Product brief · TC Protect™

Salesforce Write Gate

Production control for AI agents that mutate Salesforce (or any SoR). Salesforce is the clear demo wedge. The gate is not Salesforce-only.

No agent writes without TekCapitol™.

On every wired mutate path: orchestrator emits Write Intent; Check Write returns Allow, Block, or Pause; only Allow executes the Salesforce update. Called gate: skipping the call means the write is not under Protect. TekCapitol™ does not MITM Salesforce.

Problem

Agents can draft a correct-looking renewal and still write the wrong Stage, Amount, or entitlement into Salesforce. Observability after the fact is too late. A diagnostic pack alone is not production control.

How it works

  1. Agent proposes a write (e.g. Opportunity StageName = Approved).
  2. Your orchestrator builds Write Intent metadata (record, fields, authority, optional SystemModstamp).
  3. Orchestrator calls TC Protect™ check_write (or SDK guardedWrite).
  4. Gate returns allow, block, or pause plus reason and auditId.
  5. Only on allow does the orchestrator call the Salesforce update API.

Data exposure stance

  • Orchestrator-emitted metadata only. TekCapitol™ does not crawl or query Salesforce.
  • Minimization. Send field names, intended values needed for policy, authority source, freshness stamps, ids. Do not send raw prompts or full record dumps by default.
  • Trace stores metadata-oriented audit (run ids, tool names, decisions, timestamps).
  • Hosted SaaS or VPC: scoped on call. See Security & data handling.

High-assurance mode

For renewals and other high-impact writes:

  • Emit authority.checkedAt + maxAgeMs.
  • Set authority.stalePolicy to pause or block (not default warn).
  • Optional lightweight verification: orchestrator reads Salesforce SystemModstamp (or hash) and includes it in freshness.
  • Set requireApproval: true when a human must clear the write even on value match.
If the orchestrator only has stale context and does not re-read authority or stamp, the gate cannot invent freshness. High-assurance is a wiring requirement, not a silent Salesforce hook.

What the customer must wire

  1. Call check_gate / beginRun at run start (kill switch / Active · Scope limited · Paused).
  2. On every mutating Salesforce write path, call check_write / guardedWrite with Write Intent v1.
  3. Execute the Salesforce API write only when decision is allow.
  4. For high-assurance: supply freshness signals and stale policy as above.
  5. Operators use the TC Protect™ dashboard for pause / resume and Trace review.

Skipping the call means the write is not under Protect. There is no silent MITM and no “cannot bypass without middleware” claim in v0.

Commercial

TC Protect Live™ Launch from $750/month per workflow (TekCapitol-hosted). Pilot / Production / VPC quoted. TC Diagnose™ maps gaps when you still need a pack ($5,000/workflow). Details: pricing, product page TC Protect.

Tour the write gate → Write Intent schema Check Write design Security & data handling Book a scoping call

Also in Docs

Same Check Write model applies to SAP, Snowflake, ServiceNow, or internal APIs. Salesforce is the reference story because buyers recognize the renewal write risk.