# Your first governed workflow

Connect, observe, test a block, and resolve an approval in a test environment.

Updated: 2026-09-22

Canonical: https://docs.kastra.ai/start/first-workflow

## Before you start

Create a [Kastra account](https://app.kastra.ai/signup), select a workspace, and create a test environment in the console. Confirm that your plan has the features needed for the workflow; the Pro trial does not include every Team or Enterprise entitlement.

You need permission to connect the integration, an administrator to create and activate the test policy, and an authorized approver for HOLD. Prepare a disposable repository or harmless test tool, and keep the operation and expected result written down. For a formal evaluation, use the [pilot plan](https://docs.kastra.ai/security/evaluation).

## Choose your first workflow

Each walkthrough provides a complete test setup, a downloadable policy, exact harmless actions, expected outcomes, and cleanup. Choose the integration closest to your application.

| Workflow | What you will prove | Start |
| --- | --- | --- |
| Coding agent | A Claude Code Bash command runs, is blocked, or waits for approval | [Coding-agent quickstart](https://docs.kastra.ai/start/coding-agent) |
| Model request | An OpenAI request passes through Kastra and resumes after human approval | [Model-proxy quickstart](https://docs.kastra.ai/start/model-proxy) |
| Local MCP | An echo tool is checked before its downstream server executes it | [MCP quickstart](https://docs.kastra.ai/start/local-mcp) |

The examples use separate test environments and marker rules. They demonstrate the decision lifecycle; use the observed context from your real integration when designing production policies.

## Record the result and clean up

| Check | Completion evidence |
| --- | --- |
| Connected scope | Client/version, workspace, environment, and actual tool attributes recorded |
| Allow | Harmless action completed and its decision was found |
| Deny | Targeted action stopped and its side effect was absent |
| HOLD | Pending action waited; approved and denied cases produced their expected outcomes |
| Cleanup | Temporary rule removed or prior policy revision restored; normal test behavior rechecked |

If a check fails, stop expanding the setup and inspect [Edge diagnostics](https://docs.kastra.ai/edge/troubleshooting) or the relevant integration guide. Collect sanitized request IDs and responses for support.

## Expand deliberately

Review false positives, fail-open events, and missing coverage before enabling a policy for shared work. An action completing does not prove that no rule matched: an approved HOLD, shadow mode, or cached decision may also allow it to proceed.