What is distance to production?
Distance to production is the number of access steps between an identity, such as an AI agent or CI token, and a destructive or data-exposing action in production.
In practice
A coding agent that holds a root API token has a distance to production of one step. An agent that needs a deploy role, then a database credential, has a longer distance. Shorter distances deserve attention first, because each step removed is one fewer control an attacker or a misbehaving agent has to pass.
The PocketOS incident is an example of a distance of one: an agent-readable token could delete a production volume directly.
Distance to production is the number of access steps between an identity, such as an AI agent or CI token, and a destructive or data-exposing action in production.
How it works. Step by step.
The parts that make it up, in an environment with AI agents.
The starting identity, for example a coding agent in CI.
A token or key the agent can read or already holds.
A role or scope that credential unlocks.
A destructive or data-exposing action on a production system.
What it looks like in Elmoz
A real path shape, drawn the way the Elmoz security graph shows it.
Questions, answered.
Short answers about Distance to production.
What is a safe distance to production?
There is no fixed number. What matters is how many independent controls sit between the agent and production, and whether any single credential skips all of them. A distance of one deserves attention first.
How do you increase the distance?
Keep production credentials out of developer machines and CI jobs that do not need them, require approval for production roles, and scope deploy identities so they cannot touch customer data.
Is there a real example of a distance of one?
Yes. In the PocketOS incident an account-scoped Railway token readable by a Cursor agent could delete a production volume directly.
Related terms.
Terms that belong to the same picture.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.