Diffuse Write Authority

When more than one process, service, or team can write to the facts an invariant governs, the invariant cannot be enforced locally. It can only be hoped for — through locks, distributed transactions, reconciliation jobs, and meetings. Diffuse write authority is the structural mistake of treating a coordination problem as if it were a correctness problem solvable inside each writer independently.

In software systems

The symptom is familiar: three microservices each maintain a slice of order state; two teams can update customer credit limits through different APIs; inventory counts are adjusted by the warehouse system, the ecommerce platform, and a nightly batch reconciler. Each writer implements its own validation. None has a complete view. Invariants hold until concurrent events arrive — then they fail silently or are patched after the fact.

Distributed locks and two-phase commit are the compensating controls. They work at small scale and become the bottleneck at large scale — global contention, deadlock risk, cascade failure when the lock holder fails. Schema evolution churn often signals the same root cause: events were designed around multiple consumers’ write needs rather than captured as irreducible facts with a single committing authority.

In human organisations

Diffuse write authority appears as shared ownership without a single accountable team — “everyone is responsible for customer data quality,” which means no one is. Product, sales, and support each maintain parallel customer records. Finance and operations both adjust contractual terms. Strategy and engineering both define what counts as a committed decision.

Coordination overhead grows quadratically. Approval chains emerge to simulate what a single writer would enforce internally. Decision latency increases. The people at coordination choke points become bottlenecks regardless of capability — not because they are slow, but because the architecture requires them to serialise what should never have been parallelised.

Accountability fragments. When an invariant breaks — a customer charged twice, a policy applied inconsistently — each team can show its local logic was correct. The failure lives in the gaps between writers, where no one’s decision the record reflects.

In socio-technical systems

The compounded failure aligns organisational diffusion with technical diffusion. Conway’s Law guarantees it: siloed teams produce siloed services that each write to overlapping domains; matrix organisations produce platforms with admin overrides that bypass the service boundaries drawn on architecture diagrams.

Reconciliation becomes the operating model — nightly jobs, manual spreadsheets, war rooms after incidents. The business learns to tolerate invariant violation as a cost of speed. Audit becomes archaeology: reconstructing which of several writers held authority when the failure occurred, often finding that none did — only a race condition between parallel paths no single process owned.

Why it persists

Short-termism. Teams ship features that write directly to shared tables because the single-writer refactor is “next quarter.” Each local change is rational; the accumulated structure is not.

Local optimisation. A squad improves its velocity by owning its own write path. System-wide invariants are someone else’s problem until production breaks.

Missing principle. Single-writer-per-invariant is absent from many architecture curricula. Microservice templates default to shared databases and saga compensations without naming the underlying mistake.

Coordination as architecture. Locks, approval chains, and reconciliation jobs feel like mature engineering. They are expensive simulations of what one writer would enforce for free — but they are visible, shippable, and familiar from prior employers.

Cognitive bias. Status quo bias keeps shared ownership in place; sunk cost makes untangling write paths feel riskier than adding another reconciler.

Principled alternatives

Single writer principle

Assigning exactly one authority per invariant domain removes the failure mechanism diffuse write authority introduces: parallel mutation paths. Others read, request, and reserve — they do not write governed facts directly. Invariant enforcement becomes local inside the writer; violations trace to one place.

This pattern eliminates the need for global locks as the default correctness strategy and replaces reconciliation-as-operating-model with committed L0 outcomes everyone consumes. Where historical diffusion cannot be rewound immediately, reconciliation is a dated bridge — every finding is evidence of a missing single writer, not proof that diffusion works.