The Moment of Commitment

There is a moment in every consequential process where the nature of what is happening changes fundamentally.

The previous article established that thinking itself often is emission — words, tokens, marks in sequence — and that tier one holds those emissions when logged, while tier zero remains the Real they speak about. This article is about the moment an emission crosses from conjecture to consequence: from an assert in the stream (article 8’s L-β) to a commit with accountability attached (L-γ when it binds the world).

Before the moment: computation, analysis, derivation. A model produces a score. An algorithm generates a recommendation. A rule engine evaluates a condition. These are opinions — technically sophisticated opinions, but opinions nonetheless. They carry no binding force. They produce no consequences on their own. They can be revised, rerun, discarded. In Four Capture Modes terms they stay derive — or assert if logged honestly — not commit.

After the moment: commitment. A loan is approved. A diagnosis is flagged for follow-up. A transaction is blocked. A post is removed. A customer is upgraded to a different tier. Something in the world has changed because of what the system concluded — a commit capture enters tier one.

The moment between these two states is not a technical transition. It is an epistemological one. And it is the most important moment in any system that makes decisions affecting people.

This moment needs a name. Call it the commitment boundary.

Why the commitment boundary matters

The commitment boundary is where accountability crystallises.

Before the boundary, there is no accountability to assign. A model’s score is not an action. An algorithm’s output is not a decision. A computation’s result is not a commitment. These things can be wrong — provably wrong, demonstrably harmful — but they are not yet accountable in any meaningful sense. They are potential.

The moment a system acts on that output — blocks the transaction, approves the loan, removes the content — potential becomes real. Someone or something made a commitment. Something in the world changed. That change may help or harm the people it affects. Accountability attaches.

The question accountability asks is simple: who committed? On what basis? With what information available at the time?

If the crossing is not recorded in the permanent log, these questions cannot be answered from the system of record — only reconstructed afterward from memory, email, interview, or scattered operational logs. That reconstruction is possible; organisations do it every day in postmortems and disputes. It is also expensive, incomplete, often contested, and a different epistemic category from a bind captured at the moment. Late human write-up is still second-hand commitment when it substitutes for an authenticated crossing at the time.

When no anchor event exists at all, attribution becomes arbitrary — accountability without commitment. Not because nobody is morally responsible, but because the decision was never captured as a fact with authority, evidence, and moment attached. It happened, produced consequences, and left no principled handle in the record.

Capture-mode crossing

Part II has already separated facts from derivations (Truth Doesn’t Change), capture modes from domain names (Four Capture Modes), and tier one from claims above (Captured Evidence). The commitment boundary is where those modes cross: pre-bind material becomes a commit capture — with authority, a reference to the evidence assert that froze what informed the bind, policy, and moment attached.

Pre-bind means anything that has not yet bound accountability at this step: off-log derive (recomputed scores, drafts), or tier-one assert, measure, or formalise still awaiting bind. After the crossing, the record carries captureForce: commit — one authority, one moment, tier-one bind; not un-happened by later edits.

For rules, policies, schemas, and values, pre-bind often follows the normative artifact ladder: assert (draft) → formalise (inscribed vN) → PolicyAdopted / SchemaAdopted / ValuesAdopted (bound to vN). Operational decisions (LoanApproved, ResponseSent) cross from assert/measure/derive at the boundary without that inscription step when no versioned artifact is in play.

What is not a crossing. A commit does not cross into another commit. Real processes contain many commits in sequence — loan approved, then disbursed — but each is a separate crossing from fresh pre-bind material to a new bind. Prior commits are referenced by event id in the evidence assert; they are evidence, not the mode being promoted. Emitting a second commit because “we already committed upstream” — without a distinct authority act at this step — is second-hand commitment or rubber-stamp approval, not a valid commit→commit transition.

Pre-bind material    ← derive (off-log), assert, measure, or formalise awaiting bind
        ↓
Evidence assert      ← ReasoningAsserted (automated) or HumanReviewAsserted (human path)
        +
Authority            ← who or what made the commitment
        +
Threshold/Policy     ← what rule converted the material to a commitment
        +
Moment               ← when the commitment was made
        ↓
Commit event         ← captureForce: commit — references evidence assert by event id

ReasoningAsserted {
  captureForce: assert,
  schemaVersion: 1,
  assertedAt,
  assertedBy: "fraud-detection-v5",
  inputs: {
    eventRefs: ["PaymentInitiated:evt-8842"],
    capturedFields: { amount: 4200, merchantCategory: "crypto" }
  },
  reasoning: {
    runnerId: "fraud-detection-v5",
    runnerVersion: "5.2.1",
    runnerConfigHash: "sha256:…",
    outputSummary: { riskScore: 0.87, triggeringRules: ["velocity-check", "geolocation-anomaly"] }
  },
  policy: {
    policyId: "fraud-blocking-policy",
    policyVersion: "2024-q3",
    thresholdApplied: 0.85
  }
}

TransactionBlocked {
  captureForce: commit,
  transactionId,
  customerId,
  decidedBy: "fraud-detection-v5",
  policyVersion: "fraud-blocking-policy:2024-q3",
  reasoningAssertRef: { eventId: "ReasoningAsserted:evt-9910" },
  decidedAt,
  appealable: true
}

ReasoningAsserted { … creditScore: 742, runnerId: "credit-model-v7", … }

HumanReviewAsserted {
  captureForce: assert,
  schemaVersion: 1,
  assertedAt,
  reviewerId: "loan-officer:maria.santos",
  reviewDurationSeconds: 180,
  materialShown: { eventRefs: ["ReasoningAsserted:evt-7701"], uiContextHash: "sha256:…" },
  conclusion: "approve",
  reasonIfDifferent: null
}

LoanApproved {
  captureForce: commit,
  applicationId,
  applicantId,
  amount,
  decidedBy: "loan-officer:maria.santos",
  policyVersion: "lending-policy-2024-q2",
  reasoningAssertRef: { eventId: "ReasoningAsserted:evt-7701" },
  humanReviewAssertRef: { eventId: "HumanReviewAsserted:evt-7702" },
  decidedAt
}

ContentRemoved {
  captureForce: commit,
  contentId,
  authorId,
  removalReason,
  decidedBy: "moderation-model-v12",
  policyVersion: "community-guidelines-v8",
  reasoningAssertRef: { eventId: "ReasoningAsserted:evt-5512" },
  decidedAt,
  reviewedByHuman: false
}

Evidence assertions

Pre-bind material for automated reasoning must be frozen before the commit — as a tier-one assert event with a fixed schema, not as an external blob. That keeps the commitment boundary model honest: everything in the permanent record is an event with a capture mode; facts are captured as events.

Automated path — ReasoningAsserted. Every automated crossing uses the same event shape (schemaVersion: 1): inputs (refs to tier-one events plus any fields that existed only in mutable state at run time), reasoning (runner id, version, config hash, output summary), and policy (policy id, version, threshold applied). Long agent traces may chain multiple ReasoningAsserted events by reference; the commit points at the terminal assert. The assert is forward without bind — honestly uncertain, revisable in principle — even when the following commit is automatic.

Human path — HumanReviewAsserted. Human review uses a different assert shape: reviewer identity, time on task, what was shown (event refs plus a hash of the UI context), and conclusion. It does not duplicate the automated runner block. A human-in-the-loop commit references both asserts when a model informed the review; human-only commits reference HumanReviewAsserted alone.

Commit references assert. The commit event stays thin: domain outcome, decidedBy, policy version, and reasoningAssertRef / humanReviewAssertRef — event ids, not blob ids. Investigation loads the commit, follows refs to the assert events, and reads the frozen basis without archaeology.

Separate topics, same discipline. Assert events may publish to a physically separate topic or stream (reasoning-assertions, human-review-assertions) while commits stay on domain topics — the same separation a blob store would provide, without leaving the event model. Consumers join by event id; retention and access policies can differ per topic while the log remains append-only.

Two judgments must stay separate:

• The commit as fact — the loan was approved, the transaction was blocked. Immutable once recorded; corrected only forward through new commit events.
• The quality of the bind — whether that was a good decision given what the assert events record.

A decision on a miscalibrated model is a cleanly committed fact and a poor decision. The linked ReasoningAsserted is what lets you establish the quality judgment without disturbing the historical fact.

Meta-decisions — deploy this model, set this threshold, waive human review — are their own commit crossings. Their commits reference eval or policy ReasoningAsserted events like any other automated path; they do not treat prior commits as measurements. Chaining is normal; skipping a fresh crossing because “we already committed upstream” is not.

Full term: ReasoningAsserted.

FraudModelDeployedToProduction {
  captureForce: commit,
  modelId: "fraud-detection-v5",
  deployedBy: "ml-platform-team",
  approvedBy: "head-of-risk:james.chen",
  blockingThreshold: 0.85,
  humanReviewRequired: false,
  deployedAt,
  replacesModel: "fraud-detection-v4",
  reasoningAssertRef: { eventId: "ReasoningAsserted:evt-6601" }
}

The human in the loop is not automatically the solution

A common response to accountability concerns in AI systems is to require human review — to insert a human at the commitment boundary. The human looks at the model’s output and makes the final call.

This is sometimes the right design. For high-stakes, irreversible decisions with low volume — clinical diagnoses, parole recommendations, large loan approvals — human review at the commitment boundary is appropriate and often legally required.

But human review does not solve the accountability problem by itself. It relocates the commitment boundary. The human becomes the authority at the boundary, which means the human’s review must be captured as a HumanReviewAsserted event and the bind as a commit that references it — with the reviewer’s identity, what they were shown, time on task, and any linked ReasoningAsserted from the model.

HumanReviewAsserted {
  captureForce: assert,
  schemaVersion: 1,
  applicationId,
  reviewerId: "loan-officer:sarah.kim",
  reviewDurationSeconds: 180,
  materialShown: {
    eventRefs: ["ReasoningAsserted:evt-8801"],
    uiContextHash: "sha256:…"
  },
  modelRecommendation: "approve",
  conclusion: "approve",
  reasonIfDifferent: null,
  assertedAt
}

LoanApproved {
  captureForce: commit,
  applicationId,
  decidedBy: "loan-officer:sarah.kim",
  policyVersion: "lending-policy-2024-q2",
  reasoningAssertRef: { eventId: "ReasoningAsserted:evt-8801" },
  humanReviewAssertRef: { eventId: "HumanReviewAsserted:evt-8802" },
  decidedAt
}

Without this event, the human review is invisible. A model said approve, a human said approve, but there is no record of the human having actually reviewed anything. The nominal human-in-the-loop becomes a rubber stamp with no audit trail.

And capturing the event is not enough on its own — the HumanReviewAsserted must be informative. The diagnostic is the override rate: how often does the human reviewer reach a different conclusion from the model? A boundary where the human approves 99.8% of recommendations without modification, in a few seconds each, is not human review. It is automation with a human-shaped delay in front of it. That is why the assert records reviewDurationSeconds and reasonIfDifferent: a pattern of zero-second reviews and never-populated reasons is the signal that the loop has become a stamp.

Human review that is not captured as HumanReviewAsserted plus a referencing commit is, architecturally, indistinguishable from no human review at all. Human review that is captured but never overrides is indistinguishable from automation wearing a name badge.

The accountability gap in current systems

Most systems in production today have accountability gaps at their commitment boundaries.

A model runs in a serving layer. Its output is consumed by application logic that applies a rule. The rule produces a business action. Somewhere in that pipeline, pre-bind material became a bind — but the pipeline records inputs and outputs, not decisions. The exact moment of commitment — the capture-mode crossing — is not a named, recorded event.

When something goes wrong, the investigation reconstructs what happened from logs, from database states, from monitoring data. This reconstruction is expensive, incomplete, and often contested. Different teams have different logs telling different parts of the story. The causal chain from model output to customer impact is assembled like an archaeological dig rather than read from a permanent record.

The accountability gap is not a compliance problem that legal teams fix with policies. It is an architectural problem that engineering teams fix by designing commitment boundaries as explicit, recorded commit events.

What changes when commitment boundaries are explicit

When every commitment boundary is a named, recorded commit event, several things change.

Investigation becomes log queries. A customer disputes a decision. The investigation starts with the commit event, follows reasoningAssertRef (and humanReviewAssertRef if present) to the frozen assert events, and reads runner version, inputs, output summary, and policy threshold from there — without reconstructing from scattered logs.

Regulatory responses become straightforward. “Show me every automated decision made about this customer in the past two years, with the basis for each decision.” This is a query against the event log, not an archaeological project.

Model versioning becomes meaningful. When a new model version is deployed, the commitment boundary events that follow reference the new version. The transition is visible in the log. Every decision can be attributed to the exact model version that made it. A/B testing of models is a routing decision that determines which version appears in the decidedBy field — and the comparison is a query, not an experiment.

Bias detection becomes systematic. A commitment boundary event contains the authority, the evidence, the outcome, and the subject of the decision. Aggregating these events by demographic characteristics — if captured appropriately and lawfully — produces the data needed to detect systematic bias in automated decisions. Without commitment boundary events, bias detection requires reconstructing decisions from scattered logs, which is expensive and incomplete.