Day 1
Connect one real agent, define 3–8 explicit permissions and verify the first signed protected action.
DESIGN PARTNER
7-day technical validation.
One real agent, one consequential workflow, a small authority surface and a fast technical decision. No enterprise-wide migration is required.
Days 2–3
Exercise ALLOW, DENY and REQUIRE APPROVAL behavior against the agreed workflow.
Day 4
Run one authorized controlled incident, inspect evidence and blast radius, then contain the affected scope.
Day 5
Rotate/revoke the affected credential path, complete remediation evidence and perform an authorized safe restart.
Day 6
Review evidence integrity, authorization latency, integration friction and operational behavior.
Day 7
Hold a technical go/no-go review: stop, extend into production-readiness work, or progress toward deployment.
SUCCESS CRITERIA
Prove the runtime boundary with one real workflow.
Authorized actions work, unauthorized actions are blocked, sensitive actions can require human approval, evidence is attributable, containment is selective, credentials can be recovered, and safe restart is evidence-gated.
Demo Lab is a self-guided sandbox. It does not start a design-partner validation. The 7-day validation starts only after we agree on the company's real agent workflow and success criteria.