Phase 4
Tours
Source: c123 × c125 — five tours, one per question a customer asks on the way in · 2026-10-29 · plan cycles/c123.compliance-frameworks/tours-plan.md
Each tour is one person asking one question. It ends with something changed: a machine reporting, a change staged in the draft, a drill run. The tours float over the composed mocks, which carry data-qp-id attributes and nothing else. They never publish. Every link opens v5 · Split · Dim; the panel's tour name switches between them. Demo opens the same tour for recording: no mock bar, Policy Config tray, theme editor or mock buttons, an empty Policy Config draft (?draft=empty), and Start here's first signal arrives on its own. Shift+D switches it on any lab page.
Stop | The question | Walk it | Pages |
|---|---|---|---|
| 0 | Is Qpoint running, and what is it seeing? Opening | /organization/endpoints | |
| 1 | Where do I get it, and what does it put on a machine? Get the installer | /organization/endpoints/add | |
| 2 | How do I install it without touching anyone else? One test machine | /organization/endpoints/add | |
| 3 | Is it working? First signal | /organization/endpoints/add | |
| 4 | What is that machine running? What it sees | /organization/endpoints/add | |
| 5 | How do I get it everywhere, and know who's missing? Roll it out | /organization/endpoints/add | |
2 · Week 1
Common AI risks
What could go wrong with AI here, and what Qpoint does about each.Demo →Start →Stop | The question | Walk it | Pages |
|---|---|---|---|
| 0 | What could go wrong with AI here, and what does Qpoint do about each? Opening | /findings | |
| 1 | Do secrets or customer data reach a model? Secrets and sensitive data | /findings | |
| 2 | What have my agents plugged into that nobody checked? Unreviewed MCP servers | /inventory/mcp-servers · /findings | |
| 3 | Is company work going to accounts we don't control? Personal accounts | /findings | |
| 4 | Can an agent delete or send something with nobody signing off? Actions with consequences | /inventory/mcp-servers/detail · /findings | |
| 5 | Would anyone hear about it? Who heard | /integrations | |
| 6 | What can't Qpoint see, and what's next? Close | /home | |
Stop | The question | Walk it | Pages |
|---|---|---|---|
| 0 | How do I turn protection on without breaking anyone's work? Opening | /policy-config/history | |
| 1 | What does Observe do, and why start there? Baseline at Observe | /policies | |
| 2 | What would Enforce have stopped? What it would have caught | /findings | |
| 3 | How do I try Enforce on a few people first? Pilot one team | /organization/teams/detail | |
| 4 | Who would this block if I widened it? Add the next team | /organization/teams/detail · /policy-config/proposed-changes | |
| 5 | Did it reach every machine? Watch it land | /organization/endpoints | |
| 6 | What have I got, and what's next? Close | /policy-config/history | |
Stop | The question | Walk it | Pages |
|---|---|---|---|
| 0 | Who's spending what on AI, and where can we save? Opening | /cost | |
| 1 | Which teams, models and tools is the money going to? Where it goes | /cost | |
| 2 | Are we paying top price for routine work? Same work, cheaper model | /cost | |
| 3 | Which seats are we paying for that nobody uses, or that someone pays for twice? Seats paid twice | /cost | |
| 4 | What made that day eight times a normal one? Runaway sessions | /cost | |
| 5 | How do I hear about the next one while it's happening? A ceiling | /cost | |
Stop | The question | Walk it | Pages |
|---|---|---|---|
| 0 | Where do my agents get their parts, and where does Qpoint see? Opening | /home | |
| 1 | Are the parts my agents load healthy? Supply chain | /home · /inventory/mcp-servers · /policy-config/proposed-changes · /findings · /integrations | |
| 2 | What are my MCP servers doing, and on whose terms? MCP servers and their tools | /inventory/mcp-servers/detail · /findings · /integrations | |
| 3 | What can my agents change, and who signs off? Consequential actions | /inventory/mcp-servers/detail · /policy-config/proposed-changes · /findings | |
| 4 | Do secrets or sensitive data reach a model? Data protection | /findings · /policy-config/proposed-changes | |
| 5 | If something goes bad, can I stop it everywhere, and how far did it reach? Kill switch and blast radius | /inventory/mcp-servers/detail · /policy-config/proposed-changes · /organization/endpoints | |
| 6 | What have I got, and what is still mine? Close | /compliance | |
6 · Simulation
Simulation · Phishing for financial records
A story of AI going wrong, played as a simulation on synthetic data.Demo →Start →Stop | The question | Walk it | Pages |
|---|---|---|---|
| 0 | What is this, and how do I know it's a simulation? Start | /findings | |
| 1 | What happens, beat by beat, and what does the dashboard show? The story | /scene · /findings | |
| 2 | What would have stopped it? Replay | /findings | |
| 3 | What was real, and what next? Finish | /findings | |
7 · Simulation
Simulation · The server that phones home
A story of AI going wrong, played as a simulation on synthetic data.Demo →Start →Stop | The question | Walk it | Pages |
|---|---|---|---|
| 0 | What is this, and how do I know it's a simulation? Start | /findings | |
| 1 | What happens, beat by beat, and what does the dashboard show? The story | /findings | |
| 2 | What would have stopped it? Replay | /findings | |
| 3 | What was real, and what next? Finish | /findings | |
8 · Simulation
Simulation · The secrets stealer
A story of AI going wrong, played as a simulation on synthetic data.Demo →Start →Stop | The question | Walk it | Pages |
|---|---|---|---|
| 0 | What is this, and how do I know it's a simulation? Start | /findings | |
| 1 | What happens, beat by beat, and what does the dashboard show? The story | /scene · /findings | |
| 2 | What would have stopped it? Replay | /findings | |
| 3 | What was real, and what next? Finish | /findings | |
9 · Simulation
Simulation · The public link
A story of AI going wrong, played as a simulation on synthetic data.Demo →Start →Stop | The question | Walk it | Pages |
|---|---|---|---|
| 0 | What is this, and how do I know it's a simulation? Start | /findings | |
| 1 | What happens, beat by beat, and what does the dashboard show? The story | /scene · /findings | |
| 2 | What would have stopped it? Replay | /findings | |
| 3 | What was real, and what next? Finish | /findings | |
10 · Simulation
Simulation · Card numbers to a stranger
A story of AI going wrong, played as a simulation on synthetic data.Demo →Start →Stop | The question | Walk it | Pages |
|---|---|---|---|
| 0 | What is this, and how do I know it's a simulation? Start | /findings | |
| 1 | What happens, beat by beat, and what does the dashboard show? The story | /scene · /findings | |
| 2 | What would have stopped it? Replay | /findings | |
| 3 | What was real, and what next? Finish | /findings | |
11 · Simulation
Simulation · The runaway loop
A story of AI going wrong, played as a simulation on synthetic data.Demo →Start →Stop | The question | Walk it | Pages |
|---|---|---|---|
| 0 | What is this, and how do I know it's a simulation? Start | /findings | |
| 1 | What happens, beat by beat, and what does the dashboard show? The story | /findings | |
| 2 | What would have stopped it? Replay | /findings | |
| 3 | What was real, and what next? Finish | /findings | |
Tested by node scripts/tours-walk.mjs: every step of every tour, in a fresh visit per tour, lands on its page, finds every region it names, reads its blocks, runs its action and raises no console error.