Research teams pay for every finding twice: once to find it, once to verify it. Generic LLM output makes the second cost worse — an uncited summary has to be re-verified line by line before anyone puts their name on it, which is often slower than doing the research directly. The findings that do survive verification then scatter into decks and shared drives, where they stop compounding; the same question gets researched from zero two quarters later. And the obvious fix — let an agent browse — is exactly what a security team is right to question: unbounded outbound traffic from inside your perimeter, with no record of where the agent went or what it touched.
Browsing gets boundaries and a paper trail. Research agents run in sandboxed containers behind network egress allowlists — a DNS and firewall sidecar decides which domains resolve, and the run page shows every outbound domain the agent actually contacted. The security review stops being “trust the agent” and becomes “read the list.”
Citation becomes structural instead of aspirational. Briefs land as versioned artifacts in which claims carry source URLs, so review means spot-checking links, not reconstructing provenance. Monitoring targets live in a Data Table the schedules read: adding a competitor is adding a row, not editing a workflow.
Verified findings stop evaporating. Approved markdown is chunked, embedded, and indexed in the platform’s vector store, and any agent granted access can ground its answers in it through a read-only search_kb tool whose scope is fixed server-side. Retrieval returns passages with their source file and a relevance score — the corpus stays citable, not merely searchable. Long engagements hold together because runs are durable: a document pack that waits three days on a reviewer resumes exactly where it parked, without burning compute in the meantime.
Judgment about significance. An agent can report that a competitor changed pricing; whether that warrants a strategy response is a human call. Curation is a human gate too — search_kb is only as trustworthy as its corpus, so nothing enters the knowledge base without a reviewer’s approval. And distribution: no brief, delta, or diligence pack circulates until a named person signs off on it. Agents propose; humans decide.
Start with one workflow. The free tier is enough to run a real one — agents propose, your team decides.