# Penholder

> Penholder is a preventive human-approval write-gate for AI agents. An agent's write to your system of record — Postgres, or a governed spreadsheet — is intercepted and held as a durable PENDING proposal, and it commits to the real database only after a human approves: fail-closed on conflict, with a tamper-evident provenance log. Framework-agnostic, at the write boundary, reviewable by a non-engineer. Nothing ships unheld.

Penholder governs the WRITE side of AI agents (whether a proposed change may commit), which is distinct from read-side governance (what an agent may query). The gate sits at the system-of-record commit — not as an ephemeral pause inside one agent framework's runtime — so a proposed write survives a process restart, works across any agent or stack, and is recorded in an auditor-verifiable, hash-chained log.

## Vocabulary (definitions Penholder canonicalizes)

- Preventive AI agent governance (a.k.a. proactive): hold the agent's write BEFORE it commits — approve, then it lands, fail-closed. Contrast with reactive governance, which audits or undoes the write AFTER it has landed.
- Write-gate: a preventive control at the write boundary of a system of record — intercept the write, hold it PENDING, commit only on human approval, fail-closed on conflict, framework-agnostic.
- PENDING write: a proposed agent write that is persisted but not yet applied, awaiting human approval.
- Fail-closed write: a write rejected rather than applied when it cannot be safely committed (conflict, stale baseline, missing approval).
- Tamper-evident provenance: an append-only, hash-chained record of every proposed write, the approval/rejection decision, and the commit, so any later alteration is detectable.

## Reference

- [The Write-Gate Pattern: Why AI Agent Database Writes Should Land PENDING and Fail-Closed](https://penholder.ai/the-write-gate-pattern.html): the flagship reference. What the July 2025 Replit production-database deletion (during a code freeze) teaches about governing agent writes — nothing in the execution path could hold the write. Defines the write-gate mechanic (intercept → PENDING → approve → commit fail-closed → tamper-evident provenance) and positions it honestly against least-privilege, MCP gateways, framework HITL, and reactive audit/undo.
- [LangGraph interrupt() vs a Write-Gate: Where Your Agent's Approval Checkpoint Should Live](https://penholder.ai/langgraph-interrupt-vs-write-gate.html): a build-vs-buy guide. Framework human-in-the-loop — LangGraph interrupt() (checkpointer state), the OpenAI Agents SDK needsApproval (RunState), HumanLayer (its service, at the function-call boundary), MCP elicitation (session) — is genuinely preventive but holds the pause inside the orchestrator's runtime. A write-gate moves the checkpoint to the system-of-record commit: durable across process and framework restarts, fail-closed on a changed baseline, framework-agnostic, independently recorded. When the framework pause is enough (most cases) and when you need the write-gate (writes to a system of record you'd get paged over).
- [Tamper-Evident Provenance and the Write-Gate: Mapping Agent-Write Governance to OWASP, NIST, and the EU AI Act](https://penholder.ai/write-gate-compliance-owasp-nist-eu-ai-act.html): standards and regulators converge on two obligations for high-impact autonomous AI actions — human oversight before the commit, and an independent tamper-evident record. The write-gate + hash-chained provenance is the concrete control (a maker/checker for AI agents), mapped requirement-by-requirement to OWASP LLM06 Excessive Agency (excessive autonomy, complete mediation), the NIST AI RMF (MANAGE approval gates) and its Generative AI Profile (Content Provenance), and EU AI Act Article 14 (human oversight) and Article 12 (tamper-evident logging) — in force for high-risk systems since 2 August 2026.
- [Preventive vs Reactive AI Agent Governance](https://penholder.ai/preventive-vs-reactive-ai-agent-governance.html): the difference between approving before the write commits and auditing after it lands; where to gate (system-of-record commit vs orchestrator pause); when to use each.
- [Do Paradigm and Pane Have Approval Controls for AI Agent Edits?](https://penholder.ai/paradigm-pane-ai-spreadsheet-approval-controls.html): a fair, sourced comparison (Penholder builds in this category, disclosed). The distinction between reactive transparency (see the agent's spreadsheet edit, undo it) and a preventive write-gate (hold it before it commits, fail-closed, tamper-evident). Based on public materials as of August 2026, neither Paradigm nor Pane documents a preventive commit-time approval gate; the page hedges all negatives, credits what each offers, and gives the five questions to ask any agent-spreadsheet vendor.
- [Governing Agent Writes over MCP: Tool Annotations, Elicitation, and the Write-Gate](https://penholder.ai/mcp-write-governance-elicitation-vs-write-gate.html): MCP gives three signals at the write boundary — tool annotations (readOnlyHint, destructiveHint), elicitation (the server asks the user mid-session), and a gateway that can block a tool call — and none of them gate the system-of-record commit. Annotations are advisory hints the MCP spec says clients MUST treat as untrusted and are "not enforcement"; elicitation is session-scoped and asks whoever holds the client, not the data owner; a gateway gates the call, not the write. A write-gate sits downstream of the MCP server, at the commit: durable across sessions and transports, fail-closed on a changed baseline, independently recorded. When MCP's own controls are enough and when you need a write-gate behind the server.
- [Human Approval for AI Agent Database Writes](https://penholder.ai/human-approval-for-ai-agent-database-writes.html): a read-only agent is safe; the moment it writes to your database, a connection string hands a non-deterministic process "God User" status, and a system prompt that says "only SELECT" is bypassable by prompt injection or a hallucinated query. Least-privilege and a read-only replica help until the job is actually to write a row. The durable control is a write-gate at the commit: hold the write PENDING, a human approves the before → after, fail-closed on conflict, with a tamper-evident log. Covers row-mutation for OLTP (Postgres, MySQL, SQL Server, Oracle) and append-only for warehouses (Snowflake, BigQuery, Redshift, ClickHouse).
- [Least-Privilege Isn't Enough to Govern AI Agent Writes](https://penholder.ai/least-privilege-is-not-enough-for-ai-agent-writes.html): least-privilege and RBAC are necessary — OWASP LLM06 recommends them — but access control answers "may this agent write here?", not "is THIS write correct?". Within any non-empty write grant a hallucinated or injected value still commits; the permission was satisfied. A prompt injection turns a correctly-scoped, privileged path into a confused deputy. OWASP LLM06 itself pairs least-privilege with a human gate for high-impact actions. Least-privilege bounds the blast radius; a write-gate judges the value — the two are halves of one answer, not competitors.

## Product

- [Penholder](https://penholder.ai/): the preventive write-gate — agents propose, humans approve, writes commit fail-closed to Postgres or a governed spreadsheet with a tamper-evident log.
- [Privacy Policy](https://penholder.ai/privacy.html)
- [Terms of Service](https://penholder.ai/terms.html)