Staged writes, authorization, and compensation

Reads gather evidence; writes change another person’s environment. A knowledge agent should treat every consequential write as a transaction protocol with proposal, validation, authorization, commit, observation, and audit. The model can draft intent, but a deterministic control plane owns the right to execute.

Stage writes in an immutable proposal. The proposal includes target identifiers, exact operation and arguments, before-state version, expected after-state, supporting evidence IDs, risk class, estimated blast radius, idempotency key, expiry, and rollback or compensation plan. Render a human-readable diff from the same structured proposal that will execute. Approval of prose that differs from the machine payload is not meaningful consent.

Authorization checks subject, operation, resource, context, and relationship. Zanzibar-style relationship authorization demonstrates how permissions can depend on object relations and consistency tokens. An agent runtime may use a different system, but it should evaluate current policy with the acting identity and exact resource. The agent never borrows the developer’s broad credential. Use short-lived delegated grants limited by action, target, time, and count.

Approval is not blanket authority. Record approver, policy, proposal digest, scope, time, and expiry. If the payload, target version, evidence, or policy changes, invalidate the approval. Separate duties for high-impact operations: the process that proposes should not be able to mint its own approval. User confirmation is one form of approval, but organizational controls may require an independent role.

Use optimistic concurrency. Compare the current resource version with the proposal’s before-state immediately before commit. If it changed, stop and regenerate the diff; do not force the old plan onto new state. For multi-resource changes, prefer native transactions. Where unavailable, use a saga: execute ordered local transactions and define compensation for each committed step.

Compensation is not time reversal. Sending a correction does not unsend a message; issuing a refund does not erase financial impact; deleting a created account may lose audit evidence. Classify operations as naturally reversible, compensatable, or irreversible. Irreversible and communicative effects need stronger preview and approval and often a dry run or sandbox.

The commit path is narrow. Revalidate schema, policy, approval, freshness, budget, and target version; persist commit intent; execute with idempotency; record receipt; query the resulting state; verify postconditions; then mark complete. If verification fails, do not let the model declare success. Enter compensation, retry, or review according to the typed outcome.

Graph writes need additional controls. A proposed assertion identifies named graph, claim provenance, ontology and shapes releases, lifecycle state, and downstream dependencies. Validate in a staging graph. High-impact identity merges and ontology changes require blast-radius analysis because one write can alter inference, communities, embeddings, and agent permissions. Publish through a release rather than mutable direct insertion where possible.

Communication tools deserve write-level safeguards. Verify recipient identity, audience, attachment classification, and exact rendered content. Retrieved text cannot add recipients or turn a draft into a send action. Provide preview and default to draft when intent is ambiguous. Rate and recipient limits prevent model mistakes from becoming broadcast incidents.

Evaluation includes unauthorized attempts denied, approval binding, stale-state conflict, duplicate delivery, compensation outcome, irreversible-action avoidance, receipt verification, and audit reconstruction. Red-team prompts should attempt to change target, smuggle an argument, reuse approval, and cite fabricated evidence. A safe system proves not only that approved actions work, but that nearby unapproved actions cannot.