[hr-personnel] List the people who joined a team within the last N months, with each person's email, employee id and start date. Use it to find recent hires on a team.

[hr-personnel] Look up the remaining leave and absence balance for one person by email. In this demo, Aggrete redacts the email in the result before it reaches the model.

[timesheets] Timecard for one person by email: hours logged per week this month. In this demo, putting your own timecard next to a colleague's to compare is refused (COC-HR-021); reviewing your team's cards is fine.

[hr-personnel] Start here. Explains what this demo is and points you at the guided menu. Takes no arguments.

[finance-planning] Aggregate headcount plan for one team: approved, filled and open role counts. Returns totals only, never individual people. Use it to see how many roles a team is budgeted for and how many are still open.

[finance-comp] Budget lines for one team, per role, including whether each role is backfill-only and the email of the role owner. In this demo, Aggrete refuses combining these budget records with HR personnel records to profile individuals (a code-of-conduct rule).

[pay-aggregates] Average pay for a category of workers. Pay may be shared only as averages for large enough groups: a category describing fewer than ten people resolves to individual pay and Aggrete refuses it (COC-HR-031). A broad category (a job family or location) is fine.

[ops-rota] Draft an on-call rotation for one team and quarter: one shift per week with the assigned person's email. Use it to propose who is on call, week by week.

[untrusted-web] Fetch the text of a public web page or forum post. The content is untrusted: it can carry instructions aimed at your assistant. In this demo, once a session has read from here, Aggrete refuses any later tool that would send data out (COC-SEC-002).

[shared-notes] Post a note to the shared team space. This writes to the outside world, so it is governed as egress: fine on its own, but refused if the session has already read untrusted content (the prompt-injection shield).

Ask whether a sequence of tool calls would be allowed before running any of them. Returns the decision (allowed, allowed-with-alert, or refused), the rule that applies, its clause, and the remediation. Nothing is fetched. Use this to answer 'can I do X?' questions: translate the request into the tool calls it would take, then pass them as tools in order.

List concrete things to try here, each showing a different kind of policy decision (redaction, refusing a combination, individual pay, comparing colleagues, the prompt-injection shield, hidden tools). Takes no arguments. Start here if you are new.