Developers / Scripted scenario
Illustrative scenario — not a measurement
Three hand-written scenarios, side by side: the same action on an ungoverned path, then the same action at an enforcement point. The verdict, the rule that produced it, the conditions that matched, and the record left behind. No timing figure appears on this page — this is the shape of a decision, not a performance result.
SCENARIO
Each tab swaps the whole comparison — payload, verdict, matched rule, evaluation order and the record. Every value below is authored copy.
The call goes straight through. Nothing evaluates it, nothing records why it was fine.
{
"bucket": "external-partner-uploads",
"contains_pii": true,
"bucket_is_external": true,
"records": 5000,
"body_preview": "SSN, Name, Email..."
} The same call, evaluated at the action boundary before it reaches the provider.
{
"bucket": "external-partner-uploads",
"contains_pii": true,
"bucket_is_external": true,
"records": 5000,
"body_preview": "SSN, Name, Email..."
} These three scenarios are scripted. The payloads, the policy names, the matched conditions and the trace lines are written by hand to show the shape of a governed decision — which rule fired, on which condition, what the record afterwards contains. They are not captured from a running system and they are not a benchmark. Deliberately, no millisecond figure appears anywhere on this page: an earlier version of this material carried per-scenario timings that had no method behind them, and they were removed rather than restated. Evaluation latency is reported in exactly one place, the benchmark page, which states the topology and the conditions before the number and leaves every percentile blank until it has actually been measured.
HOW TO READ IT
Blocking an action is easy to demonstrate and hard to operate. The four things beside the verdict are what make it reviewable afterwards.
Every verdict names the rule that produced it. A decision nobody can point at is a decision nobody can appeal, tune or turn off.
Matched policyThe trace lists each condition and whether it held. That is what lets an engineer tell a bad rule apart from a bad request.
Readable traceThe action, the verdict, the rule and the context are recorded together. Reconstructing them from provider logs afterwards is not the same thing.
Audit eventA block that offers redaction or an approval route gets adopted. One that only says no gets routed around.
Recommended next stepTHE WALKTHROUGH
The same lifecycle the homepage draws, recorded against the product: signing in through your own identity provider, discovering unregistered AI, the fleet it finds, writing the policy, a denial at the action boundary, an action held for a human, an agent stopped mid-flight, and the evidence an assessor reads.
Recorded against a live demo tenant, not a mockup or a storyboard. Every verdict on screen is a decision the product actually made while the recording ran — the denial, the approval held for a human, and the kill switch are real calls, not staged screens. The agent fleet and its traffic are a seeded sample, and no latency figure is claimed here — the benchmark page states what is and is not measured.