Write arbitration
Write arbitration is the set of rules a data store applies when something wants to change it: who may write, where a write lands, who settles conflicts.
In single-writer software the question is nearly invisible. One person uses the application, that person is the authority, and a write is simply a write. Arbitration becomes a real design problem the moment automated writers are added, because an AI agent calling a tool is a writer with no accountability of its own and can be wrong in a way that reads exactly like being right. Arbitration is the answer to what that tool call is permitted to do.
A complete model has four parts. Authority: whether a given client may write at all, and whether its write commits or lands pending. Evidence: what each write carries about its origin, so the resulting fact can be checked later rather than trusted. Review: whether a person confirms before the write takes effect, and whether the credential that proposes is separate from the credential that approves, since a client able to do both is reviewing itself. Conflict: what happens when two writers make incompatible claims, which in practice means either silently picking a winner or keeping both and surfacing the disagreement.
The order in which these can be adopted is not free. Provenance especially is a property of the write path rather than a feature layered on top: a row stored without a source is a row whose source is gone. Adding it later yields a store where recent facts can be checked and older ones cannot, and a reader then has to know which is which, which is a harder position than having no provenance at all.
None of this is exotic infrastructure. Version control has had it for decades under different names: a commit carries an author, a branch holds work that has not landed, and a merge conflict is shown rather than guessed at. What is new is applying the same discipline to a record about people, written by a model, at conversational speed.
Why it matters
Agent access to software is now ordinary, so it has stopped separating products. What still separates them is what an agent's call is allowed to do unsupervised. In most tools it commits, and the cost surfaces months later as a record you cannot tell apart from one a person entered. Arbitration is also the practical answer to prompt injection: if the credential an agent holds can only propose, an instruction hidden inside a web page or an email has nothing to write to, and the attack terminates at a review screen instead of at your data.