What this looks like in practice
An AI connected to Riktra follows the same rule, through the same door. It can call
propose_company_update; it cannot write company context directly. Approval is a separate tool, restricted to administrators and owners, and enforced in the database rather than in the tool description a model reads.
A scheduled agent should never approve its own proposals. That removes the only check in the system. See Scheduled agents.