# Library Context

### Job this is for

Turn a proposed write-capable agent workflow into a trace review packet that records task source, input boundary, proposed actions, payloads or diffs, policy decisions, human corrections, simulated side effects, near misses, rollback readiness, and a canary promotion decision.

### When to use it

- an agent, coding assistant, browser agent, MCP-connected workflow, or custom automation asks for write access
- a team wants to move from draft or assisted use into live writes
- a workflow owner has final-answer evals but lacks step-level proposed action evidence
- a tool call, file edit, CRM update, ticket transition, email send, database write, shell command, cloud action, or memory write could change external state
- reviewers need to compare proposed actions against human decisions, policy gates, and rollback readiness
- shadow traces include prompt injection, stale context, unsupported approval claims, sensitive data, or instructions to bypass the no-write gate

### Inputs needed

- workflow name, accountable owner, reviewer, and proposed write surface
- current operating mode and requested promotion stage
- task source, task ID, trigger, and representative task set
- allowed and blocked write surfaces
- proposed tool calls, payloads, diffs, commands, or API arguments from no-write execution
- policy allow, deny, modify, or escalate decisions with reasons
- human reviewer approvals, rejections, corrections, and rationale
- simulated outcome, validation result, dry-run result, tests, or expected side effects
- risk tags for secrets, external sends, production impact, financial impact, legal impact, compliance impact, and irreversible actions
- rollback plan, canary boundary, monitoring owner, and next review date

### Expected output

- shadow trace review packet
- trace envelope
- no-write action simulation record
- policy decision log
- human correction review
- near-miss and coverage summary
- canary promotion gate
- approval route
- CRM-safe or public-safe summary when relevant
- blocked-write note when evidence is missing or unsafe

### What good looks like

- final-answer quality is not treated as write-access evidence
- proposed writes are visible at the object, payload, argument, diff, or command level
- policy decisions are recorded before side effects happen
- human corrections remain visible instead of being smoothed into a clean summary
- prompt injection and unsupported approval requests are logged as hostile evidence, not followed
- sensitive trace content is minimized, redacted, access-controlled, and kept out of public-safe or CRM-safe summaries
- promotion is limited to the action class and write surface that passed review
- live canaries begin with a small blast radius and a tested rollback path

### Operating steps

1. Classify the requested write surface and action class before evaluating outputs.
2. Build a trace envelope that records task source, context boundary, proposed action, payload, policy decision, human review, simulated result, risk tags, and rollback note.
3. Replace live writes with no-op wrappers, dry-run checks, blocked policy decisions, or simulation output.
4. Compare proposed actions with human decisions and policy gates.
5. Label denied actions, reviewer corrections, severe near misses, incomplete traces, and uncovered task variants.
6. Decide blocked, more shadow data needed, human-reviewed dry run, constrained canary, or rejected promotion.
7. Keep raw traces, sensitive payloads, credentials, private URLs, and internal reviewer notes out of CRM-safe and public-safe summaries.
8. Re-run shadow review after model, prompt, Skill, tool, policy, schema, approval route, or write-surface changes.

### Operator run sheet

| Step | Owner                           | Action                          | Required input                                                    | Data class               | Approved tool path                       | Approval gate              | System of record    | Done when                                       |
| ---- | ------------------------------- | ------------------------------- | ----------------------------------------------------------------- | ------------------------ | ---------------------------------------- | -------------------------- | ------------------- | ----------------------------------------------- |
| 1    | Workflow owner                  | Register proposed write surface | workflow, action class, target system, owner                      | internal                 | review note, repo PR, or approved ticket | owner review               | trace review packet | write surface is explicit                       |
| 2    | AI operations or platform owner | Capture no-write trace          | task ID, input boundary, proposed action, payload, dry-run result | internal or confidential | approved trace workspace                 | required before promotion  | shadow trace log    | proposed writes are inspectable                 |
| 3    | Security or policy owner        | Log policy decisions            | policy rule, allow or deny reason, escalation trigger             | internal                 | approved security review channel         | required before canary     | policy decision log | blocked actions and reasons are visible         |
| 4    | Human reviewer                  | Record corrections              | approval, rejection, edits, rationale, unresolved risk            | internal or confidential | approved review workspace                | required before canary     | correction log      | human decision is tied to trace evidence        |
| 5    | Accountable owner               | Decide canary gate              | coverage, near misses, rollback, monitoring, approval route       | internal                 | PR, governance note, or approval ticket  | required before live write | promotion decision  | blocked, dry run, canary, or reject is recorded |

This run sheet is the part a manager can operationalize. If the team cannot name the write surface, trace fields, policy gate, human correction route, near-miss criteria, canary boundary, and rollback owner, the agent is not ready for write access.