One gateway in front of every AI app
A sandboxed lab on ESXi and a Mac mini. Every app, agent and user reaches language models and tools only through the Prisma AIRS AI Gateway: identity from Entra ID, policy from Strata Cloud Manager, every request scanned by AIRS Intercept and logged per user. The firewall allows nothing else.
How the lab works
Hover a node for details, click it for links. Use the arrows or the keyboard to switch between architecture, request flow and deployment.
Use cases
Each one is a different kind of client on the same gateway: a public chatbot, employees, agents, developer tools, agent-to-agent, and the agents nobody sanctioned.
Hosts and networks
Three VMs and a Mac mini. Every container has its own address in an ipvlan network, so the NGFW sees and logs each app separately.
URLs
All *.demo-lab.at lab names resolve to the private address of the proxy (192.168.201.202). They need the lab network or a VPN. This page is public.
Control plane
Where identity, policy and models are configured. Nothing on the data path works without these.
Status as of , from the DemoLab-AI README and the setup guide.