Developers

One API call before the write.

Your agent decides what it wants to do. TekCapitol checks whether that specific change should proceed.

Your application still performs the write. TekCapitol makes the decision immediately before it. TekCapitol governs writes that are wired through Check Write. Writes that bypass the call are outside that control path.

Five-minute quickstart

1 · Get an API key

Sandbox playground needs no key. For Live API keys:

Open TC Protect with a work email.
Request Launch access if Live is not yet enabled for your domain (info@tekcapitol.com).
Register an agent in the dashboard to receive a one-time kops_… key. Store it as TEKCAPITOL_API_KEY.

Self-serve sandbox keys without Launch entitlement are not public yet. Use /check-write to try decisions now.

2 · Send Write Intent

curl https://tekcapitol.com/agentops-api.php \
  -H "Content-Type: application/json" \
  -H "X-Kyklos-Agent-Key: $TEKCAPITOL_API_KEY" \
  -d '{
    "action": "check_write",
    "system": "Salesforce",
    "objectType": "Opportunity",
    "objectRef": "006ABC123",
    "field": "StageName",
    "agentValue": "Closed Won",
    "authoritySource": "sales_ops",
    "authorityFound": true,
    "metadata": {
      "agent": "renewal-agent",
      "context": { "contract_signed": true }
    }
  }'

import os, requests

r = requests.post(
    "https://tekcapitol.com/agentops-api.php",
    headers={"X-Kyklos-Agent-Key": os.environ["TEKCAPITOL_API_KEY"]},
    json={
        "action": "check_write",
        "system": "Salesforce",
        "objectType": "Opportunity",
        "objectRef": "006ABC123",
        "field": "StageName",
        "agentValue": "Closed Won",
        "authoritySource": "sales_ops",
        "authorityFound": True,
        "metadata": {
            "agent": "renewal-agent",
            "context": {"contract_signed": True},
        },
    },
    timeout=15,
)
print(r.json())

const res = await fetch("https://tekcapitol.com/agentops-api.php", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Kyklos-Agent-Key": process.env.TEKCAPITOL_API_KEY,
  },
  body: JSON.stringify({
    action: "check_write",
    system: "Salesforce",
    objectType: "Opportunity",
    objectRef: "006ABC123",
    field: "StageName",
    agentValue: "Closed Won",
    authoritySource: "sales_ops",
    authorityFound: true,
    metadata: {
      agent: "renewal-agent",
      context: { contract_signed: true },
    },
  }),
});
console.log(await res.json());

3 · Receive Allow / Pause / Block

{
  "decision": "pause",
  "reason": "Current authority could not be confirmed",
  "auditId": "cw_…",
  "allowed": false
}

Live responses use lowercase allow | pause | block. Treat them as Allow, Pause, Block in product UX.

4 · Perform the external write only on Allow

# Pseudocode: only call Salesforce after decision == allow
# if decision != allow: exit / route to human review

decision = r.json()
if str(decision.get("decision", "")).lower() == "allow":
    update_salesforce_opportunity()  # your write
elif str(decision.get("decision", "")).lower() == "pause":
    surface_review_state(decision)   # do not write
else:
    stop_action(decision)            # BLOCK: do not write

const decision = await res.json();
if (String(decision.decision).toLowerCase() === "allow") {
  await updateSalesforceOpportunity(); // your write
} else if (String(decision.decision).toLowerCase() === "pause") {
  await surfaceReviewState(decision);  // do not write
} else {
  throw new Error(decision.reason || "blocked"); // do not write
}

First integration: LangGraph + Salesforce

Stop a LangGraph agent before the wrong Salesforce update.

LangGraph agent
↓ Write Intent
TekCapitol Check Write
ALLOW / PAUSE / BLOCK
↓
Salesforce update only on ALLOW

Runnable example (copy folder, set env, run):

examples/langgraph-salesforce-check-write Salesforce Write Gate docs Write Intent schema

Reference

Check Write design Check Action engine Security & data handling TC Protect™