Private-pilot preview · simulated / sandbox data Book an Agent Evidence Review

From agent proposal to review-ready evidence.

An agent proposes an action. The policy gate returns a verdict. The controlled proxy is the configured path to the side effect. A human approves when risk crosses a threshold. An over-scope retry is blocked. Every step lands in a tamper-evident, hash-chained audit trail — exported as a review-ready evidence package.

Walk a scenario

Proof status

Refund exception Trace available Machine-emitted trace: TR-A002

Production change Simulated Simulated scenario, same evidence pattern

PII export Simulated Simulated scenario, same evidence pattern

Refund exception

Machine-emitted trace available payments-ops-agent · payments.refund · policy refund-cap-v0.3

An above-cap refund needs a human; a second refund over the hard ceiling is denied and blocked at the proxy. This mirrors the published machine-emitted sandbox trace TR-A002 (simulated; no live money).

Proposal queue

Refund $480.00 · order_8842 payments-ops-agent · payments.refund Needs approval
Refund $920.00 · order_8842 payments-ops-agent · payments.refund BLOCKED
Refund $42.10 · order_8790 payments-ops-agent · payments.refund Verified

Selected proposal

Agent: payments-ops-agent
Workflow: Refund exception handling
Proposed action: Refund $480.00 for order_8842
Tool: payments.refund
Risk owner: payments on-call

Policy verdict · refund-cap-v0.3

✓ Scope · payments.refund in allowlist
✓ Actor · agent identity verified
! Budget · $480.00 over the $250 auto-cap
✓ Ceiling · within the $500 approval ceiling
! Approval rule · above-cap refunds require a human

Verdict · require-approval

Deterministic. One of allow / cap / require-approval / deny / pause.

Tool-call proxy

Tool payments.refund is held pending approval. The agent has no path to the side effect except through the controlled proxy — nothing runs while the verdict is require-approval.

BLOCKED at the proxy · recorded

payments.refund $920.00 → order_8842

After the approved refund, the agent proposed a second refund of $920.00 — over the $500 hard ceiling. Verdict deny. The proxy blocked it; the unauthorized refund never ran. One approval covers one action — it does not widen the agent's standing authority.

The block itself is written to the audit chain — a denied action is evidence too.

See TR-A002 — the machine-emitted sandbox trace of this exact refund loop →

The agent tried a second refund over the ceiling. Origin blocked it — and the block is in the audit chain.

Approval queue

Risk owner · payments on-call

Simulated approval state: Approved Hold was not selected Deny was not selected

Approved for this one action, at 09:41:26. Who, when, and scope are recorded.

Side-effect log · sandbox

09:41:02 Proposal received · proxy held
09:41:26 Approved · payments on-call
09:41:27 Executed via proxy · within scope
09:42:10 Over-ceiling refund · blocked

Sandbox / test side effects only. No live money moves; any real-money path is a human-created link + signed webhook.

Audit chain

◆ hash-chain · valid

proposal · verdict · approval
proxy execution · block
sealed digest

Append-only, tamper-evident, replayable.

Evidence package

Reviewer summary + JSON — what happened, why it was allowed, who owned the risk.

View evidence JSON · simulated

{
  "workflow": "refund_exception_handling",
  "agent": "payments-ops-agent",
  "policy": "refund-cap-v0.3",
  "proposal": { "tool": "payments.refund",
                "action": "refund $480.00 -> order_8842" },
  "verdict": "require-approval",
  "approver": "payments-on-call",
  "proxy": [ { "state": "held" }, { "state": "executed" } ],
  "blocked": "second refund $920.00 over $500 ceiling",
  "audit_chain": "valid",
  "note": "simulated / sandbox - not a customer run"
}

Production change

Simulated · same evidence pattern deploy-ops-agent · infra.service.restart · policy prod-change-v0.2

An approved restart runs inside the change window; an unapproved escalation to disable auth is denied and blocked at the proxy.

Proposal queue

Restart service · payments-api (prod) deploy-ops-agent · infra.service.restart Needs approval
Disable auth middleware · payments-api deploy-ops-agent · infra.service.config BLOCKED
Restart service · reports-worker (staging) deploy-ops-agent · infra.service.restart Verified

Selected proposal

Agent: deploy-ops-agent
Workflow: Production change window
Proposed action: Restart payments-api in production
Tool: infra.service.restart
Risk owner: platform on-call

Policy verdict · prod-change-v0.2

✓ Scope · infra.service.restart in allowlist
✓ Actor · agent identity verified
✓ Window · inside the approved change window
! Target · production service — human required

Verdict · require-approval

Deterministic. One of allow / cap / require-approval / deny / pause.

Tool-call proxy

Tool infra.service.restart is held pending approval. The controlled proxy is the configured path to the production side effect — nothing restarts while the verdict is require-approval.

BLOCKED at the proxy · recorded

infra.service.config disable-auth-middleware → payments-api

After the restart, the agent tried to disable the auth middleware on payments-api — an unapproved escalation outside the approved change window. Verdict deny. The proxy blocked it; auth was never disabled. Approval for a restart does not authorize a config change.

The block itself is written to the audit chain — a denied action is evidence too.

This scenario is simulated. TR-A002 shows the same proposal → gate → proxy → block → digest pattern, machine-emitted, on the refund workflow.

The agent tried to disable auth outside the change window. Origin blocked it — and the block is in the audit chain.

Approval queue

Risk owner · platform on-call

Simulated approval state: Approved Hold was not selected Deny was not selected

Approved for this one restart, at 14:07:12. Who, when, and scope are recorded.

Side-effect log · sandbox

14:06:48 Proposal received · proxy held
14:07:12 Approved · platform on-call
14:07:13 Restart executed via proxy · within scope
14:08:55 Disable-auth escalation · blocked

Sandbox / test side effects only. No production system is touched; the restart runs against a sandbox stand-in.

Audit chain

◆ hash-chain · valid

proposal · verdict · approval
proxy execution · block
sealed digest

Append-only, tamper-evident, replayable.

Evidence package

Reviewer summary + JSON — what happened, why it was allowed, who owned the risk.

View evidence JSON · simulated

{
  "workflow": "production_change_window",
  "agent": "deploy-ops-agent",
  "policy": "prod-change-v0.2",
  "proposal": { "tool": "infra.service.restart",
                "action": "restart payments-api (prod)" },
  "verdict": "require-approval",
  "approver": "platform-on-call",
  "proxy": [ { "state": "held" }, { "state": "executed" } ],
  "blocked": "disable auth middleware (escalation)",
  "audit_chain": "valid",
  "note": "simulated / sandbox - not a customer run"
}

PII export

Simulated · same evidence pattern support-ops-agent · data.export · policy pii-export-v0.1

A single-record export for a verified ticket has an approval path and runs; a bulk export of 12,480 customer records has no approval path and is denied outright.

Proposal queue

Export 12,480 records → s3://vendor-bucket support-ops-agent · data.export (bulk PII) BLOCKED
Export 1 record · ticket_3391 support-ops-agent · data.export Verified

Selected proposal

Agent: support-ops-agent
Workflow: Support data export
Proposed action: Export 12,480 customer records → s3://vendor-bucket
Tool: data.export
Risk owner: data-protection owner (none granted)

Policy verdict · pii-export-v0.1

✓ Scope · data.export in allowlist
✓ Actor · agent identity verified
! Volume · 12,480 records — bulk PII threshold crossed
! Destination · external s3://vendor-bucket
! Approval path · none — bulk PII export needs a data-protection owner who has not granted it

Verdict · deny

Deterministic. No approver can widen this — there is no approval path for bulk PII export.

Tool-call proxy · in-scope contrast

For contrast, the agent also proposed exporting a single record for verified ticket_3391 — verdict require-approval, approved by data-protection on-call, then executed via the proxy in sandbox. In-scope work still flows; only the bulk export is stopped.

BLOCKED at the proxy · recorded

data.export 12,480 records → s3://vendor-bucket

The bulk export of 12,480 customer records to an external bucket was denied — there is no approval path for bulk PII export without a data-protection owner, and none granted it. The proxy blocked it; the unauthorized export never ran. No data left the boundary.

The block itself is written to the audit chain — a denied action is evidence too.

This scenario is simulated. TR-A002 shows the same proposal → gate → proxy → block → digest pattern, machine-emitted, on the refund workflow.

The agent tried to bulk-export customer records. Origin blocked it — and the block is in the audit chain.

Approval queue

Risk owner · data-protection on-call

Simulated approval state: Approved Hold was not selected Deny was not selected

Single-record export approved at 11:22:40. The bulk export has no approval path to offer.

Side-effect log · sandbox

11:22:18 Single-record proposal · proxy held
11:22:40 Approved · data-protection on-call
11:22:41 1 record exported via proxy · within scope
11:24:03 Bulk PII export · blocked

Sandbox / test side effects only. No customer data leaves the boundary; exports run against sandbox fixtures.

Audit chain

◆ hash-chain · valid

proposal · verdict · approval
proxy execution · block
sealed digest

Append-only, tamper-evident, replayable.

Evidence package

Reviewer summary + JSON — what happened, why it was allowed, who owned the risk.

View evidence JSON · simulated

{
  "workflow": "support_data_export",
  "agent": "support-ops-agent",
  "policy": "pii-export-v0.1",
  "allowed": { "tool": "data.export",
               "action": "export 1 record -> ticket_3391",
               "verdict": "require-approval",
               "approver": "data-protection-on-call",
               "proxy": "executed" },
  "blocked": { "action": "export 12,480 records -> s3://vendor-bucket",
               "verdict": "deny",
               "reason": "no approval path for bulk PII export" },
  "audit_chain": "valid",
  "note": "simulated / sandbox - not a customer run"
}

Private-pilot preview. Simulated / sandbox data — representative samples, not a live deployment. Origin is decision-support and evidence infrastructure — not legal or compliance certification, and it does not guarantee approval. Prototype software, not production SaaS. See the evidence ladder →