A preventive approval gate for every agent write — in a governed spreadsheet on its own, or wired to Postgres, MySQL, BigQuery, Snowflake. Protected outputs wait in PENDING; you approve per cell, per write.
The invariant: a protected output never publishes on the strength of an unapproved agent write.
| line | Q2 | Q3 |
|---|---|---|
| Bookings | 1,040,000 | 1,120,000 |
| Net revenue | 980,000 | 1,240,0001,880,000Pending |
| Gross margin | 62% | 64% |
Live: propose → hold → approve → commit
To hold the pen is to have the final say — the hand that signs. Agents are fast with a pen; Penholder keeps it in yours. Every write they propose is held — pending — until you take the pen back and approve.
The term is borrowed from diplomacy: at the UN Security Council, the penholder is the delegation that leads a resolution — the one who drafts and holds the pen on its text. Here, that pen stays with a human.
Agents draft. You hold the pen.
Give an agent write access and one bad row can silently move a number you report on. Take it away and it's a toy. Penholder is the third option: agents draft, a human signs off, and nothing protected publishes until then.
A gate, not a rollback. The change is caught before it lands — per cell, per write.
An agent is a first-class principal — per-cell ACL, provenance. It proposes an edit or a database write. It never gets raw credentials.
Protected outputs freeze. A bad upstream input holds everything derived from it — taint stops the silent recompute.
You review current vs proposed and approve per cell, per write. Approve or reject. The human keeps the last word.
Only on approval does it commit — fail-closed on conflict, and hash-chained into a tamper-evident op-log.
The spreadsheet is a first-class governed store on its own. Databases are optional — read from many, write back to any. Use one layer or all three; the gate is the same.
The grid is the store. Agents propose, you approve. Op-log, taint, per-cell ACL and a tamper-evident audit — all on a plain sheet. No database required.
Pull rows from Postgres, BigQuery, other workbooks into one governed model. Bring scattered data together in a sheet — read exactly what you need.
When you're ready, approved changes commit back to your real databases — fail-closed on conflict, hash-chained. The top of the ladder, not the entry ticket.
One gate — whether it's a cell or a database.
Compose one governed sheet from many sources — then, when you're ready, push approved changes back. Agents get a proposal channel, not raw credentials; fail-closed on conflict; every write hash-chained. Row-mutation for OLTP, append-only for warehouses. Plenty of teams never leave the sheet.
Hold before publish. Not undo after damage.
Every proposal, approval, and commit is hash-chained. Break a link and it shows. Provenance and delegation are recorded per principal — human or agent.
Close numbers no agent can move without sign-off. Forecasts, consolidations, commissions — proposed at machine speed, published only on approval.
Let agents update records at scale and approve the exceptions. Writes land in your CRM or database only after a human clears them.
A preventive gate and a provable log for every automated write — the maker/checker control regulated work already requires.
Agents can propose. They never hold the keys — and no one outside your account sees your data. Governance and privacy are the same posture, not a bolt-on.
An agent gets a proposal channel — not your database logins or API keys. A rogue agent can propose a change; it can't connect to anything.
Connection secrets live in an encrypted, account-scoped store — never written to the op-log, never visible to an agent or a reviewer.
Each account's workbooks are byte-isolated. No request can name another tenant's data, and reads are gated per cell, per reader.
Outbound connections are SSRF-guarded — a bound source can't be pointed at an internal address or a cloud metadata endpoint.
Every action is hash-chained and HMAC-signed. Break a link and it shows. Provenance is recorded per principal — human or agent.
A deterministic engine does the math; agents propose structure and inputs. No protected figure is ever an LLM's guess.
Penholder is a hosted service, not a repo. We're onboarding design partners hands-on — a working system, wired to your data, with the gate in your control.
Tell us which databases you run in production and what you'd hand an agent first. We'll set up a live demo on your scenario.
Keep the pen.
Agents draft. You hold the last word. Nothing protected ships until you say so.