Check Write: emission, decision API, audit

Integrator note for the minimum production path: orchestrator emits Write Intent, check_write decides, metadata audit records the outcome.

1. Orchestrator emission path

Raw SoR updates in agent code are not supported. Use guardedWrite. Schema: Write Intent. This library path is gated; skipping the SDK means the write is not under Protect (called gate, not MITM).

1. Before any mutating tool (Salesforce update, ERP post, etc.), build a Write Intent v1 object.
2. Prefer SDK guardedWrite({ intent, write }) (or buildWriteIntent + check_write yourself).
3. Call Live API via the SDK (https://tekcapitol.com/agentops-api.php or your VPC endpoint).
4. Branch on decision. Run the write callback only when allow. On block / pause, throw and never mutate.

await protect.guardedWrite({
  intent: { /* write_intent.v1 fields */ },
  write: () => sf.sobject("Opportunity").update({ Id, StageName: "Approved" }),
});
// On block → WriteBlockedError (reason, auditId)
// On pause → WritePausedError (reason, auditId)

Also call check_gate / beginRun at run start so kill switch Paused blocks new runs. Reference: SDK examples/salesforce-opportunity-stage.mjs.

2. Decision API

Primary action: check_write. Response includes:

Decision semantics

• allow — Orchestrator may execute the write.
• block — Do not write. Policy or stale-block failed closed.
• pause — Do not write. HITL or stale-pause. Kill switch often moves to Paused so subsequent check_gate holds.

3. Audit log

• Every check_write returns auditId for correlation.
• Trace / event log stores metadata: agent id, workflow id, object refs, decision, timestamps, policy tags.
• Default posture: no raw prompts or full SoR payloads in TekCapitol™ SaaS storage.
• Operators review Trace in the Protect dashboard; export / SIEM webhooks are roadmap where noted on the product page.

4. MVP prototype scope (what must exist to demo)

• Write Intent v1 accepted by Live check_write.
• Allow / Block / Pause returned with auditId.
• SDK guardedWrite skips the write callback on block/pause.
• Demo path: Salesforce-shaped renewal write (illustrative or partner sandbox).
• Dashboard kill switch + Trace visibility for the same agent.

Out of v0: silent Salesforce MITM, cannot-bypass middleware, hard DB row lock / 2PC, SOC 2 certification.

5. Related APIs

Also in Docs

• Write Intent schema · required fields, freshness, authorityStalePolicy
• Security & data handling · what TekCapitol™ stores
• Salesforce Write Gate · buyer-facing product brief

Status: Live on TekCapitol™ hosted Protect. Private SDK folder for design partners. Not published to public npm yet.