Writes back into your system of record.
There is exactly one path from agent output to a write in your system, and it is staged, whitelisted and approved. It also enforces the calling user's permissions in that system.
Drafting is automatic. Approving is not.
The question a managing partner asks about AI is not whether it can write. It is what happens if it writes something wrong and nobody catches it. Mayeshal answers that structurally: nothing reaches a counterparty and nothing writes back into your system of record without a named person approving it, and a draft carrying another client's identifier cannot be approved at all.
Shipped and running in production today
The contamination check fails closed
Every approval logged with user and timestamp
The problem
Autonomy is the wrong dial to turn first.
Most of the widely reported AI failures of the last two years were not model failures. They were governance failures: a system that could act, acting on something nobody had checked, in a context where the cost of being wrong was carried by the customer rather than by the vendor. Three quarters of organisations running agents in 2026 reported rolling one back or shutting it down.
The instinct that follows is to slow everything down with sign offs, which kills the value the tool was bought for. The useful split is different: make the drafting fast and unattended, and make the leaving slow and attended. Nobody minds a draft appearing on its own. Everybody minds a letter going out on its own.
That split is also what makes the audit trail meaningful, because every approval is a named human act with a timestamp attached to a specific artefact.
How it works
Draft, check, approve, record.
The same gate stands in front of an outbound document and in front of a write back into your system of record.
- 01
Draft freely
Assembly, extraction, summarisation and analysis run unattended, because none of them change anything outside the platform. Speed belongs here.
- 02
Check, and fail closed
Every draft runs a contamination check on approval, on packet generation and again on hand over. If it names an identifier belonging to another client's file it cannot be approved, cannot be packaged and cannot be dispatched. If the checker itself is unavailable, the answer is no rather than yes.
- 03
A named person approves
Approval is a person, not a role that happens to be logged in. What they approved, when, and what the artefact looked like at that moment are all recorded.
- 04
Record it where you will look for it
The approval and the resulting action are written back against the record in your own system, staged and whitelisted, so the trail lives where your people already look rather than only inside ours.
What it connects to
What the gate stands in front of.
Anything that changes the world outside the platform passes through it. Nothing else has to.
Outbound documents and correspondence.
Letters, notices and packets are drafted, guarded and approved inside the platform. Dispatch itself has its own page.
The audit trail.
Every tool call, every admin action and every approval is logged with the user, the timestamp and what was touched. One trail, because there is one system.
The cost meter.
Every model call passes a single chokepoint that records the model, the tokens and the dollar cost, which is how a per document cost can be quoted to four decimal places.
Where it matters most
The industries where somebody has to answer for it.
Regulated buyers ask this question first, and they ask it in the same words in every industry.
Legal
Records, deadlines, negotiations and the document file never sit in one place, and the client is asking one question about all of it.
Legal pack, live in productionFinancial services
Client records, a books and records obligation, and an examiner who wants to see what you knew and when.
Pack built and signedAccounting and tax
Client documents arriving as PDFs and email, and a person moving them into a spreadsheet by hand.
First customer build
Said plainly
The parts of this that are not finished.
The gate is built into the paths that needed it rather than existing as a generic primitive on every workflow you might add later. Where a new workflow needs an approval, that is configuration work we do with you, not a switch you flip on your own.
Approvals happen in the platform. Routing an approval out to email or to a chat tool and accepting the answer back is not built, so the approver comes to the queue rather than the queue coming to them.
On the audit trail, one honest qualification. It is one trail and it is complete in the places that matter, and making it tamper proof at the database level is applied on some tenants and is being applied to all of them. Self serve export of the log is not built yet. We would rather tell you which half is finished.
Get started
See it read one of your own matters.
Thirty minutes, on a screen share, on a matter you pick. We connect nothing, install nothing and ask for no credentials to have that conversation. If it is not obviously useful in the first ten minutes, we will tell you so and you get your afternoon back.