Four Accounts of Agent Write Access. Two Describe a Gate Before the Write.

In August we read the coverage of Salesforce’s plugin for Claude and found exactly one named control: permission inheritance. Approval thresholds, write rate limits and reversibility did not appear anywhere in what the company chose to lead with. We wrote then that they might exist regardless, and that a control you cannot name is a control your risk team cannot review.

The vendor’s own documentation now names one of them. “By default, Claude asks the seller to approve each proposed change before it’s written.” That sentence is product documentation rather than a press quote, which makes it the strongest material available on this question. It also carries two words that do most of the work: by default. A default is a starting position. The sentence does not say who is allowed to move it.

Three other accounts published on 14 and 15 September 2026 answer the same question, and they answer it differently enough that the four accounts sort into a taxonomy. A trade article about Figma, published on 14 September, corroborates the weakest position in it.

What shipped at Salesforce, and what the announcement still leaves open

The scale is worth stating before the controls. Salesforce in Claude carries 37 skills and 2 connectors, and Anthropic reports 7,000 Salesforce sellers along with deployments at GitLab, Siemens and Legora. It is in beta on all paid plans. Seven thousand sellers and beta on all paid plans is not a pilot.

The identity model is quoted directly: “Sellers sign in with their Salesforce credentials and Claude reads only what their permissions allow.” Nothing is minted for the agent. It borrows a grant that the seller already had, which is the same property we took at face value in August and which still governs only which records are in reach.

The approval sentence is the new part. Per proposed change, before the write, with a human in the path. That is a direct answer to the blast-radius question, and it is the answer we said was missing.

One write in the announcement is described without an explicit approval step: adding stakeholders found in email and Slack threads as contacts on the account. I read that as the announcement drawing a line between a low-consequence create and a change to an existing record. The announcement does not say that is the line, so treat the reading as mine and not theirs.

Four accounts, four positions

Approval per write. Anthropic’s default asks the seller to confirm each proposed change. The unit of consent is the individual write.

Approval per action class. WorkOS published a decision table with three outcomes inside a single workflow: searching charges is allowed, issuing a refund requires approval, deleting a customer record is denied. The unit of consent is the operation type, decided in advance, and one of the three outcomes is a refusal rather than a prompt. That distinction matters more than it looks. A deny needs no human at runtime, so it cannot be worn down by a seller clicking approve forty times in a row.

Approval at grant time, with provenance on every call. Theory Ventures is a venture firm describing a tool it built for itself and has run for a year. Write access is granted, in their words, “only when the task requires it and we are comfortable with the scope and consequences of the changes.” The account places the gate at the moment the capability is handed over and describes no prompt at each use. What compensates for that is instrumentation: every tool call carries a task_context field and a shared conversation ID, and each write operation gets its own tool rather than sharing a general-purpose one. Attribution is designed in, which is precisely the property we found missing in the CRM audit trail.

No gate in the account. Linear’s changelog for Loops describes a run that “can automatically update the launch plan and post a Slack message explaining what changed, why, and who needs to act.” No approval step appears anywhere on that changelog. The changelog links to Linear’s own docs for Loops, which I did not read, so the honest statement is that the changelog describes none. What it does describe is review after the fact: “Each loop run starts a conversation with Linear Agent. Once it finishes, you can continue that conversation like any other agent session to review the work.”

Retrospective review is a real mechanism. It is also a different mechanism. A conversation you can open after the launch plan changed and the Slack message went out tells you what happened. It does not decide whether it should have.

The Figma case corroborates the fourth position

Figma’s generative plugins are in open beta, per the trade write-up. They cannot be monetized, and they run inside the native PropsKit interface without the third-party API calls that classic plugins could make. That last constraint is a containment boundary, and a meaningful one.

What the article does not describe is any gate on the generated code itself: no sandbox for a first run, no permission prompt, no diff, no dry run, no pre-publication review. The only safeguard it states is advice to test thoroughly. The piece is trade commentary rather than a primary source, its central facts trace to four Figma help-center articles, and the author flags their own speculation where it occurs. When the beta opened is not stated in any source I have. Read it as corroboration of a pattern, not as documentation of Figma’s design.

One quantified claim across the five accounts

Here is the number that decides how much any of this taxonomy is worth. Across all five accounts there is exactly one quantified performance claim: Theory’s “100x multiplier on time-to-useful-result for some requests,” which is unbenchmarked and hedged in its own sentence by “some.” There are zero accuracy figures and zero error-rate figures anywhere.

None of the five accounts offers evidence that a pre-write gate costs throughput, and none offers evidence that an ungated write produces errors. The taxonomy cannot be ranked on outcomes, because nobody measured any. What it does reveal is whose judgment each design trusts, and at what moment it asks for it. The two designs that ask before the write are the two describing writes to business records. The two accounts describing no gate are describing document and artifact writes: a launch plan, a plugin. Both accounts read as though those were cheap to get wrong.

We have argued the surrounding architecture in the four-floor containment stack. Two earlier pieces sit beside this one: Don’t Trust the Agent, Mediate It and Your Agent Fleet Ships Without a Kill Switch. What these four accounts add is narrower and more useful: a set of positions you can be placed in, whether or not you chose one.

Do this now: place every agent write path in one of the four positions

Take an hour. List every path by which an agent writes anything at your company, including the ones that write documents rather than records. For each path, fill three cells.

The position. Per write, per action class, at grant time, or none. Write the words down. A path you cannot place is a path where nobody decided, and it will default to none.

Default or invariant. If the gate is a default, name who can turn it off and whether that change is logged. Anthropic’s sentence is the model here: a default is a good starting position and a weak guarantee. An invariant enforced at the boundary where the write lands is a control. A default a user can clear on a busy Thursday is a preference.

One denied operation. WorkOS’s table has a row that is not a prompt. Pick one operation on each path that an agent may never perform, regardless of who approves, and enforce it where the write is executed. If every row on your table is “requires approval,” you have built a queue of confirmations, and confirmation fatigue will empty that queue for you.

The document-writing paths are where I would start, because they are the ones with no gate described in either account above, and because a launch plan that quietly changed is harder to notice than a re-staged opportunity. Nobody gets an incident report for a wrong sentence in a plan. They get a decision made on it.

---

This analysis synthesizes Bringing Salesforce into Claude (Anthropic, September 2026), Who gets to define an AI agent’s intent? (WorkOS, September 2026), Building a Company Brain People Actually Want to Use (Theory Ventures, September 2026), Loops for product management (Linear, September 2026), and Figma Is Turning Designers Into Plugin Makers (Web Designer Depot, September 2026).

Victorino Group helps teams place every agent write path in a named position before the default becomes the policy. Let’s talk.