The zero-to-something recipe. Clone the repo, run lesson one, and it works.
What you build
A script on your laptop that calls a hosted sample server. The call does not go direct — it goes through the Agent Gateway, which decides whether to allow it.
That is the whole lesson, and it is deliberately small. The interesting thing is not the weather forecast that comes back. It is that you can open Payload Capture and see four distinct stages: what you sent, what the Gateway made of it, what actually arrived at the target, and what came back.
Why it matters
The target admits nothing except the Gateway. You cannot curl it, and that is
not an inconvenience to work around — it is the point being demonstrated. The
resource has no perimeter to defend because it has delegated that job to
something that can make an identity-aware decision.
Once you have seen the four stages, you can debug everything else in the Lab.
Then take the stabilisers off
Lesson two swaps the supplied script for your own agent. Nothing about the Gateway configuration changes, which is the second point worth noticing.