AI Analysis Runs

An analysis run is what you start when the question needs more than a lookup: “pull yesterday’s security logs from the finance servers and tell me which accounts failed logon from outside the office, with the list attached.” Breeze exports the data it needs, writes and runs code against it in an isolated workspace, and hands back findings plus files you can download, attach to a ticket, or put in a report.

This runs on rented compute, and it is off until you say otherwise

Analysis code executes in a sandbox hosted in your organization’s region — not on your devices, and not on your own servers. It is off by default for every organization and an administrator has to turn it on per organization under Settings → Organization → Security. Until then the capability is simply absent: nothing breaks, and nobody can start a run. Self-hosted Breeze does not have this feature at all.

What the workspace can and cannot do

The workspace is a per-run virtual machine that is destroyed when the run ends.

It can	It cannot
Read the data the run staged into it	Reach the internet, your devices, or the Breeze API — it has no network at all
Run Python, Node and shell scripts the model writes	Hold any credential, token or key
Write files you can download	Change anything on a machine, or survive the run

Anything the analysis wants done comes back as a proposal. Proposals are text: turning one into a real action is the same approval you already use, with the same tier gate and the same audit record. The sandbox is not a way around approvals — it cannot reach a device even if it tried.

Starting a run from chat

1. Ask in chat for the analysis you want. Name the devices or the site if it matters.

2. Breeze answers with a run card showing the run id and its progress. Runs take minutes, not seconds — you can keep working, close the chat, or come back later.

3. When the run finishes, the card shows the summary and one chip per file it produced. Click a chip to download it, or Open the full run to see everything.

Starting a run is something only a person does from a live chat session — an AI agent cannot launch one on its own.

If the conversation ends before the run does — you closed the tab, your session timed out, or Breeze was updated — nothing is lost. The result is always written to the run page, and the card links straight to it. Chat is where you start a run and the convenient place to read it; the run page is where it is kept.

If you already pulled a file from a device in this conversation, Breeze can stage it into the workspace — that is how live device files get analysed, since reading a file off a machine still needs your approval each time.

Reading the run

The run page is the audit surface. Besides the usual trigger and status, an analysis run shows:

• Files this run produced — name, kind, size, a preview, and a download. Files always download as attachments; Breeze never renders them.
• What ran in the workspace — every step in order, with the language, the exit code, how long it took, and links to the exact script and its output. This is how you check a finding rather than take it on faith.
• Compute — the sandbox’s own cost, tracked separately from the run’s model/token cost.

Files are kept for 30 days and then deleted. A ticket or report you attached one to keeps the record; once a file expires, it shows as expired rather than as a broken link.

Attaching a file to a ticket

Open the run, find the file, and choose Attach to a ticket. Nothing is copied — the ticket points at the same file, so even a large output attaches instantly. The attachment expires with the file.

A report run can attach the same file the same way, by reference rather than by copy.

Turning it on

1. Your operator enables the feature for the deployment.

2. An administrator turns on Allow sandboxed AI analysis for each organization that wants it, under Settings → Organization → Security.

3. The organization’s AI policy must include the workspace capability. Until it does, runs are refused with a message saying so.

Each organization has its own daily compute budget and per-run limits, enforced before a run starts — an analysis that would exceed them is refused rather than truncated halfway.