Write & approval model
What each skill writes - and who has to approve it
The platform's safety model: reading is free, writing is controlled. Reads go through security_invoker views; every write goes through a security definer RPC that checks em_private.accessible_write before it touches a row - base-table writes are revoked from the scoped roles. On top of that, judgement-tier changes require an explicit human OK (propose → approve → apply) and only deterministic facts write on their own. Every approval-state below is taken from the skill's own contract.
Write & approval matrix - all 12 plugins, every skill
"Writes to" lists the em.* table(s) each skill mutates through its RPC. Account changelog rows are an audit side-effect of most writing skills and are noted where they apply.
| Skill | Writes to | Human approval before write |
|---|---|---|
| em-core · Foundation | ||
| /em-setup | em-manifest.json local config file, not a Notion DB | Required reads back & confirms |
| em-task-manager | em.tasks via em_db.tasks | Required manual / audit modes · Delegated api mode (caller-gated) |
| em-identity-resolver | — never writes | Read-only |
| account-changelog | em.account_changelog_entries | Automatic Mode A (caller already confirmed) · Required Mode B (interactive) |
| notion-writing | Caller's target page formatting helper, no DB of its own | Delegated inherits caller's gate |
| em-copilot · Assistant | ||
| qira | — routes only; no direct write | Enforces gates confirmation contract + each downstream skill's gate |
| _assistant-core | auto-memory file last-context only | Enforces gates waits on every downstream write-gate |
| em-ask | EM Library Gaps one Open row on a miss; reads the EM Library only | Read-only except an automatic gap-log when the library doesn't cover the question |
| em-howto | Qira Docs Gaps one Open row on a miss; reads the docs corpus only | Read-only except an automatic gap-log when the docs don't cover the tooling question |
| em-people-management · People | ||
| em-1on1-logger | em.one_on_one_sessions · em.wins (optional) via em_db.one_on_one | EM-driven EM supplies the score & driver in-session |
| em-feedback-builder | Feedback (via em_db.feedback) · JP_TASKS (follow-up) · .eml file | Required draft confirmed yes / no / edit |
| em-feedback-follow-up | Feedback (via em_db.feedback) | Per-item EM picks Done / Escalate / Snooze |
| em-account-intelligence · Accounts | ||
| em-call-profiler | — emits signals JSON | Read-only |
| em-email-profiler | — emits signals JSON | Read-only |
| em-profile-writer | em.stakeholder_profiles (auto-tier) · account changelog | Automatic deterministic; honors "Skip auto-update" |
| em-conversation-log-writer | em.conversation_log_entries | Automatic auto-generated row, idempotent |
| em-okr-management · Delivery | ||
| em-okr-builder | Tability (Outcomes · check-ins · Initiatives), mirrored to em.objectives/key_results · account changelog | Required explicit confirm before writing to Tability |
| em-okr-reviewer | Tability (check-ins · Initiatives) · account changelog | Per-KR EM-driven check-in loop |
| em-okr-scorer | Tability (final check-ins · close Initiatives) · account changelog | Required final scoring confirmed / edited |
| em-okr-auditor | account changelog audit row only | Read-only never writes OKRs |
| em-risk-management · Delivery | ||
| em-risk-detector | em.risks (new row / comment) · account changelog | Required never writes without confirmation |
| em-risk-reviewer | em.risks (update / comment / close) · account changelog | Required confirm before each write |
| em-risk-hygiene | — produces a punch list | Read-only |
| em-risk-escalator | .eml file · em.risk_comments + account changelog | EM sends ready-to-send .eml; log is a non-blocking side-effect |
| em-planning-assistance · Planning | ||
| daily-briefing | — generates a briefing artifact | Read-only |
| em-am-signal-emitter | — pure formatter, no I/O | Read-only |
| em-reporting · Reporting | ||
| monday-briefing | — generates a briefing artifact | Read-only |
| em-bigmac-framework · Delivery | ||
| sprint-audit | em.bigmac_* (run results) + HTML reports · tasks via em-task-manager | Automatic deterministic orchestrator writes local files |
| em-routines · Foundation | ||
| em-platform-morning-run | em.signals · em.proposals (staged) · em.daily_plans stages judgment, never writes risks/feedback directly | Automatic emits signals + stages proposals; nothing consequential applied |
| em-platform-closer | em.proposals (apply) · em.daily_plans (close) · logger-owned tables via apply() | Approval-gated applies only ticked proposals + the trust-ladder 'auto' path |
| em-platform-backfill | logger-owned tables factual replay only; no risks/tasks/plans/proposals | Automatic ledgered, idempotent historical capture |
Approval states
Required explicit confirm before the write
Per-item / EM-driven human decides each item in-session
Approval-gated a separate human Approve step (queue / checkbox)
Automatic deterministic, writes without approval
Delegated worker; inherits the caller's gate
Read-only never writes