Approved customer A-to-Z

After approval, prove one real boundary and share verified evidence.

Public customer access is closed. This reference shows selected private-beta teams how to connect their issued Profile workspace, wrap the first risky action, confirm readback, export proof, and prepare a support bundle.

Join waitlist API docs OpenAPI JSON Verify proof

First run

The approved private-beta sequence.

Receive private access

After waitlist approval, receive the Profile workspace and credentials for the scoped private-beta environment.

Install or wrap one agent

With approved access, install the CLI or SDK adapter in the customer repo and wrap the first action where it actually executes.

Run one safe action

Execute one safe allowed action first so Profile receives live monitored activity before stricter proof lanes are added.

Confirm activity

Open Profile and confirm the same agent shows the action in monitored activity with policy, source, status, and proof context.

Export proof packet

Export the buyer packet and AI-BOM, verify the digest, and create a redacted share only after Profile marks the packet current.

Copy command path

Step	Command
Install and check	`npm install @imladri/cli @imladri/sdk npx imladri doctor --customer --worker-url "$IMLADRI_WORKER_URL" --remediate`
Connect invited workspace	`npx imladri onboard --sandbox --worker-url "$IMLADRI_WORKER_URL" --email "$IMLADRI_PROFILE_EMAIL" --password "$IMLADRI_PROFILE_PASSWORD" --scan-path . --proof-format json --proof-output imladri-proof.json`
Publish policy	`npx imladri policy publish --allow "ticket.summarize,db.sandbox.read" --review "cloud.deploy,db.sandbox.review_write" --block "credential.export"`
Run first proof	`npx imladri proof run --agent-id "$IMLADRI_AGENT_ID" --allowed-action "ticket.summarize" --blocked-action "credential.export"`
Run DB sandbox proof	`npx imladri sandbox --profile --worker-url "$IMLADRI_WORKER_URL" --agent-id "$IMLADRI_AGENT_ID" --sdk-key "$IMLADRI_SDK_KEY"`
Upload scanner	`npx imladri scan --path . --format json --output imladri-boundary.json --fail-on new --upload`
Verify export	`npx imladri proof verify --input imladri-proof.json`

Profile

What every tab should tell the customer.

Profile tab	Customer should see
Home	First-run guide, copy commands, last seen in Profile, proof status, and next action.
Agent	Agent mission, allowed/review/blocked actions, published policy, SDK preparation, and deployment state.
Deployments	Recent monitored activity, allowed calls, blocked calls, latency, source, status, and proof export controls.
Proof	Proof packet explanation, freshness badges, scanner/adopter lanes, MCP authority, exports, and share links.
Providers	Optional provider key verification, capacity selection, protected workload setup, auto-stop controls, and launch readiness.
Training	Optional provider run monitor, callback evidence, proof detail, stop/delete controls, and training proof export.
Sandbox	Optional database branch setup, governed transaction, source-isolation proof, export, and branch cleanup.
Account	Workspace identity, SDK key fingerprints, API route map, support bundle export, password, and logout.

API workspace

Routes that connect terminal/API work back to Profile.

Route	Path	Customer use
Public catalog	`GET /api/customer/api`	Shows route ids, auth requirements, and advertised rate limits.
Readiness	`GET /api/customer/readiness`	Shows account, workspace, API, proof, and next-action checks for the signed-in customer.
Agent profile	`GET /api/customer/profile`	Returns the customer workspace, active agent, API access map, and account state.
Runtime evidence	`GET/POST /api/customer/agents/:agentId/runtime-evidence`	Syncs terminal/API proof back into Profile.
Boundary scan	`POST /api/customer/agents/:agentId/boundary-scan`	Uploads or refreshes the same-agent scanner lane from terminal or CI into the proof packet.
SDK certification	`POST /api/customer/agents/:agentId/sdk-certification`	Uploads or refreshes adapter certification packets for the customer-selected stack.
Proof export	`GET /api/customer/agents/:agentId/proof-export`	Exports JSON, Markdown, or PDF proof from the active Profile packet.
Proof share	`GET/POST /api/customer/agents/:agentId/proof-share`	Lists active links and creates or refreshes the same-agent redacted buyer/auditor proof link.

Proof packet

What must be inside before sharing.

Agent and policyActive agent id, mission, policy version, allowed/review/blocked lists, and unknown-action mode.

Allowed actionOne allowed event with source, request id, timestamp, latency, and decision context.

Blocked actionOne denied or halt-required event blocked before the dangerous function body or committed side effect.

Runtime readbackDeployments and Proof show the same latest monitored activity after terminal/API upload.

Scanner or adopter laneIncluded when the customer uses a CI scanner or framework adapter certification.

MCP, hosted, data, or compute laneIncluded only when that lane is in scope for the customer workflow. Missing credentials remain visible as missing.

IntegrityDigest, chain root, packet hash, signature metadata when configured, and redaction context.

Share safetyBuyer/auditor links are redacted and created only after the current packet verifies.

Optional lanes

Add only what the customer actually uses.

MCP authorityIssue short-lived authority tokens for tool hosts instead of long-lived SDK keys.

Hosted workflowRun credentialed hosted verification only when the customer actually uses that product.

CI scannerRun locally or in CI, then upload findings to the active Profile agent.

Database sandboxCreate a governed branch, run a signed SQL transaction, export proof, and destroy the branch.

Protected computeVerify provider access, launch protected work with auto-stop, monitor callbacks, and clean up resources.

Support bundle

Support step	Detail
Before contacting support	Run doctor, refresh Profile, export the support bundle from Account, and note the active agent id.
What the bundle includes	Account id, workspace id, route map, SDK key fingerprints, recent activity, proof shares, scans, certifications, and proof digest.
What the bundle excludes	Plaintext SDK keys, passwords, provider keys, hosted verification tokens, authority tokens, and private raw payloads.

Final customer acceptance

Area	Done signal
Access	Approved customer can use issued credentials to see the correct private Profile workspace and active agent.
API identity	Account shows workspace id, active agent id, route map, and OpenAPI link.
Policy	The agent policy is published and verified.
Runtime proof	At least one allowed and one blocked-before-body event are visible in Profile.
Proof packet	Export verifies locally or in the browser and includes integrity metadata.
Customer-selected lanes	Scanner, adopter, MCP, hosted, DB, or compute lanes are passed or explicitly out of scope.
Cleanup	Old SDK keys are revoked when rotated, DB branches are destroyed, and provider resources are stopped or deleted when used.