Where to click, what to expect.

1Your first ten minutes: a workspace and its data policy

1. Console Home → Identity → Workspaces → New workspace (or /admin/workspaces/new).
2. Name it test-<yourname>. Set Data sovereignty policy to Local only (nothing may go to a cloud model) or Local + cloud allowed. Set the Default model tier.
3. Add yourself under Add member. Save changes.
4. Switch to it in the workspace switcher.

What you should see: the switcher pill shows your workspace with a "Local only · cloud blocked" or "Local + cloud" hint; Home shows an empty workspace at a glance.

Try this: with Local only, go to Chat, pick the Cloud Reasoning tier and ask anything. You get a sovereignty refusal, not an answer. Governance → Audit log shows the refusal.

2Knowledge: upload, search, cite

1. Knowledge → Create knowledge set → name it. Open it.
2. Upload documents (drop files: PDF, DOCX, XLSX, TXT, MD, HTML) or Ingest URL → Scrape & Index. Upload a scanned PDF too.
3. Wait for Indexed. Use Search this knowledge set….
4. Go to Chat, ask a question the documents answer.

What you should see: the answer carries citations; clicking one opens the passage. A scanned PDF either indexes (a vision model is configured) or tells you at upload time that text extraction needs a vision model — never a silently empty set. A colleague who is not a member of your workspace cannot see the set or get answers from it.

3Chat: exact computation and charts

1. Chat, any workspace. Type: "What is 2 to the power 64, exactly?"
2. Turn on compute mode (the composer shows Compute mode on — your next message is computed exactly in the sandbox) and send it again.
3. Type "Q1 12, Q2 18, Q3 15, Q4 22 — bar chart of quarterly revenue" and use Visualize data → Bar.
4. On the chart, use Pin to dashboard (needs Build dashboards).

What you should see: step 1 may be an estimate; step 2 is 18446744073709551616, computed in the sandbox, and the run trace (Agent Administration → Runs) shows the executed code. Step 3 renders a chart with hover values and a PNG/SVG export; step 4 asks for a dashboard and the chart lands there as a widget with its own dataset.

4Agents: design, allow tools, certify, run, revoke

1. Agents → Create agent (or Agent Administration → Composer). Name it, pick the Default persona, set Workspace scope to your workspace.
2. Allowed tools: tick Search knowledge, Show a table, chart or KPI, Append to dataset. Tick Run code if your licence includes the sandbox (otherwise the tool says Requires licence).
3. Posture: Sovereign / Mixed / Permissive. Model tier ceiling and Max USD / run. Create agent.
4. To use the code sandbox, the workspace must allow it: Identity → Workspaces → your workspace → Agentic tool access → Run agent-written code (sandboxed) → Save changes.
5. Certify: Agent Administration → Certification → + Certify agent (needs a platform CA; if the page says Generate a platform CA first, do that once). Pick the agent, the scope (the tools you ticked), a classification ceiling and an expiry → Issue passport. The agent card now shows Certified. (An off-platform CA can sign instead: Export cert request in the Agent Designer, then Import agent certification token under Certificates.)
6. Chat with the agent: ask it to compute something exactly, then to show the result as a table.
7. Ask it to do something outside its allowed tools (e.g. write to a dataset you did not allow). Then revoke: Agent Administration → Certificates → the agent's cert → Revoke.

What you should see: the agent's table appears as a card in the chat with a Pin to dashboard button; the out-of-scope request is refused and the run trace shows a denied tool call with the rule; after revocation a new conversation is refused at once and a running one stops within 30 seconds. A Sovereign posture agent refuses code execution in a sovereign workspace regardless of the toggle.

5Automations: a workflow with an approval and a Publish-result step

1. Automations → Design workflow (Designer). Add trigger → pick one (e.g. Webhook or Schedule). Add next step → AI step (prompt, Model tier, Data classification).
2. Add next step → Approval → set Approvers.
3. Add next step → Code (JavaScript in the sandboxed worker) that returns rows, e.g. return { rows: [{date: '2026-09-01', line: 'U1', passengers: 120}] }.
4. Add next step → Publish result → pick or create a dataset, write mode Append, rows {{code.rows}}.
5. Publish. Back in Automations → Active, use Run now. Approve it under Approvals.
6. Automations → History → open the run.

What you should see: each step's input and output; the approval shows who decided and when; the run has a Published rows tab; Dashboards → Datasets shows the new rows. Try the ✨ Help me build button in the Designer: describe an automation in a sentence and Render on canvas.

6Hooks: react to what happens

1. In the Designer, create a second workflow whose trigger is When an event happens, event dataset.rows.published. Add one step (an AI step summarising {{trigger.payload}}). Publish.
2. Automations → Hooks → New hook: title, Event dataset.rows.published, Filter payload.datasetId eq <your dataset id> (use Test filter against the sample payload), Handler = the workflow from step 1. Enable.
3. Run the workflow from chapter 5 again (or import a CSV into the dataset).
4. Open the hook's Deliveries.

What you should see: 1 delivered, a View run link, and the handler's run in History. Disable the handler workflow and trigger again: the hook shows handler paused and deliveries fail honestly, with Retry. In Deliveries → Replay events, pick a window, Preview, then Replay N — the replayed deliveries carry a replayed #n badge and each starts exactly one new run.

7Dashboards: datasets, business models, widgets, cross-filter, forms

Datasets

1. Dashboards → Datasets → New dataset: title, Columns (e.g. date date, line string, passengers integer, occupancy number), Keep rows for (days) = 90. Create dataset.
2. Open it → Import CSV (write mode Upsert by key or Append).

What you should see: the row count, the retention, the quota bar. In the grid: drag a column edge to resize, drag a header to reorder, Search in table (Ctrl/Cmd-F), select a range and Ctrl/Cmd-C to copy into a spreadsheet; numbers right-aligned; the first column stays put on wide tables.

A dashboard

1. Dashboards → New dashboard → Create. You are in the editor.
2. Add widget: Type KPI; Business model (one is created for each dataset); tick a measure; in the property panel pick the Measure; Add. Repeat with Type Chart: tick a measure and a dimension, pick X field / Y field from the pickers, tick Show values on hover. Under Interactions, set Clicking a bar or slice filters other widgets by your dimension. On the KPI, tick Listen to selections from other widgets.
3. Drag widgets by their header; resize from any edge; Pin one so it stays put; drag the New widget chip onto an empty cell to create a widget right there.
4. Add filter (a period filter). Save draft, then Publish.
5. Open the published dashboard (it is now in the left navigation under Dashboards). Click a bar.

What you should see: the other bars dim, a chip line: U1 appears above the dashboard, the KPI re-queries to the filtered value, and the chip's ✕ clears it. Versions lets you roll back; Retire removes the dashboard from the navigation. Try ✨ Help me build with a sentence like "passengers per line for the current month, and a total": the proposal is validated against the model before you see it.

A form

1. Add widget → Type Form (Adaptive Card). Keep the sample card, or add an Input.ChoiceSet, an Input.Number with min/max, and an Action.ShowCard with extra fields. Pick a workflow as the target. Add, Save draft, Publish.
2. On the published dashboard submit the form empty, then correctly.

What you should see: the empty submit is blocked in the browser with the card's own messages, zero requests sent; the correct submit shows the success message and starts the target workflow (Approvals or History shows the run). Share on a dashboard with a form is refused — forms are never public.

Share

1. On a dashboard without a form: Share → Create link (label, hours). Open the link in a private window.

What you should see: the dashboard renders read-only with your organisation's name and the expiry, no login; Revoke in the same dialog kills it. (Needs the resultsPublicShare licence flag and Share a result.)

8Marketplace and templates

1. Marketplace → filter Type Solution → open one → Install → choose a workspace → Confirm install.
2. Automations → Templates → Deploy template.

What you should see: the solution's workflows appear under Automations → Active; a solution that carries a dashboard bundle also creates its dashboard, datasets and hooks in the chosen workspace (Dashboards navigation).

9Extensions: make the platform look and speak like you

Everything below is a signed pack — a zip with a manifest and data files, signed with a key you keep. The platform never runs code from a pack.

Sign your first pack

1. On your laptop with Node 20: node tools/aancer-pack/cli.mjs keygen --out mykey.key (from the release bundle; produces mykey.key and mykey.pub).
2. Write manifest.json (see the customer guide Authoring a pack for the minimal example; the hexad-ci folder in the bundle is a complete theme pack you can copy).
3. node tools/aancer-pack/cli.mjs sign manifest.json content/ -o mypack-1.0.0.ancpack --key mykey.key

Install it

1. Platform Settings → Extensions → Add trust key: key id (must equal publisher.keyId in your manifest), label, the contents of mykey.pub.
2. Import pack → choose the .ancpack → Import. Read the verification summary and any warnings. Configure & activate → bind the parameters (usually a workspace) → Activate.

What you should see: a pack imported before the trust key was added is refused with PACK_SIGNER_UNKNOWN; after, "Bundle verified", the items listed with their state, and after activation everything the pack declares appears: theme applied, navigation entries, Home cards, dashboards, hooks (managed by pack). Retire pack removes it all and restores the stock product; a newer version of the same pack id imports as an upgrade and you can roll back.

What a pack can carry

Your look and feel without a pack

Platform Settings → Branding: Platform name, Login page tagline, Primary color, Secondary color, Logo URL, Favicon URL, Login background color, Default theme. Live preview shows the login page. This is the six-field, no-signing route; a theme pack does everything this does plus fonts, per-block tokens and per-workspace variants.

10Embedded apps: your own application inside the hub

1. In your pack, add an app item: url (https, {{workspace}} allowed), origin, capabilities (e.g. read:me, read:dataset:<id>, write:dataset:<id>, navigate, notify), egress.hosts. Import and activate as in chapter 9.
2. Platform Settings → Extensions → open the pack → Manage app: read the origin and capabilities, tick the acknowledgement, Approve; Approve each egress host.
3. Your application must answer with Content-Security-Policy: frame-ancestors <your platform origin> and must not send X-Frame-Options: DENY.
4. Dashboards → your app appears under its group with the Embedded app glyph. Open it.

What you should see: before approval, an honest Needs approval card; if your app does not allow framing, the app has not allowed this platform to embed it with Retry; when it does, your app loads and receives a short-lived token over the bridge (never in the URL). Log out in another tab: the frame shows session revoked within 15 s. Rotate secret shows the new introspection secret once. Every bridge call is audited under app.capability.*.

11Governance: prove it happened

1. Governance → Audit log: filter by action (agent.tool.call, hook.delivered, extension.pack.activated, sovereignty.*).
2. Governance → Records of processing → export; Compliance → the regulatory reports.
3. Console Home → Monitoring: runs, cost, security events.

What you should see: every consequential action from the chapters above, with who, when, workspace and outcome; denied actions as denials; row-level data never in the log. The audit chain verify endpoint (/api/admin/compliance/audit-chain/verify) reports ok: true.

12Things that should refuse — test them on purpose

Every refusal above is a feature. Report a refusal that didn't happen, or one that happened without an audit row.