Product brief · TC Protect™

ServiceNow Check Write™ integration

Production control for AI agents that mutate ServiceNow (or any SoR). ServiceNow is the demo wedge, not a limitation. The gate is not ServiceNow-only.

Called gate before the consequential write.

On every wired consequential action: orchestrator emits Write Intent; Check Write™ returns Allow, Block, or Pause; only Allow executes the ServiceNow update. Called gate: skipping the call means the write is not under Protect. TekCapitol™ does not MITM ServiceNow.

Problem

Agents can draft a correct-looking support action and still write the wrong values into ServiceNow. Observability after the fact is too late. A diagnostic pack alone is not production control.

How it works

  1. Agent proposes a write (for example, updating intended records in ServiceNow).
  2. Your orchestrator builds Write Intent metadata (record, fields, authority, and optional SoR version stamp).
  3. Orchestrator calls TC Protect™ check_write (or SDK guardedWrite).
  4. Gate returns allow, block, or pause plus reason and auditId.
  5. Only on allow does the orchestrator call the ServiceNow update API.

Data exposure stance

  • Orchestrator-emitted metadata only. TekCapitol™ does not crawl or query ServiceNow.
  • Minimization. Send field names, intended values needed for policy, authority source, freshness stamps, and ids. Do not send raw prompts or full record dumps by default.
  • Trace stores metadata-oriented audit (run ids, tool names, decisions, timestamps).
  • Hosted SaaS or VPC: scoped on call. See Security & data handling.

High-assurance mode

For high-impact writes:

  • Emit authority.checkedAt + maxAgeMs.
  • Set authority.stalePolicy to pause or block (not default warn).
  • Optional lightweight verification: orchestrator reads an SoR version stamp (or hash) and includes it in freshness.
  • Set requireApproval: true when a human must clear the write even on value match.
If the orchestrator only has stale context and does not re-read authority or stamp, the gate cannot invent freshness. High-assurance is a wiring requirement, not a silent SoR hook.

What the customer must wire

  1. Call check_gate / beginRun at run start (kill switch / Active · Scope limited · Paused).
  2. On every mutating ServiceNow write path, call check_write / guardedWrite with Write Intent v1.
  3. Execute the ServiceNow API write only when decision is allow.
  4. For high-assurance: supply freshness signals and stale policy as above.
  5. Operators use the TC Protect™ dashboard for pause / resume and Trace review.

Skipping the call means the write is not under Protect. There is no silent MITM and no “cannot bypass without middleware” claim in v0.

Commercial

Developer Check Write™ is free (self-serve tc_dev_ key). Production and enterprise TC Protect™ are commercial offerings: talk to TekCapitol. TC Diagnose™ maps gaps when you still need a pack ($5,000/workflow). Details: plans, product page TC Protect™.

Tour TC Protect™ → Write Intent schema Check Write™ design Policy picker Security & data handling Book a scoping call

Also in Docs

Same Check Write™ model applies to any SoR: SAP, Snowflake, ServiceNow, internal APIs. Salesforce is the reference story because buyers recognize the renewal write risk.