360360 Solutions GroupFind the break. Fix the flow.
Start a diagnostic
PES access

One-run invitation, target bound, and fail-closed by default.

This page builds the access contract without wiring the live PES or Google APIs.

Review the sampleRequest a snapshot

Sample grant record

{ "grant_id": "grant_01j0a7z1m4q2x8t9r6", "hashed_token": "sha256:8b7f0d6c0d9e17c6b1bfbf5fd7e3b0d8f9c3cf4f74d1b5c9ad0e0c7f34c2a11f", "target_domain_or_place_binding": "alder-street-mechanical.example", "issued_at": "2026-07-31T12:00:00Z", "expires_at": "2026-08-01T12:00:00Z", "max_runs": 1, "runs_used": 0, "status": "issued", "allowed_surfaces": [ "sample", "request", "access" ], "cost_ceiling": 0, "operator_reference": "ops/pes-access-review" }
Grant controls

Token validation, target binding, rate limits, budget ceilings, and one-run redemption.

Redeem access

GuardrailsThe repository stores only hashed tokens. This page fails closed for reuse, expiry, wrong target, rate limits, scanner unavailability, and budget pressure.

Required controls

  • Server-side token validation.
  • Raw tokens never stored in source or logs.
  • One-time redemption with expiry and target binding.
  • Fail-closed states for reused, malformed, wrong-target, rate-limited, unavailable, and budget-blocked grants.