Skip to main content
Use one controlled browser conversation to show your security team what an agent can access, what it can do, and what records the platform keeps. Allow about 30 minutes for the walkthrough and time for questions.

​
Before you begin

  • Use a workspace and an agent you are allowed to show. You need Editor access or above to edit and test the agent; an Admin or Owner is needed to show connection and member settings. See roles and permissions.
  • Prepare a short, synthetic knowledge-base document and test caller details. Do not use real customer data or display provider keys during the demo.
  • If you will demonstrate a tool or webhook, connect it to a test endpoint you control. Know what that endpoint records and who can read it.
  • Save a draft and confirm that its browser test works before the meeting. The first-agent guide covers this setup.

​
Walk through one agent

If your use case includes incoming phone calls, also show the phone number’s agent assignment and inbound webhook verification. Outbound calling is temporarily disabled; use the browser tester or a controlled inbound call for the live walkthrough.

​
Review the boundaries together

Use the demo result to settle these deployment-specific questions before handling real caller data:
  • Identity and authorization: Which Labs users and API keys have access to this workspace? The application applies workspace roles, and some phone-call controls also require a Labs role. See authentication and roles and permissions.
  • Data exposure: Which model, speech, document-processing, telephony, tool, webhook, and observability services are enabled? What data is sent to each one? Review the actual settings and contracts for the selected providers.
  • Conversation artifacts: Who can view or download recordings, transcripts, run context, and traces? How will your team handle consent, retention, deletion, and access to copies sent to external systems? Treat artifact links as sensitive.
  • External actions: What can each attached tool do with its credential? What should happen if a caller asks the agent to ignore its instructions or to disclose data from a document or tool result? Test the behavior and restrict downstream permissions to the intended task.
  • Release and investigation: Who can edit, test, and publish an agent? Which version handled a call, and what run and trace details are available to investigate it?
Your security requirements, provider agreements, and deployment settings determine the answers to questions such as retention periods and data residency. Verify those separately for your environment.