Building Atlas PM Agent, the page-scoped chat had to be useful on real PRDs and backlogs without the AI ever silently overwriting user content.
THE DECISION
The scoped chat assistant cannot write to the database. It can only emit structured proposal cards (create_story, edit_prd_section, etc.) that the user must explicitly Apply.
Letting an LLM write directly to a PRD is a trust-killer — a single bad edit destroys confidence in the whole tool
Forcing the model to call typed propose_* tools enforces output shape and keeps the write path narrow and auditable
PRD applies snapshot the prior content into a versions table first, so even an Apply is reversible
The same pattern lets the chat stay ephemeral on the backlog page — no message persistence needed because intent is captured by the proposal, not the conversation
Trustworthy AI edits on real PRDs
Reversible PRD writes via auto-snapshot
One narrow write path that's easy to audit and rate-limit
Structured outputs (typed tool calls) instead of free-form text
Extra click between intent and outcome
More code than 'just stream and patch'
Backlog applies aren't versioned yet — only PRD has full undo
The agent became safe enough to use on actual PRDs. The proposal card pattern also doubles as a UX primitive — users can see exactly what's about to change before committing, which is the only way I'd put an LLM near a source-of-truth artifact.
For agentic writes, the right unit isn't 'message' or 'edit' — it's 'proposal'. Make the model produce typed proposals, make the human commit them, and snapshot before every commit. Trust is a feature, not a vibe.