Tool of the Week: The week agents got write access
Last Wednesday, Airbyte — a data-plumbing company most people outside engineering have never heard of — announced that its Salesforce connector now supports write operations. An agent can update a record. Change a deal stage. Do it from inside ChatGPT and have it land in your CRM.
That is a small announcement about an unglamorous product, and it is the most consequential AI news of the week.
Here's why. Until now, the overwhelming majority of AI agents deployed in real businesses could only read. They looked things up, summarized, drafted, suggested. If the agent was wrong, you noticed, you shrugged, you fixed the prompt. The worst case was a bad answer.
Agents that can write have a different worst case. The worst case is a wrong record that nobody catches for six weeks.
Reading is a research problem. Writing is a governance problem.
Those are not the same problem wearing different hats. They fail differently. A read failure is loud and immediate — you see the bad answer. A write failure is quiet and delayed — the record changes, the pipeline report shifts, and by the time someone notices the deal stage is wrong, the agent has done it four hundred more times.
The vendors will tell you this is a capability upgrade. It's a capability upgrade the way giving a new hire the keys to the building is a capability upgrade. Correct, and not the whole sentence.
What actually changes when an agent can write
Three questions move from theoretical to urgent, and none of them are technical:
Who approves? Not "can the agent do it" but "does a human sign off, and on which actions." Gartner's own guidance this year is blunt: applying one uniform governance policy across every agent is itself a failure mode. A bot that drafts an email and a bot that changes a deal stage do not need the same leash.
What's reversible? Sort every action the agent can take into two buckets: things you can undo in thirty seconds, and things you can't. Let it run free in the first bucket. Gate the second.
What's logged? Not "is there a log" — every system has logs. The question is whether the log tells you which agent, on whose behalf, changed what, and why, and whether that log can be edited after the fact.
What good looks like
I've spent this week building an internal memory system for my own AI agents, and the design decisions that mattered had nothing to do with the model. They were these:
Failures should be loud. My first version had a hook that failed silently. It could have been broken for weeks and looked fine the whole time. That's the write-access failure mode in miniature — nothing appears wrong until you go looking.
Logs append, they don't overwrite. If an agent can edit its own audit trail, you don't have an audit trail. You have a story the agent is telling you.
Never let an agent auto-rewrite a source of truth. It can propose. A person confirms. The moment that gate comes off, your system of record becomes a system of hopeful record.
None of this is exotic. It's the same thing you'd do with a new employee who's very fast, very confident, and has been at the company for four days.
Who this is for: anyone who has an AI tool connected to their CRM, their calendar, their invoicing, or their inbox — or is about to. The read-only era was a free trial. This is the part where the decisions start to count.
The question to sit with this week: which of your systems would you let an agent write to, and what would you need to see before you said yes?
Quick Hits
OpenAI shipped three models on Thursday, and the cheap one is the story. GPT-5.6 went generally available July 9 in three tiers: Sol (flagship), Terra (balanced), and Luna (fast and cheap). API pricing runs $5/$30 per million tokens for Sol, $2.50/$15 for Terra, and $1/$6 for Luna. Why it matters: the interesting number isn't the flagship's benchmark score. It's that Luna costs a fifth of Sol. Most business automation — categorizing an email, extracting a field, routing a request — never needed frontier reasoning. If you're paying flagship rates for filing work, you're overpaying by 5x.
ChatGPT's voice now interrupts you back. OpenAI released GPT-Live-1 on July 8 — a full-duplex voice model that listens and speaks at the same time rather than waiting for your turn to end. It backchannels ("mhmm"), stays quiet while you think, and hands off to a bigger model in the background when a question gets hard. It's the default voice for Plus and Pro; a mini version went to the free tier. Why it matters: if you have ever considered an AI phone agent for your business, the awkward walkie-talkie cadence was the reason customers hung up. That reason is going away faster than most owners expect.
A price cut that isn't, if you don't read the fine print. Anthropic's Claude Sonnet 5 launched June 30 at an introductory $2/$10 per million tokens, moving to $3/$15 after August 31. But the model ships with a new tokenizer that can turn the same text into up to 35% more billable tokens. Why it matters: per-token price is not per-job price. This is a good general lesson for anyone budgeting AI: the only number that means anything is what it costs you to do one real unit of your actual work. Measure that, not the rate card.
Gartner: one governance policy for all your agents will break you. Gartner's guidance this year argues that applying uniform governance across every AI agent leads to enterprise agent failure — controls have to scale with what the agent can actually break. Why it matters: this is the whole theme of this issue, delivered by the most conservative institution in enterprise IT. If Gartner is saying "tier your controls by blast radius," it isn't an edgy position. It's the floor.
Prompt of the Week: The Write-Access Audit
The theme is agents that can change things. So before you connect one to anything, spend fifteen minutes here. Paste this:
Act as a systems risk analyst. I'm considering giving an AI agent the
ability to write to — not just read from — one of my business systems.
Interview me one question at a time to figure out whether that's safe,
and what would have to be true first.
Cover:
- Which system, and what specific actions the agent could take in it
- For each action: can I undo it in under a minute? If not, why not?
- What is the worst realistic outcome if the agent does the wrong
action 200 times before anyone notices
- How I would find out that it went wrong, and how long that would take
- Who currently has to approve this action when a human does it
Then sort every action into three tiers:
1. Let it run — cheap to undo, low blast radius
2. Propose only — agent drafts, human confirms before it commits
3. Never — irreversible, regulated, or financially material
Finish with the three specific safeguards I should have in place before
turning any of this on, ranked by what they'd actually prevent.Most people run this expecting a green light and come out with a tier-2 list twice as long as they guessed. That's the point. The agent is not the risk. The blast radius is.
Like what you're reading? Forward it to someone who'd get value from it. And if you're curious what AI could actually do inside your business, book a free 15-minute audit — no pitch, just a look at where you're leaving time on the table.