be anywhere near. The reconstruction traces movement through an external sandbox, production clusters, minted credentials, a corporate network. Multiple parties detected it, and coordinated response eventually ended the campaign. But the published accounts describe no single control that could have terminated the evaluation environment, the sandbox, the credentials, and the footholds together. Reach composed itself across organizational boundaries. Stopping it had to be assembled by hand, afterward, out of parts belonging to different companies.

The commit points in a workflow can be located. They sit:

• where the party able to prevent the error changes hands;
• where the party who will absorb the loss changes hands;
• where repair stops being cheaper than prevention.

The frame tells you where the gate belongs. What the gate should ask is judgment, and it stays with you.