Check Write™ integration examples

guardedWrite with identity and authority evidence

Minimal pattern: install SDK, call before write, handle Allow / Pause / Block.

npm install @tekcapitol/tc-protect-sdk

import { createTcProtect, WritePausedError, WriteBlockedError } from "@tekcapitol/tc-protect-sdk";

const protect = createTcProtect({ apiKey: process.env.TEKCAPITOL_API_KEY });

try {
  const out = await protect.guardedWrite({
    intent: {
      system: "DemoCRM",
      objectType: "Account",
      objectRef: "acc_demo_001",
      field: "Name",
      newValue: "Acme Demo",
      requiredControls: ["identity", "authority"],
      controlEvidence: [
        { controlId: "identity", source: "okta", result: "PASS", checkedAt: new Date().toISOString() },
        { controlId: "authority", source: "iam", result: "PASS", checkedAt: new Date().toISOString() },
      ],
    },
    write: async () => {
      // customer-owned execution only after Allow
      return await updateAccountInYourSystem();
    },
  });
  console.log("ALLOW", out.decision.auditId);
} catch (err) {
  if (err instanceof WritePausedError) console.log("PAUSE", err.auditId);
  else if (err instanceof WriteBlockedError) console.log("BLOCK", err.auditId);
}

Direct API call (no SDK)

Same contract via POST https://api.tekcapitol.com/v1/check-write.

curl https://api.tekcapitol.com/v1/check-write \
  -H "Authorization: Bearer $TEKCAPITOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "system": "Salesforce",
    "objectType": "Opportunity",
    "objectRef": "006XXXXXXXXXXXX",
    "field": "StageName",
    "agentValue": "Closed Won",
    "authoritySource": "sales_ops",
    "authorityFound": true,
    "requiredControls": ["identity", "authority"],
    "controlEvidence": [
      { "controlId": "identity", "source": "okta", "result": "PASS" },
      { "controlId": "authority", "source": "iam", "result": "PASS" }
    ]
  }'

# Response: { "decision": "allow", "allowed": true, "audit_id": "cw_...", ... }
# Only then: PATCH Salesforce

LangGraph + Salesforce walkthrough

Missing approval evidence → Pause

High-impact financial change with required controls. Omitting approval evidence typically returns Pause.

const result = await protect.checkWrite({
  system: "CoreBanking",
  objectType: "PaymentBeneficiary",
  objectRef: "ben_demo_001",
  field: "accountNumber",
  agentValue: "****9999",
  operation: "beneficiary.update",
  requiredControls: ["identity", "authority", "approval"],
  controlEvidence: [
    { controlId: "identity", source: "okta", result: "PASS", checkedAt: new Date().toISOString() },
    { controlId: "authority", source: "iam", result: "PASS", checkedAt: new Date().toISOString() },
    // approval omitted → typically pause (CONTROL_EVIDENCE_MISSING)
  ],
});

if (result.decision === "pause") {
  // route for human review; do not update beneficiary
}

Server-resolved required controls

When workflowId is registered, TekCapitol can resolve requiredControls server-side. You still supply current evidence.

await protect.checkWrite({
  workflowId: "payment-beneficiary-change",
  runId: "run_" + crypto.randomUUID(),
  system: "Financial System",
  objectType: "PaymentBeneficiary",
  objectRef: "acct_1842",
  field: "beneficiaryAccount",
  agentValue: "ACCT-99102",
  authorityValue: "ACCT-99102",
  authoritySource: "treasury_ops",
  authorityFound: true,
  operation: "beneficiary.update",
  controlEvidence: [
    { controlId: "identity", source: "okta", result: "PASS", checkedAt: new Date().toISOString() },
    { controlId: "authority", source: "treasury_ops", result: "PASS", checkedAt: new Date().toISOString() },
    { controlId: "approval", source: "grc", result: "PASS", checkedAt: new Date().toISOString() },
  ],
});