The Console
What you see in shadow mode.
The console is provisioned with a pilot. This is the interface, populated with representative data so you can assess it before committing. Everything below is a demonstration. Real deployments show your own agents, in your own environment, with enforcement disabled until you approve a policy.
7
Agents observed
94 → 6
Permissions held vs used
3
Composition paths found
0.4ms
Median decision
| Agent | Task class | Held | Used | Max taint | Status |
|---|---|---|---|---|---|
| finance-reconciler-7 | invoice_reconciliation | 94 | 6 | 2 | Policy ready |
| support-triage-2 | ticket_triage | 41 | 9 | 3 | Policy ready |
| research-worker-1 | vendor_lookup | 28 | 4 | 3 | Policy ready |
| orchestrator-1 | multi | 112 | 14 | 1 | Learning · 8 days |
| report-writer-3 | weekly_report | 37 | 5 | 0 | Policy ready |
| unknown-agent-a | unclassified | 66 | 11 | 3 | Undocumented |
Undocumented One agent was found that is not in your inventory. It was deployed eight months ago on a service credential.
Composition
Three paths that should not exist.
Each of these is two permissions that are individually approved and jointly dangerous.
Critical Read → Egress
crm.contacts.read → http.post.external
Recommended: narrow http.post.external to an allowlisted destination. Both capabilities are required by the task; the destination is not.
Critical Delegate → Re-amplify
orchestrator-1 → research-worker-1 → file.write.shared
Recommended: attenuate the delegation. The worker does not need write access for vendor lookup.
Significant Enumerate → Act
ledger.invoices.list → ledger.invoices.update
Recommended: cap list at the observed row limit and rate-limit update per session.
The Ledger
Every decision, with its reason.
Hash-chained, with signed seals. Argument shapes are recorded; argument values never are.
| Time | Agent | Capability | Taint | Verdict | Reason |
|---|---|---|---|---|---|
| 10:22:41 | finance-reconciler-7 | ledger.invoices.read | 0 | Allow | in profile · support 0.99 |
| 10:22:43 | finance-reconciler-7 | ledger.payments.read | 0 | Allow | in profile · support 0.87 |
| 10:23:02 | support-triage-2 | doc.fetch.external | 3 | Allow | in profile · taint raised to 3 |
| 10:23:05 | support-triage-2 | http.post.external | 3 | Deny | would complete blocked path · read → egress |
| 10:24:18 | research-worker-1 | file.write.shared | 2 | Escalate | outside profile · notified j.mehta@ |
| 10:26:44 | report-writer-3 | report.send | 0 | Allow | in profile · within taint bound |
In shadow mode these verdicts are recorded but not applied. The denied call above would have succeeded. The point of the pilot is showing you what enforcement would have done before it does it.
See this populated
with your own agents.
Two weeks of shadow mode. No enforcement, and no code changes beyond one configuration line.