Permission and access maps
What may the agent, workflow, field, account, or tool call reach?
Artifact examples
- access matrix
- workflow boundary map
- permission lease
- capability shelf
- secret courier policy
- text-field action map
AI workflow artifacts
Find the AI workflow artifact your next decision needs
When an AI workflow touches customers, records, code, money, public facts, or another agent, the next step should not be a vague policy discussion. Choose the matrix, packet, receipt, ledger, contract, source map, or rollout plan that makes the decision visible.
Chooser shelf
Pick the artifact family before picking the tool
Start with the operational question the meeting is really asking. Each shelf points to concrete worksheets, posts, and a contact path that keeps the request artifact-specific.
Review and approval packets
What does a human need before approving the action?
Artifact examples
- approval queue
- handoff note
- threshold lane
- review packet
- rehearsal card
- storefront approval path
Receipts, ledgers, and source-of-truth records
Can the team reconstruct what the workflow saw, decided, changed, and still needs?
Artifact examples
- agent receipt
- state ledger
- model facts register
- analytics source register
- failure population ledger
- dispatch ledger
Build, release, and sandbox controls
What keeps agent-built work reviewable before it merges, runs, or migrates production systems?
Artifact examples
- sandbox contract
- PR harness
- merge receipt
- migration bench
- fleet contract
- dependency no-fly list
Security and data-boundary drills
Which source, field, credential, query, package, or handoff could become the incident?
Artifact examples
- security review packet
- prompt-bearing field map
- query-spill ledger
- skill quarantine bench
- agent BOM
- vulnerability desk
Operational rollout and resilience plans
What keeps the pilot from expanding before the team has evidence, rollback, and ownership?
Artifact examples
- shadow week
- rollback plan
- pause note
- workflow compiler brief
- portability packet
- model access freeze plan
Public web and AI-search artifacts
What public facts, sources, crawler rules, documents, or customer promises will assistants read and repeat?
Artifact examples
- AI-search source map
- machine visitor terms
- AI-readable website brief
- customer promise inventory
- document handoff
- storefront approval path
Quick chooser by symptom
If the team arrives with a problem, route it to a work product
| If the team says... | Point them to... | Why |
|---|---|---|
| “We do not know what the agent can touch.” | Permission and access maps | The first artifact should name reach before behavior expands. |
| “The reviewer is guessing.” | Review and approval packets | The work needs source evidence, proposed action, risk flags, owner, and rollback hint before approval. |
| “Nobody can tell what happened last time.” | Receipts, ledgers, and source-of-truth records | The system needs a reconstructable record, not a longer transcript. |
| “The agent can write code or run scripts.” | Build, release, and sandbox controls | Execution needs a sandbox contract, receipt, tests, and rollback before merge or run permission expands. |
| “This could expose data or credentials.” | Security and data-boundary drills | The risk sits in sources, fields, queries, credentials, packages, and handoffs. |
| “The pilot worked once; can we expand it?” | Operational rollout and resilience plans | Expansion needs shadow evidence, pause rules, rollback, and ownership. |
| “Assistants may read or repeat the wrong public fact.” | Public web and AI-search artifacts | The source trail needs a stable owned path and machine-readable terms. |
Recent posts by artifact family
Use the library as the supporting link for artifact-led posts
This first map covers more than twenty recent posts. It shows where a future CTA or related link can point without sending every reader to the same broad page.
Permission and access maps
- Google ADK boundary map
Future supporting target: Compare boundary artifacts.
- Agent access matrix for A2A gateways
Future supporting target: Copy the access matrix.
- Keyboard agent text-field action map
Future supporting target: Map the text-field action boundary.
- Peerd browser permission lease
Future supporting target: Compare permission leases.
- Cloak secret courier policy
Future supporting target: Map the broader access boundary.
Review and approval packets
- Handoff note for AI workflow approval
Future supporting target: Choose the approval-packet fields.
- False positives and false negatives in approval queues
Future supporting target: Route the review queue.
- Threshold tuning for AI approval workflows
Future supporting target: Tune the threshold lane.
- Google Gemini Business Profile storefront
Future supporting target: Map the storefront approval path.
- AI agent spend circuit breaker
Future supporting target: Set the spend circuit breaker.
Receipts, ledgers, and source-of-truth records
- Bedrock model profiler model facts register
Future supporting target: Copy the model facts register.
- Analytics agent source-of-truth register
Future supporting target: Copy the metric source register.
- OpenAI core dump failure population ledger
Future supporting target: Map a failure population ledger.
- eMem signed field fact receipt
Future supporting target: Keep the field fact receipt.
- OpenAgentIO dispatch ledger
Future supporting target: Add the dispatch ledger.
- Apache Burr state-machine review
Future supporting target: Review the agent state map.
Build, release, and sandbox controls
- Agent-written code needs a sandbox contract
Future supporting target: Draft the sandbox contract.
- AI pull request harness engineering
Future supporting target: Use the PR harness.
- Agent Java migration acceptance bench
Future supporting target: Pair with the migration bench.
- AI agent fleet migration contract
Future supporting target: Use the fleet contract.
- Coding agents need dependency no-fly lists
Future supporting target: Write the no-fly list.
Security and data-boundary drills
- Shared vulnerability desk
Future supporting target: Build the vulnerability desk.
- Research agent query-spill ledger
Future supporting target: Track query spill.
- SkillsGuard skill quarantine bench
Future supporting target: Bench risky skills.
- Two-cent transfer assistant security test
Future supporting target: Map prompt-bearing fields.
- Agent BOM composition analysis
Future supporting target: Build the agent BOM.
Operational rollout and resilience plans
- Run a shadow week before AI automation
Future supporting target: Plan the shadow week.
- Rollback path belongs in the workflow spec
Future supporting target: Write the rollback plan.
- When to pause an AI pilot after the first miss
Future supporting target: Use the pause note.
- Dapr agents portability packet
Future supporting target: Build the portability packet.
Public web and AI-search artifacts
- AI-search poison-pill source map
Future supporting target: Map the AI-search source trail.
- Machine visitor terms for AI crawlers
Future supporting target: Set machine visitor terms.
- AI-readable website workflow
Future supporting target: Draft the AI-readable briefing page.
- Inventory customer promises before AI replies
Future supporting target: Inventory customer promises.
- Generated PDFs need document handoff
Future supporting target: Hand off generated documents.
How this fits the controls guide
The artifacts library is a chooser; the controls guide is the full sequence
Use this page when the reader remembers the artifact noun but not the path. Use the controls guide when the team is ready to walk one workflow through boundary, data, policy, shadow week, queue, receipts, tests, observability, and rollback.
Bring one workflow artifact into the next decision
If the team can name the workflow but not the work product, bring the question. BaristaLabs can help choose the access map, review packet, receipt, ledger, contract, source map, or rollback plan that should come first.
Choose the first artifact together