Pick a scenario below: one click runs the entire pipeline end to end — guardrail scan, gateway, extraction, § 14 UStG audit, then either a booking or a drafted correction letter held at the approval gate. Every call it makes lands in the gate ledger below.
Who is on duty, and who Model Armor has pulled off duty. This is the Control pillar: a preview of the Fleet tab, where every agent carries its scopes and its history. Showing 4 of 15.
The UAS pillar - the Universal Autonomous System - runs tasks unattended and stops at an ask gate whenever the decision is yours. A preview of the Approvals tab, where you act on the full queue.
When an agent hits an ask gate, the request appears here before anything leaves the building.
Handled by OmniLedger, the accounting domain: it extracts an invoice, audits it against § 14 UStG, then books it or opens a dispute. The Domains tab shows which policies, agents and skills it is bound to.
The facts, lessons and policies agents retrieve from before they act. This is the Memory pillar: a preview of the Memory tab, which lists every entry.
Generated result documents are stored durably and are private by default. Only the creator can change sharing. A named share grants one workspace access, Department grants the creator's department access, and Organisation grants every workspace on this deployment access.
Your share ID is workspace:3b4e0df037790da283f14858cd2099c418c1486fefb523331b65cd90af9ea5cb. It is a one-way, non-authenticating handle for this browser workspace, not the secret workspace cookie or a verified human account. Clearing the cookie loses that identity. Production sharing therefore remains gated on IAM/IAP.
Export a chat or render a correction letter. The generated file is stored privately before download.
Talk to one governed agent - explore, draft, ask. For work that should repeat or run unattended, save it as a task and run it in Fleet.
Pick the skills and prompt version that should govern the answer, then send a message. Switch to race mode to put several models on the same prompt. To bring a web page into the conversation, fetch it in the Web reader below and insert it - the agent has no route to the network of its own.
Research does not come from the model. You fetch a public page here through agent:web-reader, the only identity scoped for it and SSRF-guarded on every redirect, then insert the text into your message.
Each domain binds its own policies, agents and skills. An agent never reaches across a domain boundary.
Autonomous invoice processing, § 14 UStG compliance audit, GoBD ledger and vendor dispute loop.
Serverless orchestration on Google Cloud Run, in-process event bus with a Pub/Sub-compatible adapter for Cloud Run deployment, and OpenTelemetry tracing.
Automated checks for GDPR PII masking, liability disclaimers and audit-proof retention.
Automated clarification workflows, vendor master data synchronisation and SLA monitoring.
The counterparties your fleet writes to and its internal contacts are distinguished explicitly. Personal records stay in this browser workspace; organisation records are shared with the fleet. Each carries a GDPR retention level - S1 six months, S2 twelve months, S3 thirty-six months for tax-relevant correspondence under § 147 AO, S4 until revoked. An opt-out leaves a tombstone that blocks future contact.
| Name | Postal address | Relationship | Scope | Category | Level | Consent | Retention reason | Action | |
|---|---|---|---|---|---|---|---|---|---|
| Acme Consulting Services Acme Consulting GmbH |
finance@acme-consulting.de |
- | external | organization | vendor | S3 | confirmed | Consulting contract | read-only |
| Accounts Payable, CloudScale GmbH CloudScale Solutions GmbH |
billing@cloudscale.de |
- | external | organization | vendor | S3 | confirmed | Business contact: invoicing correspondence under § 14 UStG | read-only |
| CyberSec Defense Corp AP CyberSec Defense Corp |
ap@cybersec-defense.com |
- | external | organization | vendor | S3 | confirmed | Security services provider | read-only |
| Accounting, Office Supplies Ltd Office Supplies Ltd |
invoices@officesupplies.eu |
- | external | organization | vendor | S3 | confirmed | Vendor contract & document exchange | read-only |
Run and manage the work itself - one-off runs, reusable tasks, and the agents that carry them out.
Runs once, right now, and leaves only its run record - nothing to name, bind or maintain afterwards. For something you will run again, save a reusable task below. A task that has not started can be cancelled; once it has settled, its record can be removed. A run in flight has neither - it is over in seconds, so there would be nothing to stop.
Queued tasks are recorded here with the agent that owns them and the evidence they produced.
Saved templates you run repeatedly - a prompt plus skills, kept under a name. The wizard walks it in order: name, prompt, skills, agent, then when it runs. Attach a routine () or a schedule () to make it recurring or dated - remove both to make it deletable again.
Create one, enqueue it once to see it run, then attach a routine or a schedule to make it fire on its own.
Every agent carries an explicit tool scope. A call outside that scope quarantines the agent instead of running.
These actions have external effect. The gateway parked each of them here rather than carrying it out.
Two things share this queue. Approvals are concrete actions an agent reached and the gateway stopped, waiting for your go-ahead. Tickets are points raised by the system or by you that need a human decision or a repair. Neither is how you give an agent work - for that, queue a one-off task or run a template in Fleet.
Run the missing VAT ID scenario to see an outbound letter stop at this gate.
The fleet's own curated memory: what agents retrieve from and inject into their prompts before they act. Structured like the operator's USMC pattern - facts, lessons, working state, sessions - as its own instance, living in this app only: nothing here is read from or written to anything outside it.
Original SentinelFleet records still load without rewriting. Their old label is kept in
metadata; new entries use the four current USMC-style names. working is new
and receives unresolved or in-flight state.
| Original name | Current name | Meaning now |
|---|---|---|
fact | facts | Stable facts and rules |
policy | facts | Rules agents treat as given |
entity | facts | Stable counterparty or entity details |
lesson | lessons | What should not go wrong again |
session_checkpoint | sessions | What a run or conversation left behind |
session | sessions | Earlier shorthand for a retained session |
| Category | Key | Content | Scope | Owner | Action |
|---|---|---|---|---|---|
| facts | org:tax_id |
Our company VAT ID is DE314159265 (Acme Corp GmbH). | organization |
system
shipped with the demo
|
read-only |
| facts | org:vat_policy |
Invoices without a valid issuer VAT ID must not be released under § 14 UStG. | organization |
system
shipped with the demo
|
read-only |
| facts | vendor:acme_supplier |
Acme Supplier GmbH | IBAN: DE89370400440532013000 | Standard payment term: 14 days | organization |
system
shipped with the demo
|
read-only |
| lessons | vendor:cloud_solutions |
Cloud Solutions Inc. frequently omits the delivery date. Always verify it. | organization |
system
shipped with the demo
|
read-only |
Both are versioned. Copy any version to reuse it elsewhere, or load it into the chat console. New demo components are created locked; version, permission and deletion administration requires an authenticated administrator and is disabled in this build.
Read-only. Every governed tool call, in order, with its verdict - the short box on the Overview tab shows the last three of these. Persisted with the application data and additionally exported to Cloud Trace when ENABLE_CLOUD_TRACE is set.
| Span | Operation | Agent | Status | Duration | Note |
|---|
Who may call what, which policies are enforced, what the gate decided, which identities are locked out, what plans stand and what a human signed off — read live from the registers that already hold it. The board stores nothing of its own.
member:demo; organization-wide requests are
forwarded, and security-root edits remain locked.
The database is not exposed directly. Every browser read or mutation passes through an API decision. In this public demo “Organisation” means every visitor to this deployment; every visitor is also the same Finance demo member, so “Department” has the same public reach here. Real user and department boundaries require the signed-IAP deployment mode.
| Data | Stored in | Read | Change |
|---|---|---|---|
| Chat histories | firestore | Creator, named shares, department, or organisation | Messages and sharing: creator only |
| Result documents | firestore metadata + private Google Cloud Storage bucket | Creator, named shares, department, or organisation | Sharing: creator only; private by default |
| Personal contacts and memory | firestore | Owning workspace only | Owner only |
| Department contacts and memory | firestore | Registered users in the same department | Same-department capability |
| Organisation contacts and memory | firestore | All organisation workspaces | Named organisation capability |
| Uploaded source bytes | Not retained | Request-scoped processing only | Re-upload to process again |
| Extracted document records | firestore | Organisation control-plane view | Workflow and approval routes only |
| Prompts, skills, tasks, tickets and templates | firestore | Organisation control-plane view | Capability-gated; security-root administration locked |
| User and role profiles | firestore | Demo registry is visible for audit | User administration locked without authentication |
Profiles supply baseline capabilities; reasoned per-user deviations take precedence. These are authorization identities, not login sessions. A “declared” chip documents the planned role model but does not claim an HTTP enforcement point.
| User | Profile | Granted capabilities |
|---|---|---|
| Demo member member:demo |
member |
policy.create
policy.edit.own
policy.bind.user
template.create
template.manage
chat.use
document.process
prompt.create
skill.create
task.manage
ticket.create
web.read
contact.create.personal
contact.manage.department
memory.create.personal
memory.manage.department
|
| Profile | Description | Declared grants |
|---|---|---|
| Member member |
Creates policies and binds them to their own work; broader scope is forwarded. | chat.usecontact.create.personalcontact.manage.departmentdocument.processmemory.create.personalmemory.manage.departmentpolicy.bind.userpolicy.createpolicy.edit.ownprompt.createskill.createtask.managetemplate.createtemplate.manageticket.createweb.read |
Supported target cells come from the same explain_binding function the API enforces.
Allow runs now, forward creates an approval ticket, deny refuses. Process is an optional
extension point for organizations that need a durable layer across templates and runs.
No Process Registry is installed in this MVP; Task Templates with steps continue to run without it.
| Target | user | other_user | department | organization |
|---|---|---|---|---|
| agent | BindingAction.ALLOW | BindingAction.FORWARD | BindingAction.FORWARD | BindingAction.FORWARD |
| process | extension point | extension point | extension point | extension point |
| template | BindingAction.ALLOW | BindingAction.FORWARD | BindingAction.FORWARD | BindingAction.FORWARD |
| skill | BindingAction.ALLOW | BindingAction.FORWARD | BindingAction.FORWARD | BindingAction.FORWARD |
| domain | BindingAction.FORWARD | BindingAction.FORWARD | BindingAction.FORWARD | BindingAction.FORWARD |
Permission rules and PolicyEngine checks are projected from their real sources on every read. Only the user slot is writable, and its entries remain advisory until a real executor enforces them.
| Policy | Type | Honesty | Source | Bind |
|---|---|---|---|---|
| Tool permission: assign_task permission:assign_task · Assigns work inside the fleet |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::assign_task declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: audit_task_health permission:audit_task_health · Read-only task health inspection |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::audit_task_health declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: audit_telemetry permission:audit_telemetry · Read-only telemetry inspection |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::audit_telemetry declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: bash_rm_rf permission:bash_rm_rf · Destructive file removal forbidden |
PolicyType.RULE |
Enforcement.MANDATORY
gateway.permissions
|
permission-registry core/permissions.py::bash_rm_rf declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: chat_completion permission:chat_completion · Model calls are read-only and carry no external effect |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::chat_completion declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: create_reconciliation_draft permission:create_reconciliation_draft · Gateway verdict is allow. |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::create_reconciliation_draft declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: create_task permission:create_task · Creates an internal queued task record |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::create_task declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: dispatch_swarm permission:dispatch_swarm · Dispatches scoped internal agents |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::dispatch_swarm declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: draft_vendor_dispute_email permission:draft_vendor_dispute_email · Gateway verdict is allow. |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::draft_vendor_dispute_email declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: execute_bank_transfer permission:execute_bank_transfer · Financial disbursements require human signoff |
PolicyType.RULE |
Enforcement.MANDATORY
gateway.permissions
|
permission-registry core/permissions.py::execute_bank_transfer declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: execute_calculation permission:execute_calculation · Runs a bounded internal calculation |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::execute_calculation declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: execute_template permission:execute_template · A template run is a model call; per-template approval is gated separately on the template itself |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::execute_template declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: export_raw_secrets permission:export_raw_secrets · Secret exfiltration forbidden |
PolicyType.RULE |
Enforcement.MANDATORY
gateway.permissions
|
permission-registry core/permissions.py::export_raw_secrets declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: extract_invoice_multimodal permission:extract_invoice_multimodal · Gateway verdict is allow. |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::extract_invoice_multimodal declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: flag_compliance_error permission:flag_compliance_error · Records an internal compliance finding |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::flag_compliance_error declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: publish_public_record permission:publish_public_record · Public state changes require human verification |
PolicyType.RULE |
Enforcement.MANDATORY
gateway.permissions
|
permission-registry core/permissions.py::publish_public_record declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: query_memory_bank permission:query_memory_bank · Gateway verdict is allow. |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::query_memory_bank declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: read_web_page permission:read_web_page · An unauthenticated GET changes nothing at the target; the control on it is the SSRF guard, not an approval |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::read_web_page declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: render_dispute_letter permission:render_dispute_letter · Rendering the correction letter has no external effect; sending it is what hits the ASK gate |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::render_dispute_letter declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: send_external_email permission:send_external_email · External email dispatch requires human review |
PolicyType.RULE |
Enforcement.MANDATORY
gateway.permissions
|
permission-registry core/permissions.py::send_external_email declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: solve_task permission:solve_task · Runs a scoped internal task |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::solve_task declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: store_memory_bank permission:store_memory_bank · Gateway verdict is allow. |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::store_memory_bank declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: update_task_state permission:update_task_state · Updates an internal task lifecycle |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::update_task_state declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: validate_tax_compliance permission:validate_tax_compliance · Gateway verdict is allow. |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::validate_tax_compliance declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: verify_receipts permission:verify_receipts · Read-only audit verification |
PolicyType.RULE |
Enforcement.ENFORCING
gateway.permissions
|
permission-registry core/permissions.py::verify_receipts declared visibility: organization · metadata only, not access control |
projected · read-only |
| Tool permission: write_credentials permission:write_credentials · Direct credential writing forbidden |
PolicyType.RULE |
Enforcement.MANDATORY
gateway.permissions
|
permission-registry core/permissions.py::write_credentials declared visibility: organization · metadata only, not access control |
projected · read-only |
| Arithmetic integrity engine:arithmetic-integrity · net + tax must match gross within ±0.02 EUR. |
PolicyType.RULE |
Enforcement.MANDATORY
policy_engine
|
policy-engine core/policies.py::PolicyEngine.evaluate_tax_compliance declared visibility: organization · metadata only, not access control |
projected · read-only |
| § 14 UStG mandatory fields engine:ustg-required-fields · 8 required fields must be present. |
PolicyType.RULE |
Enforcement.MANDATORY
policy_engine
|
policy-engine core/policies.py::PolicyEngine.evaluate_tax_compliance declared visibility: organization · metadata only, not access control |
projected · read-only |
| Bounded template chain engine:step-budget · A task template contains at most 8 steps. |
PolicyType.RULE |
Enforcement.MANDATORY
task_template_validator
|
schema-validator uas/task_templates.py::TaskTemplate._steps_form_a_valid_chain declared visibility: organization · metadata only, not access control |
projected · read-only |
| Binding | Target | Scope | State | Decision evidence | Action |
|---|---|---|---|---|---|
| No policy bindings yet. | |||||
Two controls meet in every cell and fail differently. Least privilege decides whether an identity carries the tool at all — calling outside it quarantines the agent. The permission registry decides what happens when a scoped call arrives: run it, hold it for a person, or refuse it outright.
| Tool | Verdict | Held by | Fleet Conductor | TaskWriter | TaskMaintainer | TaskSolver | SystemAuditor | Vision Extractor | Tax Compliance Sentinel | Ledger Reconciler | Dispute Communicator | Web Reader | Chat Operator | 4 race lanes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
assign_task
Assigns work inside the fleet
|
allow
explicit rule
|
1 | ● | · | · | · | · | · | · | · | · | · | · | · |
|
audit_task_health
Read-only task health inspection
|
allow
explicit rule
|
1 | · | · | ● | · | · | · | · | · | · | · | · | · |
|
audit_telemetry
Read-only telemetry inspection
|
allow
explicit rule
|
1 | · | · | · | · | ● | · | · | · | · | · | · | · |
|
bash_rm_rf
Destructive file removal forbidden
|
deny
explicit rule
|
none | · | · | · | · | · | · | · | · | · | · | · | · |
|
chat_completion
Model calls are read-only and carry no external effect
|
allow
explicit rule
|
2 | · | · | · | · | · | · | · | · | · | · | ● | ● |
| create_reconciliation_draft |
allow
explicit rule
|
1 | · | · | · | · | · | · | · | ● | · | · | · | · |
|
create_task
Creates an internal queued task record
|
allow
explicit rule
|
2 | ● | ● | · | · | · | · | · | · | · | · | · | · |
|
dispatch_swarm
Dispatches scoped internal agents
|
allow
explicit rule
|
1 | ● | · | · | · | · | · | · | · | · | · | · | · |
| draft_vendor_dispute_email |
allow
explicit rule
|
1 | · | · | · | · | · | · | · | · | ● | · | · | · |
|
execute_bank_transfer
Financial disbursements require human signoff
|
ask
explicit rule
|
1 | · | · | · | · | · | · | · | ● | · | · | · | · |
|
execute_calculation
Runs a bounded internal calculation
|
allow
explicit rule
|
1 | · | · | · | ● | · | · | · | · | · | · | · | · |
|
execute_template
A template run is a model call; per-template approval is gated separately on the template itself
|
allow
explicit rule
|
1 | · | · | · | ● | · | · | · | · | · | · | · | · |
|
export_raw_secrets
Secret exfiltration forbidden
|
deny
explicit rule
|
none | · | · | · | · | · | · | · | · | · | · | · | · |
| extract_invoice_multimodal |
allow
explicit rule
|
1 | · | · | · | · | · | ● | · | · | · | · | · | · |
|
flag_compliance_error
Records an internal compliance finding
|
allow
explicit rule
|
1 | · | · | · | · | · | · | ● | · | · | · | · | · |
|
publish_public_record
Public state changes require human verification
|
ask
explicit rule
|
none | · | · | · | · | · | · | · | · | · | · | · | · |
| query_memory_bank |
allow
explicit rule
|
9 | ● | ● | ● | ● | ● | ● | ● | · | ● | · | ● | · |
|
read_web_page
An unauthenticated GET changes nothing at the target; the control on it is the SSRF guard, not an approval
|
allow
explicit rule
|
1 | · | · | · | · | · | · | · | · | · | ● | · | · |
|
render_dispute_letter
Rendering the correction letter has no external effect; sending it is what hits the ASK gate
|
allow
explicit rule
|
1 | · | · | · | · | · | · | · | · | ● | · | · | · |
|
send_external_email
External email dispatch requires human review
|
ask
explicit rule
|
1 | · | · | · | · | · | · | · | · | ● | · | · | · |
|
solve_task
Runs a scoped internal task
|
allow
explicit rule
|
1 | · | · | · | ● | · | · | · | · | · | · | · | · |
| store_memory_bank |
allow
explicit rule
|
1 | · | · | · | · | · | · | · | ● | · | · | · | · |
|
update_task_state
Updates an internal task lifecycle
|
allow
explicit rule
|
1 | · | · | ● | · | · | · | · | · | · | · | · | · |
| validate_tax_compliance |
allow
explicit rule
|
1 | · | · | · | · | · | · | ● | · | · | · | · | · |
|
verify_receipts
Read-only audit verification
|
allow
explicit rule
|
1 | · | · | · | · | ● | · | · | · | · | · | · | · |
|
write_credentials
Direct credential writing forbidden
|
deny
explicit rule
|
none | · | · | · | · | · | · | · | · | · | · | · | · |
8 fields must be present on every invoice.
net + tax must equal the stated gross within ±0.02 EUR. The tolerance absorbs per-line rounding, not a wrong total.
A task template may contain at most 8 steps; larger chains are rejected before storage and revalidated before enqueue.
Run a scenario or a task and every tool call lands here with its verdict.
A verdict says what the gate decided; these say what it looked at — the privacy screen on an outbound document, the armor scan on tool arguments, the inspection of a fetched page.
Process a document or read a page, and the check that ran is recorded here.
No agent is quarantined or waiting on an approval right now.
Every task template with its steps, the identities each step runs as, and what makes it recur. Unfiltered: the Fleet tab honours what one viewer hid from their own list, this count is the fleet's standing work.
What a person actually decided. An ASK verdict at the gate parks the agent and opens one of these; nothing external happens until someone signs it off. The queue itself, with the buttons that decide, lives in the Approvals tab.
Token spend as the provider reported it, attributed to the gate-ledger row the call ran under. Only live calls through the gateway are metered. Counted since this instance started: a redeploy or a scale-to-zero restart resets it, so empty is normal right after a deploy.
No live model call has run in this window yet.
Runs once and leaves only its run record. Nothing is saved to run again - for that, make a reusable task with the wizard.
The same create call the wizard makes, on one screen. Use the wizard if you would rather be asked one thing at a time.
Guided: name, prompt, skills, agent, then when it runs. Same create endpoints as the quick form, walked one decision at a time so nothing is left implicit.
Changed from the picked version - this saves a new version via the prompt registry before the task is created.
Skill forking requires authenticated administration. The public demo can attach an existing locked skill version.
execute_template in scope can be assigned here.
Runs this task once per supported model at every trigger.
One URL per line, at most five. Each page is fetched through the gateway as agent:web-reader - SSRF-guarded, one gate-ledger row and one Model Armor verdict per page. A page Model Armor flags is left out of the answer and named as excluded; if no page can be read, the run fails rather than answering from nothing. The agent never picks a URL: you do, here.
Leave both unticked and the task runs only when you start it. Tick one to make it recurring (a routine), or to have it run once at a date (a schedule).
A single step is an ordinary task. Add more to run them as a chain, in order - each step sees the previous step's output as extra context. "Race" runs a step across every supported model at once and forwards all of their labelled answers to the next step.
Read-only status log of this run - not a chat transcript, and no input goes back to the server. Phase 1 executes a run synchronously inside the request that queued it, so most runs are already finished by the time this opens: the buffer below is then a full replay, not a live stream.
A manual entry in the approval queue: something that needs a human decision, filed by you instead of raised by an agent. To give an agent work instead, queue a one-off task or run a template in Fleet.
Agents read this before they act, so a correction here changes what they do next. It does not rewrite the gate ledger: a span records which tool an agent called, never the text it retrieved, so what already happened stays as it was recorded.
This entry shipped with the demo. Once you change it, the startup seeding stops restoring it - your version stands.
A reusable prompt, versioned from the first save. Tasks and chats pin a version, so a later edit never changes what an earlier run was given.