Start with the read
Open the interactive demo. It runs in your browser with mock records, without an account or credentials. The simulated caller is a support agent. In Customer support, leave Maya Chen and Read customer selected, then choose Evaluate request. The workspace shows the matched rule and simulated execution outcome.
Look for the distinction between the decision and the audit trace. The decision explains why the request was allowed. The trace shows that the simulated tool executed.
Compare a denied action
Under Proposed action, choose Delete customer and evaluate again. The scope covers reading, so the default deny rule blocks deletion. Switch to Sam Rivera and Read customer to see a different rule block a cross-tenant lookup.
This example isolates the action check. In a real integration, also check the tenant, ownership and the resource ID on a read. Read access for one customer does not extend to another.
Simulate an approval
Choose Refund review, enter $49 and evaluate. The tool is held for review. Approve or reject the exact request, then check the audit events for the reviewer’s decision and execution outcome. Repeat with $15 for an automatic allow or $110 for a denial.
Reset scenario restores the example and clears its audit events. The demo runs locally with editable mock requests and makes no calls to a payment or CRM service. Use the policy and approval guides to translate the examples into requirements for an implementation you control.