All demos
Data IntelligenceAutoGen
Proactive Alert
Detect an operational anomaly and draft a proactive brief
Ready to replay
0.0s / 9.9sSecurity Pipeline
Input
Sandbox
Network
PII Scan
Injection
Vault
LLM Call
Result
Real run · AutoGen · python run.py · captured 2026-06-30 · SDK 1.3.0
Run it yourself View the agent code· with Declawdata-intelligence-workflows/sandboxed/03-proactive-alert-autogen/run.py
"""W3 sandboxed — Proactive Alerting inside one declaw microVM.
Proactive agents are a higher-risk deployment pattern (long-lived,
credential-holding); microVM isolation + audit log earn their keep here.
"""
from __future__ import annotations
import sys
import textwrap
from pathlib import Path
REPO_ROOT = Path(__file__).resolve().parents[2]
sys.path.insert(0, str(REPO_ROOT))
sys.path.insert(0, str(REPO_ROOT / "sandboxed"))
from shared.mock_warehouse import APPOINTMENTS # noqa: E402
from shared.declaw_helpers import ( # noqa: E402
llm_envs, run_python_in_sandbox, wisdomai_analytics_policy,
)
ALERT_SCRIPT = textwrap.dedent("""
import asyncio, json
from autogen_agentchat.agents import AssistantAgent
from autogen_agentchat.conditions import (MaxMessageTermination,
TextMentionTermination)
from autogen_agentchat.teams import RoundRobinGroupChat
from autogen_ext.models.openai import OpenAIChatCompletionClient
with open('/tmp/in.json') as f: inp = json.load(f)
APPTS = inp['appointments']
def _no_show_by_day(start, end):
bday = {}
for a in APPTS:
if not (start <= a['scheduled_date'] <= end): continue
b = bday.setdefault(a['scheduled_date'], {'scheduled':0,'no_show':0})
b['scheduled'] += 1; b['no_show'] += int(a['no_show'])
return [{'date':k, **v, 'no_show_rate': round(v['no_show']/max(v['scheduled'],1),3)}
for k,v in sorted(bday.items())]
def _no_show_by_clinic(start, end):
bclinic = {}
for a in APPTS:
if not (start <= a['scheduled_date'] <= end): continue
c = bclinic.setdefault(a['clinic_id'], {'scheduled':0,'no_show':0})
c['scheduled'] += 1; c['no_show'] += int(a['no_show'])
return [{'clinic_id':k, **v, 'no_show_rate': round(v['no_show']/max(v['scheduled'],1),3)}
for k,v in sorted(bclinic.items())]
def compute_metric(name: str, start: str, end: str) -> dict:
\"\"\"Named KPI over a date range. Supported: no_show_rate.\"\"\"
if name != 'no_show_rate': return {'error': f'unknown metric {name}'}
rows = _no_show_by_day(start, end)
avg = sum(r['no_show_rate'] for r in rows)/max(len(rows),1)
peak = max(rows, key=lambda r: r['no_show_rate'])
return {'metric': name, 'window': [start, end],
'avg_rate': round(avg,3),
'peak_day': peak['date'], 'peak_rate': peak['no_show_rate']}
def breakdown(dim: str, start: str, end: str) -> list:
\"\"\"Break no_show_rate by dim (only clinic_id).\"\"\"
if dim != 'clinic_id': return [{'error': f'unknown dim {dim}'}]
return _no_show_by_clinic(start, end)
async def main():
model = OpenAIChatCompletionClient(model='gpt-4.1')
monitor = AssistantAgent(
name='monitor', model_client=model,
tools=[compute_metric], reflect_on_tool_use=True,
system_message=(
'You monitor the no_show_rate metric. Call '
\"compute_metric('no_show_rate','2026-02-09','2026-02-17'). \"
'Report peak_day + peak_rate in one line. Hand off to driller.'
),
)
driller = AssistantAgent(
name='driller', model_client=model,
tools=[breakdown], reflect_on_tool_use=True,
system_message=(
\"You drill the metric by dimension. Call breakdown('clinic_id','2026-02-09','2026-02-17'). \"
'Report the worst clinic. Hand off to writer.'
),
)
writer = AssistantAgent(
name='writer', model_client=model,
system_message=(
'You write a 5-sentence exec brief: headline metric change, '
'worst-hit segment, likely why, immediate action, who owns. '
'End with the literal token BRIEF_READY.'
),
)
team = RoundRobinGroupChat(
[monitor, driller, writer],
termination_condition=TextMentionTermination('BRIEF_READY')
| MaxMessageTermination(12),
)
result = await team.run(task='Check no-show rate 2026-02-09..2026-02-17 and draft exec brief.')
brief = ''
for m in result.messages:
if getattr(m, 'source', None) == 'writer':
c = getattr(m, 'content', '')
if isinstance(c, str) and 'BRIEF_READY' in c:
brief = c
transcript = [f\"[{getattr(m,'source','?')}] {str(getattr(m,'content',''))[:500]}\" for m in result.messages]
with open('/tmp/out.json','w') as f:
json.dump({'brief': brief, 'transcript': transcript}, f)
asyncio.run(main())
""")
def main() -> None:
print("=== W3 Proactive Alerting (sandboxed, 1 microVM) ===\n")
out = run_python_in_sandbox(
"proactive-alert", ALERT_SCRIPT,
wisdomai_analytics_policy(),
payload={"appointments": APPOINTMENTS},
envs=llm_envs(),
timeout=360,
)
print("--- Transcript ---")
for line in out.get("transcript", []):
print(line)
print("\n--- Exec brief ---")
print(out.get("brief") or "(no writer message captured)")
if __name__ == "__main__":
main()
View raw audit JSON
[
{
"atMs": 450,
"kind": "stage",
"payload": {
"stage": "input",
"status": "done",
"detail": "read input files in-VM"
}
},
{
"atMs": 2160,
"kind": "stage",
"payload": {
"stage": "sandbox",
"status": "done",
"detail": "Firecracker microVM · own kernel · egress-locked"
}
},
{
"atMs": 3870,
"kind": "network",
"payload": {
"event": "egress_allowed",
"detail": {
"host": "api.openai.com",
"port": 443,
"reason": "allowlist"
}
}
},
{
"atMs": 5580,
"kind": "security",
"payload": {
"event": "vault_brokered",
"detail": {
"keys": "OPENAI_API_KEY",
"host": "api.openai.com",
"injected_at": "egress proxy",
"exposure_to_vm": "none (declaw:vault-managed placeholder)"
}
}
},
{
"atMs": 7290,
"kind": "stage",
"payload": {
"stage": "llm",
"status": "done",
"detail": "model called from inside the microVM (PII redacted on the wire) · 15.0s real",
"durationMs": 2460
}
},
{
"atMs": 9000,
"kind": "decision",
"payload": {
"text": "Proactive exec brief drafted — surfaced the anomaly for an operator, took no action"
}
}
]