29Court Your AI's Backend
Dillo example

Your AI already knows how to think.

Dillo gives it a backend. Meet Scout, an external agent running on a function-scoped key. Run it below and watch every call it makes. Inspect exactly what its key allows, then play Danny and make the human decision yourself. No setup, everything is live.

Documents
3
on the owner's desk
Functions
6
on the agent key
Table permissions
0
on the agent key

Watch the agent work

Scout's mission: find the Q4 consulting agreement and get Danny's approval. Each step below is a real call to this page's live Dillo backend, made by this page's server with Scout's function-scoped key, so the secret never reaches your browser. Scout can search and request, but it cannot read file bytes and it cannot approve anything. The decision belongs to a human.

    The key

    Scout's credential is real, and it is scoped to six functions and nothing else: no table reads, no table writes, no file bytes, no key management. The secret itself is held by the server and is never served to a browser. This demo used to hand the secret to every visitor, which quietly undid the point of scoping it. Now the page's server makes Scout's calls for it, and everything about the key is still here to inspect, except the secret.

    Scout agent key expires
    loading the key's public facts…

    That prefix is all that ever leaves the server. There is no reveal and no copy, because there is nothing here to reveal or copy.

    With this key, Scout can

    • Prove who it is (agent_identity)
    • Search the owner's documents and people by title
    • Request an approval for a specific document and person
    • Check whether an approval is still pending
    • Read the audit trail of its own calls

    With this key, Scout cannot

    • List or read any table directly
    • Read file bytes without a human's grant
    • Approve or reject its own requests
    • Create keys, manage users, or touch billing
    
    
    
    
    Run it with your own key. Create an account on this backend, sign in, and mint a key from your account (POST /v1/api-keys) with the scopes you choose, then swap YOUR_OWN_KEY for it above. A key you mint answers agent_identity right away. It cannot see Danny's documents: the search and approval functions only answer callers the owner enrolled in the demo circle, and enrollment is the owner's call, exactly as it should be.
    
  
    

  
    
    
    Play Danny
    
    
    The approval link alone opens nothing: Danny signs in with the demo account, then the link's token unlocks one document, five reads, one decision. Approve or reject, and watch Scout's status check flip.
    
    
    
      
    
      
    
    
    
    
    
      
      
    
    
    
    
    
  
    

  
    
    
    Activity
    
    
    Every function call writes an audit row: who called, what they did, and under which authorization. This feed reads the live audit trail through activity_feed, one of Scout's six functions.
    
    
    
      
    
    
    
    
    
    
      
    WhenPrincipalActionAuthorization
    
      
    Loading the audit trail…
    
    
    
    
    
  
    

  
    
    
    How it works
    
    
    Three moving parts, all of them real on this page.
    
    
    
      
    1. A scoped key
    The owner issues Scout a key with functions:* scopes only, and the secret stays on the server. The MCP surface at /mcp exposes the same four agent tools to any external agent holding a scoped key.
    
      
    2. Functions, not tables
    Scout never touches the database. It calls find_document, find_person, request_approval, and approval_status inside the demo's trusted circle, and the backend enforces ownership on every call.
    
      
    3. A human decides
    An approval is a single-decision, expiring grant. Only Danny's signed-in session can read the file or record the decision, and every step is audited.