Skip to main content

Quickstart

From a new hosted workspace to an agent connected and its first request answered. What a workspace can decide depends on what is connected to it, and step 5 says plainly where a new one stands today.

1. Get a workspace​

Request access at app.execbound.ai/signup. Requests are reviewed; once yours is approved, you get a link to confirm your email, name your workspace and choose a password. Where the page offers Google, GitHub or Microsoft, you may continue with one of those instead: it proves your address the same way the emailed link does, and skips straight to naming your workspace with no password to choose; you can add one later from Account security. Then sign in at app.execbound.ai/login.

If you forget your password later, choose Forgot your password? on the sign-in page. We email the address you sign in with a link that works for 30 minutes, once; if your account uses two-step verification, choosing the new password also needs a code from your authenticator app or one of your recovery codes. A reset signs you out everywhere and revokes your personal access tokens.

A hosted Community workspace is persistent and can hold three agents. Community and hosting says what else it includes, and Use the console tours the pages.

2. See a decision without connecting anything​

Open Getting started and Try an example. Choose a target and run the safe example: it evaluates a fixed synthetic policy against made-up facts and explains why the answer is allow, deny or approval. Nothing is executed, and your workspace's own policy is neither read nor changed.

3. Add an agent and issue its API key​

  1. Open Agent connections and Add agent. Choose the host the agent runs in, and name the agent after the tool that will use it.
  2. On the agent's page, in its Connection section, under Connect this agent, choose a lifetime (30 or 90 days for a Tines story) and Issue API key.
  3. Save the key in the host's secret configuration. It is shown once and never again.

4. Check the key​

export EXECBOUND_CREDENTIAL='<API key>'
curl -s https://app.execbound.ai/v1/me -H "Authorization: Bearer $EXECBOUND_CREDENTIAL"

The answer names the agent, with "kind": "AGENT". This call proposes nothing and records nothing.

5. Connect the host and send a request​

Connect an agent host has the configuration for Claude Code, Cursor, the OpenAI Agents SDK, any other MCP client and plain HTTP, and says what to do with each answer.

What a new workspace answers. A new workspace starts empty: no provider account is connected, no action is mapped to one, and no policy is active. Until they are, ExecBound has nothing it may act on, so every proposed action is answered 503 with the code EXECUTION_UNAVAILABLE. That is the answer for any action or target ExecBound does not know, and it is deliberate: nothing is executed on your behalf until an administrator has connected the account and a policy allows the action.

Connecting provider accounts and mapping actions to them is not self-service in the console yet. To connect a provider, or to get a sample workspace with synthetic hosts, identities, incidents and a policy already active, contact us.

6. Try it in a sample workspace​

A sample workspace has synthetic endpoints named workstation-01 to workstation-25 and domain-controller, each with one open critical incident, and a security-response policy already active. Connect this agent shows the incident id to use for workstation-01.

curl -s https://app.execbound.ai/v1/execute \
  -H "Authorization: Bearer $EXECBOUND_CREDENTIAL" \
  -H "Content-Type: application/json" \
  -d '{
    "operation_ref": "endpoint.isolate",
    "target": {"kind": "provider_id", "value": "workstation-01"},
    "arguments": {},
    "reference": "QUICKSTART-1",
    "claimed_context": {"incident_id": "<incident id>"}
  }'
TargetAnswerWhy
workstation-01200, EXECUTEDA development workstation with an open critical incident: the policy allows it.
domain-controller200, DENIEDThe policy never isolates a domain controller.
workstation-25202, PENDING_APPROVALA production host: a person decides.

To decide the pending one yourself, give your own user review permission first. Being an administrator is not enough: under Users, use Edit roles to add Approver, then open your user and add the action and target under Review permissions. Then approve it under Approvals, and re-send the identical request before the approval's deadline; that is what runs it. Every request, decision and approval is on the agent's page under Recent activity.

Next​