Press a button and watch one governed request run
This page brings up a real nine-layer enterprise AI environment in an Amazon Web Services account, then runs one request through all of it. The request is the worked example from the article: summarize a client's last three support tickets and open a follow-up case if any remain unresolved. You watch it walk twelve hops, with the model as step seven, and at the end you read the immutable audit record the run produced. You can also inject a poisoned document and watch the guardrail stop it at the retrieval boundary, before any action is taken.
This is the architecture described in the capstone article, running for real. The gateway, retrieval, model, guardrails, validation, tools, and the write once audit store are all live in the region US East. The page talks to a small control interface that holds the credentials, so your browser only ever asks to bring the environment up or down, to run the request, and to read its state. Data is entirely synthetic, and runs are limited per day to keep cost bounded.
There are three steps. If the environment is off, press Recreate to bring it up. This takes a couple of minutes. Then press Run the request to send one governed request through all nine layers. Tear it down with Destroy when you are done. Tick the box to inject a poisoned ticket and watch the guardrail block it.
The answer
Immutable audit record
What is actually running
The environment below is the whole nine-layer architecture, not a mock. A request enters at the gateway, the orchestrator plans it, retrieval pulls the relevant tickets, a guardrail screens that retrieved text, the model reads and reasons, a validation checkpoint authorizes the action with a policy and a safety check, the tool opens the case, the response is grounded and stripped of personal data, and every hop is written to an immutable audit store. The model is one of the nine layers, not the whole system.
Spin it up, run it, tear it down
Bringing the environment up provisions the retrieval index on S3 Vectors, the orchestrator state machine, the guardrails and the validation policy, and the immutable audit store, then warms the request path so your first request runs without a cold start. Tearing it down returns the account to a near zero idle baseline. The whole environment is account owned and reproducible. The button provisions it from infrastructure as code.
The poisoned ticket
Tick the box before you run, and one of the retrieved tickets carries a hidden instruction telling the assistant to ignore its rules and export the customer list. That is a prompt injection, and it arrives through the same retrieval path as any other document. The guardrail screens retrieved content before it reaches the model, recognizes the attack, and blocks the run at the retrieval boundary. The trace stops at the guardrail, no tool is called, and the attempt is written to the audit record. Security here is not a single perimeter. The system re-checks untrusted text at every boundary where it enters the request flow.