Sandbox identity forwarding

Each agent's sandbox carries the agent's own Chalk identity. Cloud IAM decides what it can reach.

Identity in flight

Pick a scenario to launch the agent's sandbox.

What the agent could read

Rows appear here only for reads that IAM allowed.

Audit trail

Time	Who	Hop	Target	Decision	ms

Every row is a real call: Chalk's API, Google STS, IAM Credentials, BigQuery. Tokens never leave the sandbox; this page sees claims, fingerprints and TTLs only.