Check Write™

POST /v1/check-write — one call before the write. Returns allow | pause | block.

POST /v1/check-write

Canonical executable endpoint: https://api.tekcapitol.com/v1/check-write

Canonical production endpoint (TLS verified). Legacy apex path https://tekcapitol.com/api/v1/check-write remains compatible.

Authentication

Authorization: Bearer $TEKCAPITOL_API_KEY

Developer keys use prefix tc_dev_… from Get Developer Key (free, no TC Protect purchase). Production keys come from TC Protect™.

Minimal request

curl https://api.tekcapitol.com/v1/check-write \
  -H "Authorization: Bearer $TEKCAPITOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "system": "Salesforce",
    "objectType": "Opportunity",
    "objectRef": "006ABC123",
    "field": "StageName",
    "agentValue": "Closed Won",
    "authoritySource": "sales_ops",
    "authorityFound": true
  }'

Minimal response

{
  "decision": "pause",
  "reason_code": "authority_unverified",
  "reason": "Current authority could not be confirmed",
  "decision_id": "cw_12345",
  "timestamp": "2026-08-20T12:00:00Z"
}

Allow / Pause / Block

• allow — Orchestrator may execute the write.
• pause — Do not write. Route to human review.
• block — Do not write. Failed closed.

Error codes

Rate limits

Developer tier limits are configurable in data/agentops/developer-config.json (developer_monthly_check_limit, developer_rate_limit). Defaults: 1,000 checks / month, 60 / minute.

What you send vs what Check Write™ resolves

Every Check Write™ request is evaluated against a server-controlled minimum baseline. Profiles, workflow controls, agent controls, and caller-requested controls can add requirements but cannot weaken that baseline.

You do not define the entire control set in your agent. The caller supplies the intended action, runtime facts, available evidence, and optional additional requirements. Check Write™ resolves baseline requirements, Action Profile, business rules, evidence contracts, and trust/freshness requirements. The caller can add requirements. The caller cannot weaken server-owned requirements.

Schema reference

Body fields follow Write Intent v1. Response fields follow Check Write™ response v1 JSON Schema. The public facade also accepts playground-style fields (agent, action, resource, change, authority, context) and normalizes them.

Optional operational fields (when your profile requires them): controlPackId / policyRef, businessContext (classification, residency, consent), approvals, authorityState (valid | stale | expired | revoked), and caller-supplied controlEvidence for risk/fraud. Check Write™ evaluates whether required evidence arrived and satisfies the profile; it does not independently calculate fraud unless TekCapitol actually did. Responses may include profileProvenance and requirementProvenance for Trace (metadata only, no raw vendor payloads).

Control evidence matrix

Integration guidance

1. Try anonymously in the playground.
2. Build with a free developer key.
3. Protect production with TC Protect™ (not equivalent to the free developer tier).

Quickstart: /developers · LangGraph example: examples/langgraph-salesforce-check-write

Emission path, decision engine, audit

Integrator note for the minimum production path: orchestrator emits Write Intent, Check Write™ decides, metadata audit records the outcome. Public clients should use POST https://api.tekcapitol.com/v1/check-write (legacy apex /api/v1/check-write remains compatible); internally this facades the canonical engine (agentops_check_write / write_intent.v1).

1. Orchestrator emission path

Raw SoR updates in agent code are not supported. Use guardedWrite. Schema: Write Intent. This library path is gated; skipping the SDK means the write is not under Protect (called gate, not MITM).

1. Before any mutating tool (Salesforce update, ERP post, etc.), build a Write Intent v1 object.
2. Prefer SDK guardedWrite({ intent, write }) (or buildWriteIntent + check_write yourself).
3. Call the public API (https://api.tekcapitol.com/v1/check-write) or your VPC endpoint. Legacy internal path: agentops-api.php?action=check_write.
4. Branch on decision. Run the write callback only when allow. On block / pause, throw and never mutate.

await protect.guardedWrite({
  intent: { /* write_intent.v1 fields */ },
  write: () => sf.sobject("Opportunity").update({ Id, StageName: "Approved" }),
});
// On block → WriteBlockedError (reason, auditId)
// On pause → WritePausedError (reason, auditId)

Also call check_gate / beginRun at run start so kill switch Paused blocks new runs. Reference: SDK examples/salesforce-opportunity-stage.mjs.

2. Decision API

Primary action: check_write. Response includes:

Decision semantics

• allow — Orchestrator may execute the write.
• block — Do not write. Policy or stale-block failed closed.
• pause — Do not write. HITL or stale-pause. Kill switch often moves to Paused so subsequent check_gate holds.

Four separate verification checks (Trace UI)

TC Protect™ does not collapse “one gate result” into a single decision. Each check_write evaluates the signed Write Intent Envelope using these independent checks:

• Agent identity — signature verification and Agent Registry attestation (JWT with HS256/RS256/ES256 or legacy HMAC).
• Workflow identity — Workflow Registry fingerprint attestation (approved definition_hash and runtime matches for environment/orchestrator/deployment).
• Current authority — approval freshness and scope against the current write timestamp.
• Write policy — allowed target systems, allowed operations, allowed fields, and policy version alignment.

In the TC Protect Trace timeline, these appear as “WRITE CHECKS (metadata)” pills alongside decision, reason_code, trace_id, and the workflow fingerprint.

3. Audit log

• Every check_write returns auditId for correlation.
• Trace / event log stores metadata: agent id, workflow id, object refs, decision, timestamps, policy tags.
• Default posture: no raw prompts or full SoR payloads in TekCapitol™ SaaS storage.
• Operators review Trace in the Protect dashboard; export / SIEM webhooks are roadmap where noted on the product page.

4. MVP prototype scope (what must exist to demo)

• Write Intent v1 accepted by Live check_write.
• Allow / Block / Pause returned with auditId.
• SDK guardedWrite skips the write callback on block/pause.
• Demo path: Salesforce-shaped renewal write (illustrative or partner sandbox).
• Dashboard kill switch + Trace visibility for the same agent.

Out of v0: silent Salesforce MITM, cannot-bypass middleware, hard DB row lock / 2PC, SOC 2 certification.

5. Related APIs

6. Nuanced Policy Gates (extension)

Judgment-heavy policies (bias, drift, context, explanation quality, downstream effects, value alignment, novelty, reversibility) run inside the same Check Write™ step. Emit nuancedSignals on the Write Intent. Merge: any Block → Block; else any Pause → Pause; else Allow. Prefer Pause over silent Allow when confidence is low. Evidence: policyEvidence on the response, same auditId.

Detail: Nuanced Policy Gates.

Also in Docs

• Nuanced Policy Gates · Pause-Before-Write for fuzzy policies
• Policy picker · business questions → writePolicy / unknownKeyPolicy / emit rules
• Write Intent schema · required fields, freshness, authorityStalePolicy
• Security & data handling · what TekCapitol™ stores
• Salesforce Check Write™ integration · buyer-facing product brief
• SAP Check Write™ integration · buyer-facing product brief
• Snowflake Check Write™ integration · buyer-facing product brief
• ServiceNow Check Write™ integration · buyer-facing product brief

Status: Live on TekCapitol™ hosted Check Write™. SDK: npm i @tekcapitol/tc-protect-sdk (current published line). Production Protect keys differ from free tc_dev_ developer keys.