This is the highest-consequence exit a model has, because a wrong value written to the system of record is believed by everything downstream.
ConceptWhat it is
A system of record is the store other systems and people treat as true — the CRM, the ledger, the patient record, the case-management system. Writing to it is the most consequential thing a model-driven system can do, and the least forgiving.
The reason is propagation. A wrong answer on a screen is read by one person who may notice. A wrong value in the system of record is copied into reports, exports and other systems, and is then indistinguishable from a fact. Correcting it later corrects one copy.
How it worksThe mechanics
Writes are proposed rather than performed. The model produces a change set — field, old value, new value, evidence — which is validated against schema and business rules, then either applied automatically within a narrow, pre-agreed envelope or queued for approval.
Every applied change is reversible and attributed. That means the previous value is stored, the change is tagged with the agent principal and the trace that justified it, and there is a route to revert a batch rather than a row. Confidence gates the path: a high-confidence change to a low-risk field can apply directly, while the same confidence on a financial field still queues.
At a glanceSee it
Two paths out of one gate, chosen by field risk rather than by model confidence alone. The prior value is kept so a batch can be reverted, not just a row.
When to use itWhere it fits
- High-volume, well-bounded field updates where the rules are clear and the risk per field is low.
- Enrichment — adding a value that was previously absent, where the downside is a wrong addition rather than a destroyed fact.
- After a sustained dry-run showing the change sets would have been correct.
- Where the record system supports history, so a revert is a supported operation rather than an archaeology project.
When NOT to use itLimits & anti-patterns
- Financial, clinical or legal fields, which belong behind human approval regardless of measured accuracy.
- Records without version history, where a wrong write destroys the prior value permanently.
- When downstream consumers cannot tell an agent-written value from a human-verified one.
- As a first production use of an agent; earn this exit rather than starting with it.
Trade-offsAdvantages & costs
Advantages
- Removes the largest category of manual data entry, which is where the durable saving is.
- Change sets with evidence are more auditable than the human process they replace, which is rarely recorded at all.
- Confidence gating lets the easy majority flow while the hard minority gets attention.
- Attribution makes the agent's error rate measurable against a real baseline rather than estimated.
Trade-offs & costs
- Highest blast radius of any exit, and errors propagate to systems you do not own.
- Approval queues become a bottleneck and then a rubber stamp, which quietly removes the control.
- Requires history and revert support the record system may not have.
- Downstream consumers rarely distinguish provenance, so a wrong value inherits the record's authority immediately.
ExampleIn the real world
A data-quality agent standardises company names in a CRM. It correctly merges dozens of spelling variants and also merges two genuinely distinct subsidiaries that differ by one word. The merge propagates to the billing export overnight. The revert existed at row level and what was needed was a batch revert keyed by the run — which is the difference between a morning's work and a quarter's reconciliation.
ToolsHow to implement it
- The record system's own audit and history featuresthe prerequisite, not an optional extra.
- A change-set queue with approvalso the risky minority is reviewed and the safe majority is not.
- Batch-level revert keyed by run idbecause errors arrive in batches and row-by-row undo does not scale.
- A provenance field on written valuesso downstream consumers can distinguish an agent write from a verified one.
Cost & effortWhat it takes
Model cost is minor. Everything here is engineering and process: the change-set pipeline, the approval surface, the revert path and the provenance plumbing. It is the most expensive exit to build correctly and the one with the largest saving when it works, which is exactly why it should not be the first one attempted.