PALO-AI quickstarts

Choose the shortest safe route into PALO-AI.

Start with one isolated, reversible action. Prove the governed path and its evidence before expanding tools, credentials or authority.

Choose your route Why PALO-AI?

Select by build mode

Three routes. One governance contract.

01 / Code

Code-first developer

Validate contracts, policy and the isolated reference runtime.

Open code quickstart →

02 / Visual

n8n / no-code builder

Install package 0.2 on a disposable self-hosted canvas and import the safe demo.

Open n8n quickstart →

03 / Rapid

Copilot Studio / MCP

Expose only a narrow, authenticated preview toolset to the agent.

Open MCP quickstart →

01 / Code-first

Validate the contracts and isolated runtime

Prerequisites: Node.js/npm, a local checkout and a supported shell.

What this proves

Schemas, Rego tests and the reference agentic validation suite pass in your checkout.

What it does not prove

Production workload identity, connector isolation, HA, KMS custody or independent assurance.

Install exactly from the lockfile.
npm ci
Install the pinned local OPA tool.
npm run opa:install
Validate the agentic contracts and policies.
npm run validate:agentic

Expected result: schema, registry, policy and full-cycle reference checks complete without failures.

MCP server reference Integration guide Inspect evidence

02 / n8n and visual builders

Sideload package 0.2 on a disposable canvas

Prerequisites: a disposable self-hosted n8n instance, Docker or an isolated host, and no production credentials.

What this proves

The package builds, verifies and can represent the governed decision and full-cycle action paths.

What it does not prove

n8n verification, npm provenance, a production connector or unavoidable interception of alternate credentials.

Build and verify the package.
cd packages/n8n-nodes-palo-ai && npm ci && npm run verify && npm pack
Sideload the generated tarball.
Install it only in your disposable self-hosted environment, then restart n8n.
Create the preview credential.
For the local Docker demo use gateway http://host.docker.internal:8787 and the repository’s explicitly demo-only token.
Import the safe workflow.
examples/n8n-demo/PALO-AI-full-cycle-assurance-demo.json

Download the safe n8n demo JSON
Compare the nodes.
PALO Governance is an advisory decision gate. PALO Governed Action represents the protected execution and verification path. Direct equivalent credentials remain a bypass and must be removed for real enforcement.

Expected result: visible Verified, Review Required, Denied and Execution Failed routes using synthetic data.

n8n package reference Hands-on assurance guide Architecture boundary

03 / Copilot Studio and MCP

Connect a deliberately narrow MCP toolset

Prerequisites: an isolated PALO remote MCP preview, HTTPS, a preview credential and permission to configure tools in Copilot Studio.

What this proves

Copilot Studio can discover and call selected PALO MCP tools over authenticated Streamable HTTP.

What it does not prove

Universal interception, OAuth/OIDC production identity or removal of direct equivalent actions.

Start from one reversible action.
Define its resource, allowed operation, accountable reviewer and expected effect.
Expose only the required PALO tools.
Use the server tool allowlist; do not publish the entire governance surface to the agent.
Use preview authentication deliberately.
The current reference remote transport supports a shared API-key/bearer preview boundary. OAuth/OIDC workload identity is the recommended production design and remains a readiness gate.
Add the existing MCP server in Copilot Studio.
Follow Microsoft’s Streamable HTTP MCP onboarding flow, then inspect every imported tool.
Remove direct equivalent actions.
If the agent can still call the operational system directly, PALO is advisory rather than an enforcement boundary.

Expected result: the agent sees only selected governance tools and evaluation remains inside a declared preview boundary.

PALO integration guide Microsoft MCP onboarding Identity readiness gate

Choose deliberately

Quickstart comparison

Route	First proof	Main bypass to remove	Next destination
Code-first	Contracts and reference tests pass	Direct SDK/tool credential	Eight-step wizard
n8n	Four full-cycle branches are visible	Alternate credential or direct node	Hands-on assurance guide
Copilot / MCP	Narrow tool discovery and call	Direct equivalent agent action	Integration guide

Run the terminal demo Open Governance Hub Capability Matrix Production Readiness