2Advisor weekly — pipeline readEMAIL · YESTERDAY
LOCATOR: MERIDIAN PARAGRAPH
Re-engaged. Nadia responsive again after the portfolio review. Climate Week meeting being set. We would not call this diligence yet.
[ 00 / 09 ] · ACTIONSLEDGER // a change review layer between an agent and your system of record //
Pull requests for AI changes to business records.
Your agent proposes. A human approves. A separate merge engine writes — the agent is never issued a write credential.
no card · 100 proposed changes/mo free · shadow mode by default
NOTIONSALESFORCEHUBSPOTAIRTABLEPOSTGRES
“Prediction: systems of record will need to become AI harnesses or face replacement by agents”
GTGarry Tan@garrytan · President & CEO, Y Combinator · 24 Aug 2026 · 449.3k views
[ 01 / 09 ] · THE PROBLEM // unattended writes //sha 9f86d0 ← e3b0c4
Nothing failed. Every API call succeeded.
An agent with a write token updated a deal’s close date at 2:14 am, off a misread email. The forecast moved a quarter. Nobody knew until the pipeline review, eleven days later.
The problem is not that agents propose bad changes — reviewers exist for that. The problem is that a write credential turns a proposal into a fact, silently, with no diff, no evidence and no signature.
crm.audit — what there was to find, eleven days later
02:14:07 agent.write Opportunity "Northwind" · Close date 2026-11-30 → 2026-09-30 token: crm_admin (full write) · evidence: — · reviewer: — +11 days forecast review — variance traced to one record root cause: "targeting end of Q3" meant their fiscal Q3
[ 02 / 09 ] · HOW IT WORKS // the change set lifecycle //sha 6b86b2 ← 9f86d0
Four gates. Three of them can stop it.
S1 · PROPOSED
The agent emits a change set
A batch of proposed changes, each with its cited evidence, a stated reason and a confidence score. No write happens here — or anywhere the agent can reach.
NOT A GATE
G1 · POLICY + RISK
Deterministic evaluation
Twelve rules produce a verdict per change; named, signed signals produce the risk score. Schema violations are blocked before a reviewer ever sees them.
CAN STOP IT
G2 · REVIEWER
A human decides, per change
Diff, evidence and verdict side by side. Approve, reject with a note, or ask for context. Batch approval by policy class — never a bypass.
CAN STOP IT
G3 · POLICY RE-RUN
Evaluated again, at merge time
Against live record state, immediately before the write. A record that moved since review — or became immutable — fails closed and is audited.
CAN STOP IT
S5 · WRITTEN
The merge worker writes
Approved changes only, by the sole holder of the write credential. Before/after snapshot and evidence references land in the append-only audit trail.
SOLE WRITER
The detail a careful engineer notices: policy runs twice. The second evaluation runs against live record state immediately before the write — a record that changed between review and merge fails closed, and the refusal is audited.
[ 03 / 09 ] · THE WRITE BOUNDARY // custody, not vigilance //sha 3f79bb ← 6b86b2
The agent reads whatever it likes. Reads are not the mechanism.
What it cannot do is write. And what it cannot do is tell ActionsLedger what a record currently says: the ledger reads the record itself and computes the before side of every diff. A fabricated "current value" has nowhere to land.
The merge worker is the sole holder of the write credential. Not the agent, not the ledger’s read path, not the reviewer’s browser.
AGENT
reads notes, email, calendar. Emits one thing: a change set.
credential: none
→
ACTIONSLEDGER
reads the record itself, computes before, scores, holds for review.
credential: read-only
→
MERGE WORKER
writes approved changes only, after policy re-runs.
credential: sole write token
[ 04 / 09 ] · EVIDENCE // verbatim, located, timestamped //sha 2c6242 ← 3f79bb
The agent cited evidence that argues against its own proposal.
A real case from the review console: the agent proposes advancing an investor from 04. Dataroom Access to 05. Initial Due Diligence. Confidence 71%. Risk 87/100. One of its own two citations reads: "Re-engaged. Meeting being set. We would not call this diligence yet."
The reviewer sees it in three seconds and rejects.
Verifiable citations defeat fabrication, not bad reasoning. The machine did not catch this — a human did, fast, because the verbatim excerpt sat next to the diff. That is the claim, and it is the honest one.
REJECTEDby Maya Lindqvist · reviewer note attached · retained forever
[ 05 / 09 ] · POLICY AS CODE // deterministic, or it is not policy //sha d4735e ← 2c6242
Twelve deterministic rules. The most restrictive verdict wins.
Auto-approval is an allowlist, not a fallback. The same twelve rules cover every system of record; a PolicyProfile names which properties carry stage, money, ownership and personal data in a given schema.
rules.ts — the rule
// Auto-approval is an allowlist, not a fallback. { id: "rule.stage.review", statement: "Changing Stage always requires human review, regardless of confidence.", maxOutcome: "needs_review" }
verdict — what it produced for chg-n5
{ "change": "chg-n5", "policyResult": "needs_review",
"risk": { "score": 87, "level": "high",
"signals": [
{ "Action type: change_stage", +40 },
{ "Property sensitivity: Stage", +20 },
{ "Agent confidence 71%", +12 },
{ "2 corroborating sources", 0 },
{ "Affects revenue forecast", +15 } ] } }[ 06 / 09 ] · ANY SYSTEM OF RECORD // one interface, one profile //sha 4e0740 ← d4735e
Onboarding a new system is one implementation and one profile.
Nothing else changes — not the policy engine, not the review console, not the audit trail. Two guarantees fall out of the schema descriptor with no per-system code:
- 01An agent cannot invent a select option that does not exist. Closed option sets are read from the schema and enforced on every property a change would write.
- 02Computed properties are refused. Formulas and rollups are marked read-only by the descriptor; a write to one is blocked before it reaches a reviewer’s queue.
connector.ts — the whole surface area
interface SystemConnector { describeSchema(): Promise<SchemaDescriptor> // props, options, computed readRecord(id): Promise<BusinessRecord|null> versionOf(record): string // Last edited | Modstamp | xmin applyChange(change, ctx): Promise<WriteOutcome> }
[ 07 / 09 ] · THE AUDIT TRAIL // append-only, hash-chained //sha ef2d12 ← 4e0740
Every event commits to its predecessor.
Sequence-numbered, hash-chained, exportable as SOC 2 evidence. A rejected change is retained forever. A refused merge is recorded as deliberately as a successful one — on an audit surface, the writes that didn’t happen are half the story.
SEQEVENTPAYLOADCHAIN
01042record.write
LP Opportunity "The Meridian Foundation" · Next step
− Next: ?+ Send Fund II teaser to Nadia before 12 Sep, ahead of Climate Week slot
evidence: aev-3, aev-5 · approved by usr-ml · change chg-401
this: sha256:4f2a9c…
prev: sha256:b81d44…
prev: sha256:b81d44…
[ 08 / 09 ] · RUNS IN YOUR TENANT // who holds which token //sha e7f6c0 ← ef2d12
The credential inventory is the security model.
One component can change a record. Everything else says "no path" — not "policy forbids it", but "there is no credential with which to do it." Self-hosted and VPC deployment on the Enterprise tier; hosted is single-tenant per workspace.
The full credential model, on the Security page →COMPONENTCREDENTIALCAN CHANGE A RECORD
AgentNone. Reads via your existing sources; emits a change set.NO PATH
ActionsLedger read pathRead-only token per system of recordNO PATH
Reviewer consoleUser session. No record credential.NO PATH
Merge workerThe write credential, scoped per systemSOLE WRITER
Audit storeAppend-only key. No update, no delete.NO PATH
[ 09 / 09 ] · PRICING // per reviewer, never per change //sha 790269 ← e7f6c0
Free1 SYSTEM · 1 REVIEWER
$0
100 proposed changes/mo, 30-day audit retention. Shadow mode included.
TeamUP TO 20 REVIEWERS
$49 /reviewer/mo
Unlimited systems and changes, 1-year audit retention, policy editor.
BusinessUNLIMITED
$99 /reviewer/mo
SSO/SAML, roles, segregation of duties, hash-chained audit export, 7-year retention.
EnterpriseSELF-HOSTED / VPC
Custom
Custom connectors, configurable retention, DPA, SLA.
We charge per reviewer, never per proposed change. Volume pricing would make you think twice about letting the agent look at more of your workspace — which is exactly backwards.
[ FAQ ] · THE REAL OBJECTIONS //sha 19581e ← 790269
Q1What if the agent is bad?
Shadow mode. It proposes, nothing merges, and you see the approval rate before you grant anything. A bad agent costs you reading time, not data.
Q2Won't reviewers just rubber-stamp?
Batch approval by policy class, so humans only see what needs a human. And the honest answer: rubber-stamping is the failure mode we design against hardest — it is why evidence sits next to the diff instead of behind a click.
Q3Why not a runtime policy gate on tool calls?
A gate must be right about every call, in the moment, with no reviewer. A custody boundary has to be right about one thing: who holds the token. We chose the smaller thing to have to be right about.
Q4Do you store our data?
Records, no — read on demand. Cited source excerpts, yes, immutably, so the audit trail still resolves in five years. Retention windows per tier are on the pricing page.
Q5Self-hosted?
Enterprise tier. Same codebase, your VPC, your keys. The credential inventory above doesn't change — it just all runs on your infrastructure.
No magic. A policy engine, an evidence pack, and a signature on every write.
Free tier, shadow mode by default: the agent proposes, nothing merges, and you see the approval rate before you grant anything.