Your workspace
Your agents. Your decisions. Your control.
Connected agents
No agents registered yet.
Guarded action lab
Security policy studio
Shape your workspace's security posture. Settings can make checks stricter, never bypass the built-in safety ceiling. Every edit is logged, versioned, and expires open unexecuted approvals.
All agents in this workspace can run within policy.
Local mock credential vault
Workspace owners can create, rotate and revoke server-generated fake credentials. The secret is encrypted in a private SQLite file and is never shown to agents, the browser or the mock worker. No Stripe, Shopify, email, or real provider API keys are accepted. This is not a cloud KMS.
No demo credentials created in this workspace yet.
Rotation and revocation cancel already-queued mock connector jobs for that action. Historical v1.7 mock dispatch is retained for offline regression compatibility; the v1.8 secure demo requires this vault. The new vault does not enable live provider access.
Every "Run sandbox" button uses the new guarded gateway: agent identity, action, tool, target, amount, units and approval are checked before ONE simulated receipt is recorded. Authorized sandbox receipts are queued for a separate signed mock-connector boundary. A private worker validates short-lived HMAC jobs and replay protection. No external provider is contacted; worker processing is a separate offline demo. Agents with direct credentials outside Guardian remain uncontrolled.
Each authorized sandbox receipt creates a server-owned connector outbox item. The local demo dispatcher verifies current agent permissions and policy version before signing a single short-lived mock request. Pending items are NOT live external actions. Queued mock jobs: 0
A valid single-record synthetic database deletion request starts denied. The agent may request an exception; the workspace owner must explicitly review scope and confirm a mock backup. Even after approval, the gateway records only a preview. No SQL DELETE is ever executed. Hard blocks cannot be overridden.
Agent & connector readiness
Connect a sandbox agent first, set a workspace policy, then use the trusted gateway. Never give Stripe or email provider keys to an AI agent. This panel does not collect, store or verify real credentials.
Scoped key, shown only once
ALLOW / APPROVAL / BLOCK
Single-use mock execution
Optional, read-only TEST-mode CLI
Workspace readiness: not checked yet.
Stripe test account connectivity is NOT verified here. The separate optional terminal checker performs only one read-only API request, with an opt-in key entered privately. Provider refunds, messages and live credentials remain disabled in this dashboard.
Real AI + Guardian activity
This dashboard already contains the authenticated, workspace-scoped Guardian API. Phase 2 adds a separate optional terminal bridge so a real OpenAI planner's strictly validated DEMO-only request can produce an event in this same workspace. No OpenAI key is entered into the dashboard and no real service tool is callable.
Choose lookup (view_customer_record) or export (export_customer_data). Save its one-time sandbox key locally.
05_PHASE2_CONNECT_AI_TO_DASHBOARD.bat. Choose offline (free) or OpenAI (paid opt-in); key input is hidden.
Click Refresh below. Export requires the signed-in owner to approve; the gateway remains synthetic-only.
Only synthetic events are stored. The dashboard does not independently attest whether an event came from a real model, a mock planner, or an agent client. The bridge's paid live test is separate from the previous disposable v2.2 live-test script.
Local pilot readiness & audit
This panel checks only your local synthetic workflow. It cannot certify a real cloud product. No OpenAI key, customer data or provider credential is required.
Local readiness not checked. Cloud private beta: NOT READY.
Before inviting real users: hosting isolation, HTTPS, secret management, MFA, verified email, backups, incident response, monitoring, external security testing, privacy/legal review and a production database are still missing or unverified. Never expose the local development server to the Internet.
Approval & audit activity
| Action / target | Amount / units | Decision | When | Review / run |
|---|---|---|---|---|
| No decisions yet. | ||||