My AI assistant writes to my database hundreds of times a week. It creates tasks, files documents, updates records across three businesses. It has never once corrupted the schema. Not because it is careful. Because it is not allowed to be careless.
The database is text
There is no Postgres here, and no vector store. The database is roughly 500 markdown files on disk, versioned in git. Each file is a record. Each record has a type, twelve of them in total, and each type has required fields and a fixed set of allowed values. A task needs a status, an owner, a priority. A project needs an area. The structured metadata sits at the top of every file, and the rest is readable by a human with their eyes.
Most people store their AI's knowledge in someone else's cloud. I store mine in plain files I own. That part is not the clever bit. The clever bit is the gate in front of them.
The gate
Every write goes through one module. Around a thousand lines of Python that no agent and no script is allowed to write around. It works as a whitelist, not a blacklist. Unknown field? Rejected. Task filed in the wrong folder? Rejected. A status value that is not one of the three I allow? Rejected before it touches the disk.
And the part I am quietly proud of: after every write, it reads the file back and compares what landed on disk against what it meant to write. If they do not match, it raises and treats the file as corrupt. Trust but verify, pointed at my own tooling.
Why I bother
An AI that can write anywhere will eventually write garbage. I know this because I lived it. In the first week, my assistant created tasks with fields that did not exist, files in the wrong place, and three different spellings of the word "active". A folder of markdown without rules is just a messy folder.
So I stopped relying on the AI being tidy and made untidiness impossible to commit. The schema is not a guideline it tries to follow. It is a wall it cannot walk through.
The honest part
It holds because every write is funneled through that one gate. Bypass it with a raw file write and the wall simply is not there. So there is a pre-commit hook as a second line of defence, and a hard personal rule never to write around the layer. This is protection by tooling and discipline, not by cryptography. A tired engineer at 2 AM could still do damage.
And at this scale, hundreds of files and not millions, plain text plus git beats a real database on every axis I actually care about. Reads are instant. Every change is a commit, so a bad bulk edit is one command to undo. The AI can point at the exact file it read, and I can open it and check. It works on a plane with no internet.
What it taught me
The unlock was not giving my AI more freedom. It was giving it a database it cannot break, and then letting it move fast inside those walls. Constraints are not the opposite of autonomy. They are the thing that makes autonomy safe to hand over.