Check Write™

One call before an AI agent takes a consequential action.

Allow | Pause | Block

Check Write™ is runtime control for consequential AI agent actions. Use it immediately before an agent changes a system of record, moves money, changes access, sends something externally, or triggers another high-impact action. Systems of record (Salesforce, SAP, ServiceNow, databases) are a primary wedge; they are not the only use case. Your application still owns execution.

npm install @tekcapitol/tc-protect-sdk

import { createTcProtect } from "@tekcapitol/tc-protect-sdk";

const protect = createTcProtect({
  apiKey: process.env.TEKCAPITOL_API_KEY, // or TC_PROTECT_API_KEY
});

const result = await protect.checkWrite({
  system: "Salesforce",
  objectType: "Opportunity",
  objectRef: "006XXXXXXXXXXXX",
  field: "StageName",
  agentValue: "Closed Won",
  requiredControls: ["identity", "authority"],
  controlEvidence: [
    { controlId: "identity", source: "okta", result: "PASS", checkedAt: new Date().toISOString() },
    { controlId: "authority", source: "iam", result: "PASS", checkedAt: new Date().toISOString() },
  ],
});

if (result.decision === "allow") {
  // your code performs the write
} else if (result.decision === "pause") {
  // hold, gather evidence, or route for review
} else {
  // block: do not execute the write
}

Check Write™ does not execute the action. Your application still owns execution. Call Check Write™ immediately before the consequential action. TekCapitol does not MITM traffic or silently proxy writes to your systems of record.

60-second quickstart

1. Install

npm install @tekcapitol/tc-protect-sdk

2. Set API key

Get a free developer key at tekcapitol.com/developers/get-key.

export TEKCAPITOL_API_KEY=your_key_here

import { createTcProtect } from "@tekcapitol/tc-protect-sdk";

const protect = createTcProtect({ apiKey: process.env.TEKCAPITOL_API_KEY });

Default endpoint: https://api.tekcapitol.com/v1/check-write

3. Create the Check Write™ request

const result = await protect.checkWrite({
  system: "DemoCRM",
  objectType: "Account",
  objectRef: "acc_demo_001",
  field: "Name",
  agentValue: "Acme Demo",
  requiredControls: ["identity", "authority"],
  controlEvidence: [
    { controlId: "identity", source: "okta", result: "PASS", checkedAt: new Date().toISOString() },
    { controlId: "authority", source: "iam", result: "PASS", checkedAt: new Date().toISOString() },
  ],
});

4. Receive the decision

result.decision is allow, pause, or block. On network or validation failure the SDK fails closed with WritePausedError.

5. Execute only when appropriate

if (result.decision === "allow") {
  // your application performs the write
  await updateAccount("acc_demo_001", "Acme Demo");
} else if (result.decision === "pause") {
  // hold, gather evidence, or route for review
} else {
  // block: do not execute the write
}

Or use guardedWrite({ intent, write }) so the write callback runs only on allow.

First runnable example (offline, no API key):

node examples/basic-check-write/index.mjs

Live with your key:

export TEKCAPITOL_API_KEY=your_key && node examples/basic-check-write/index.mjs --live

How it works

Agent intends consequential action
        ↓
Check Write™
        ↓
Allow | Pause | Block
        ↓
Application owns execution

flowchart LR
    A[AI Agent] --> B[Consequential Action]
    B --> C[Check Write]
    C -->|Allow| D[Application executes]
    C -->|Pause| E[Hold / gather evidence]
    C -->|Block| F[Stop]

Use Check Write™ for runtime control immediately before consequential execution: database writes, Salesforce and ServiceNow updates, money movement, access or permission changes, external sends, purchase orders, and other high-impact actions. It supports policy enforcement and agent authorization on the actions that matter without taking ownership of execution.

Decisions

Allow

Required controls are satisfied. The application may proceed.

Pause

More evidence, authority, or review is required before proceeding.

Block

A required control failed. Do not execute the write.

On pause or block, guardedWrite() never calls your write callback.

Examples

| Example | What changes | Evidence sent | Decision | Where execution runs | |---------|--------------|---------------|----------|----------------------| | basic-check-write | Demo CRM account name | identity, authority | allow (offline mock) | write callback | | salesforce-update | Opportunity StageName | identity, authority, approval | allow (mock) | write callback (replace with jsforce/REST) | | database-write | PostgreSQL row update | identity, authority | allow (mock) | write callback (replace with your DB client) | | servicenow-change | change_request create | identity, authority, approval | allow (mock) | write callback | | payment-beneficiary | Beneficiary account change | identity, authority, approval | pause (mock) | write callback (money movement) | | purchase-order | Purchase order create | identity, authority, approval | allow (mock) | write callback (ERP create) | | refund-approval | Refund amount | identity, authority, approval | allow (mock) | write callback |

Framework patterns (no fake integrations):

| Pattern | Path | |---------|------| | Plain Node.js | examples/frameworks/plain-node/ | | LangGraph-style tool gate | examples/frameworks/langgraph/ | | CrewAI (Python HTTP) | examples/frameworks/crewai/ | | Python HTTP / API | examples/frameworks/python-http/ |

More scenarios: examples/README.md · Control templates: control-patterns/

node examples/basic-check-write/index.mjs
npm test

SDK quick reference

import {
  createTcProtect,
  DEFAULT_CHECK_WRITE_URL,
  WritePausedError,
  WriteBlockedError,
  buildWriteIntent,
} from "@tekcapitol/tc-protect-sdk";

Primary methods: checkWrite, guardedWrite, reportExecution. Node 18+.

Fail-closed: if Check Write cannot return a valid decision, the SDK throws WritePausedError and does not run write. Codes include CHECK_WRITE_TIMEOUT, CHECK_WRITE_UNAVAILABLE, CHECK_WRITE_TLS_ERROR, CHECK_WRITE_INVALID_RESPONSE, CHECK_WRITE_SERVER_ERROR.

What this does not do

• MITM Salesforce, SAP, ServiceNow, or databases
• Execute the customer write
• Independently re-query every evidence source (v1)
• Guarantee compliance with any framework
• Stop actions if orchestrator code skips Check Write (called gate)

Links

• Examples: tekcapitol.com/developers/examples.html
• Product: Check Write™
• Docs: tekcapitol.com/docs · Check Write API
• API key: Get started
• npm: @tekcapitol/tc-protect-sdk

Security

See SECURITY.md. Do not open public issues for vulnerabilities.

License

UNLICENSED. All rights reserved. Contact TekCapitol regarding permitted use.