Review AI edits before they land
Let AI write to your notes, and still decide what lands.
An agent that can only read your team's notes is a search box. An agent that can write is a colleague, until the afternoon it rewrites the pricing page from a stale email. The answer is not to take the pen away. It is to decide, per agent and per folder, which writes land on their own and which wait for a person.
Two modes, chosen on purpose
There are two honest ways to supervise an agent that writes. In the first, it waits: the change is drafted, a named person looks at it, and only then does it reach the note. In the second, it acts, and a person watches the record and undoes what was wrong. Both are reasonable. The mistake is drifting into one of them by default, usually the second, without anyone deciding.
A useful rule of thumb: let an agent write directly where a wrong line is cheap and easy to spot, such as its own working notes, meeting summaries and a running log. Make it ask where a wrong line is expensive or quiet: decisions, client facts, numbers, anything someone outside the team will read.
What a good review step looks like
The agent proposes, it does not overwrite
The edit arrives as a proposal against the note as it stands, not as a new version that has already replaced it. Readers keep seeing the current text until someone accepts the change.
Review the parts, not the whole
An agent asked to fix one date often tidies three paragraphs on the way. Reviewing hunk by hunk lets you take the fix and leave the tidying, instead of choosing between all or nothing.
Every accepted line keeps its author
Once a change lands, the history should say which agent proposed it, who accepted it, and when. Months later, that is the difference between a one-line correction and an argument about where a number came from.
Undo is one action
Some wrong changes get through review anyway. Reverting should add history, not erase it, and it should take one click rather than a restore from backup.
Why the review has to live outside the model
Telling an agent "ask before you change anything important" is a request, not a control. The model decides what counts as important, and text it reads along the way can talk it out of asking. A review step only means something when the system enforces it: when an agent set to propose simply has no way to write directly, whatever its instructions say.
The same goes for where it can write at all. Folder-level rules that bind agents separately from people keep the review queue short, because the agent cannot even propose changes to places it was never meant to touch.
Do not ask an agent to be careful. Give it a pen that can only draft where care matters, and a record that shows every line it wrote.
Keeping the queue from becoming the job
A review step that produces forty proposals a day gets rubber-stamped by Thursday, and then it protects nothing. Three habits keep it honest:
- Narrow the reach first. Most noisy queues come from an agent allowed to propose everywhere. Limit it to the folders where its work belongs.
- Move trusted work to direct writes. When an agent's summaries have been accepted unchanged for weeks, let it write those directly and keep review for the rest.
- Batch the routine. Retagging fifty notes is one decision, not fifty. Review it as one change with a dry run first and a single undo after.
What review does not do
A reviewer approving a proposal is checking that it reads right, not re-deriving every fact in it. Review catches the rewrite nobody asked for and the confident line in the wrong place. It does not make the agent correct. Attribution and history are what let you find and fix the rest later, which is why they matter even for changes that were approved.
Memava is built for this: any agent can be set to proposal mode so every write waits for a reviewer, proposals are accepted hunk by hunk, every line carries its author in the history, revert adds history rather than erasing it, and per-file rules written as sentences decide where each agent can reach. Batches run with a dry run and one undo. The security page covers the access model, and the developer page lists the tools.
Keep reading: CLAUDE.md, AGENTS.md and a shared team memory · Connect Claude to a shared team memory · MCP security: what to check before you connect AI to your notes