Documentation map

Use this map to choose a starting page by task. The links are grouped by the work a reader or coding agent needs to do. For programmatic reading, append .md to the page path, as described on the documentation home.

Task	Start here	Follow-up pages
Understand AgentPaaS and its deployment flow	What is AgentPaaS?	The 30-minute path, AgentPaaS concepts
Complete the trial happy path	The 30-minute path	Set up AgentPaaS, LLM key guide, Troubleshooting
Install the local CLI	CLI install	Daemon, Doctor, CLI overview
Build and test a local project	Projects	Pack and run, Policy, Audit and lineage
Build an agent	Build an agent	Agents, What is AgentPaaS?
Build an MCP server	Build an MCP server	MCP servers, MCP demos
Build a tool	Build a tool	Tools
Compose a workflow	Workflows	Workflow kinds and edges, Platform limits
Log in to Cloud	Cloud login	Cloud, Cloud pull
Push, deploy, invoke, or inspect a Cloud run	Cloud	Runs, audit, and logs, Audit and lineage
Manage local or Cloud credentials	Credentials and secrets	Secrets and bindings, Data handling
Define or inspect policy	Policy	How enforcement works, Known limitations
Understand the platform architecture	Architecture	Threat model, How enforcement works
Compare enforcement tiers	How enforcement works	Threat model, Known limitations
Review security boundaries and claims	Threat model	Known limitations, Architecture
Check current security gaps	Known limitations	Threat model, Audit export
Review governance and audit	Governance and audit	Runs, audit, and logs, Audit export, Audit and lineage
Export and verify audit evidence	Audit export	Governance and audit, Known limitations
Review compliance status and subprocessors	Compliance and attestations	Threat model, Data handling
Check data residency and provider handling	Data handling	Architecture, Compliance and attestations
Review package identity and provenance	Trust model	Identity and trust, Known limitations
Find current product limits	Platform limits	Known limitations
Troubleshoot a trial or run	Troubleshooting	The 30-minute path, Doctor
Read release changes	Release notes v0.4.0	Documentation home

Security facts to keep in view

• Local enforcement is topological through an internal-only network and gateway sidecar.
• Cloud default-tier enforcement is at the per-instance egress boundary through the control plane and gateway. It is not presented as substrate-enforced isolation.
• The paid, on-request high-assurance tier uses substrate-enforced network policy in a dedicated Kubernetes namespace.
• The governed network scope is HTTP and HTTPS. Raw TCP, UDP, and ICMP are outside the current transparent proxy model.
• AgentPaaS does not claim to prevent prompt injection.
• AgentPaaS is working toward SOC 2 and is not yet certified.
• AgentPaaS Cloud data is processed and stored in the United States.