Follow an ordinary request from a simple pastebin through sharing, expiry, review, and publishing. At each stage, the agent implements the product change and extends authorization behind the scenes.
Before: nothing to inherit.
The evaluator creates the app directory and captures its filesystem before the agent starts. No scaffold, hidden policy, or pre-existing Go code is present.
$ find . -type f $
files in the signed initial snapshot.
The proxy recorded real decisions.
Generated tests sent HTTP requests through Toolkit.Proxy and the embedded Cerbos PDP. These are bounded samples from the resulting append-only JSONL—not reconstructed UI behavior.
Authorization headers are redacted by the recorder. The complete captured JSONL is linked with the replay evidence below.
Replay the complete structured session in place.
Every recorded event remains available in its original order and at its original timestamp. Play the chronology or seek directly without turning the page into a long stack of cards.
How authorization is configured
REQUEST → DECISIONAfter: policy is executable.
The finished tree is the evaluator's hashed final snapshot. Explore the exact Cerbos YAML, schemas, trusted mapping boundary, loopback runtime startup, and module pins produced in the session.