How do you keep two agents from overwriting each other's pending draft?

Short version: the interesting decision was not the feature, it was where the permission lives. Most MCP servers are thin wrappers over a read API. That is fine until the tool has to write, and then the design question changes completely. A write-capable MCP server has to answer: who is allowed to call this, what happens when the model calls it with a plausible but wrong argument, and how a human sees what happened afterwards. None of those are transport concerns, which is why so many servers punt and expose the raw write. What we did: tools return pending objects, not effects. The MCP surface has no publish tool at all. Approval lives in the database, so the agent literally cannot express 'publish this now' because there is no tool for it. That has a cost: the agent is less useful, and you have to explain to users why the thing they asked for did not happen yet. Curious whether others landed on the same trade or found a better one. What did you land on, and what did it cost you?