Product brief · TC Protect™

SAP Check Write™ integration

Production control for AI agents that mutate SAP (or any SoR). SAP is the demo wedge, not a limitation. The gate is not SAP-only.

Called gate before the consequential write.

On every wired consequential action: orchestrator emits Write Intent; Check Write™ returns Allow, Block, or Pause; only Allow executes the SAP update. Called gate: skipping the call means the write is not under Protect. TekCapitol™ does not MITM SAP.

Problem

Agents can draft a correct-looking business action and still write the wrong attribute values into SAP. Observability after the fact is too late. A diagnostic pack alone is not production control.

How it works

  1. Agent proposes a write (for example, updating the intended record values in SAP).
  2. Your orchestrator builds Write Intent metadata (record, fields, authority, and optional SoR version stamp).
  3. Orchestrator calls TC Protect™ check_write (or SDK guardedWrite).
  4. Gate returns allow, block, or pause plus reason and auditId.
  5. Only on allow does the orchestrator call the SAP update API.

Data exposure stance

  • Orchestrator-emitted metadata only. TekCapitol™ does not crawl or query SAP.
  • Minimization. Send field names, intended values needed for policy, authority source, freshness stamps, and ids. Do not send raw prompts or full record dumps by default.
  • Trace stores metadata-oriented audit (run ids, tool names, decisions, timestamps).
  • Hosted SaaS or VPC: scoped on call. See Security & data handling.

High-assurance mode

For renewals and other high-impact writes:

  • Emit authority.checkedAt + maxAgeMs.
  • Set authority.stalePolicy to pause or block (not default warn).
  • Optional lightweight verification: orchestrator reads an SoR version stamp (or hash) and includes it in freshness.
  • Set requireApproval: true when a human must clear the write even on value match.
If the orchestrator only has stale context and does not re-read authority or stamp, the gate cannot invent freshness. High-assurance is a wiring requirement, not a silent SoR hook.

What the customer must wire

  1. Call check_gate / beginRun at run start (kill switch / Active · Scope limited · Paused).
  2. On every mutating SAP write path, call check_write / guardedWrite with Write Intent v1.
  3. Execute the SAP API write only when decision is allow.
  4. For high-assurance: supply freshness signals and stale policy as above.
  5. Operators use the TC Protect™ dashboard for pause / resume and Trace review.

Skipping the call means the write is not under Protect. There is no silent MITM and no “cannot bypass without middleware” claim in v0.

Commercial

Developer Check Write™ is free (self-serve tc_dev_ key). Production and enterprise TC Protect™ are commercial offerings: talk to TekCapitol. TC Diagnose™ maps gaps when you still need a pack ($5,000/workflow). Details: plans, product page TC Protect™.

Tour TC Protect™ → Write Intent schema Check Write™ design Policy picker Security & data handling Book a scoping call

Also in Docs

Same Check Write™ model applies to any SoR: SAP, Snowflake, ServiceNow, internal APIs. Salesforce is the reference story because buyers recognize the renewal write risk.