What a workload is
A workload is for agents that run in containers rather than on a developer’s machine. It uses your organisation’s rules and has its own approvers, keys and network settings. A container uses one of the workload’s keys to register. Quint checks every tool call in the run against the rules and records it with its decision. While a container runs, it checks in with Quint about every 30 seconds. The dashboard calls each check-in a heartbeat. A stop, a revoked key or a changed network setting reaches a run at its next heartbeat. Inside a container, Quint records tool calls, model exchanges and network connections. It covers agents without a supported hook at the network level only, and it does not record file and process activity in containers.The list
Before the first workload, the page shows Set up your first workload with four steps: Set up a workload, Create a key, Build from agent-base and run, Runs appear here. Once a workload exists, four tiles count Live runs, Runs today, Blocks today and Pending approvals. Below them each workload has one row. The row shows how many runs it has, when it last ran, whether its network is open (Observe) or limited (Allowlist), and how many runs it may have at once (Cap). A badge says whether the workload is Active or Disabled.Set up a workload
Creating and changing workloads, keys and approvers needs Admin or Owner; Read members and Policy Writers can read every workload and run. At the end you have a workload with a key, approvers and the container settings for its first run. Before you start:- Your own rules refuse or hold tool calls only once Enforcement is on for your workspace. Until then a run records what they would have done. See Shadow enforcement.
- An approval takes two people: the person who starts a run can’t approve its held tool calls. Someone trying this alone cannot decide the request, so a second person has to.
1
Open the form
Click Set up a workload. The steps are listed down the left: Basics, Notifications, Network and limits and Connect a container. Back and Continue move between the first three.
2
Fill in Basics
- Name: lowercase letters, digits and hyphens. It can’t be changed later.
- Description: optional.
- Concurrency cap (default 20): the most runs that may be live at once. A run over the cap is refused. The form also says how the cap is billed: “Each unit is billed as one container machine, and only on days a run is live.”
- Approval wait: how long a held tool call waits for an approver before it is denied. Pick 2 min, 5 min, 10 min (the default) or 15 min. Your rules’ own limit and the agent’s own timeout can make the wait shorter.
3
Choose Notifications
Notify according to policy is on by default. While it is on, Approval requests are always sent.
- For Blocks, pick Don’t notify, All blocks or Only these categories. A block notice names the rule, its family and the run. It never carries the arguments or the agent’s text.
- Tick at least one of your Channels, or click Connect a channel. With a PagerDuty channel chosen, Also send block notices to PagerDuty appears.
4
Set Network and limits
Under Network access you choose which websites and services the agent can reach. The form explains each choice:
- Network mode: “Observe: the agent may reach any destination; every connection is recorded. Allowlist: only the destinations below are reachable.”
- Allowed destinations (under Allowlist): one per line. “A host, or a wildcard like
*.example.com; add :443 or :443,8443 to limit the ports.” - Private networks: Allowed (the default) or Restricted. “Cloud metadata and Quint’s own addresses are always refused.”
- Private ranges (under Restricted): at least one address range such as
10.0.0.0/8. Each range must sit inside10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,100.64.0.0/10orfc00::/7.
- Stop grace (1 to 20 seconds, default 5): how long the agent gets to finish after a stop.
- Evidence flush timeout (2 to 60 seconds, default 10): how long Quint then gets to send its last records.
- Process limit (256 to 65,536, default 4,096): the most programs the agent may run at once.
5
Create the key
Under Workload key, click Create key. The key is shown only once. Copy it, store it in your CI secret store as
QUINT_WORKLOAD_KEY, then click Done.6
Copy the container settings
Use Copy on the Dockerfile, docker run or Kubernetes snippet. The docker run and Kubernetes snippets already carry the workload’s name. Then click Go to workload. The snippets stay on the workload’s Keys tab under Connect a container.
7
Name the approvers
On the Approvers tab, click Change approvers and pick the people who may approve or deny this workload’s held tool calls. Read members and people who have not accepted their invite can’t be picked. Until you save, nobody is an approver, so a held tool call waits until it expires and is then denied.
8
Start a container
Follow Run an agent in a container with Docker. Its first requirement is access to the agent-base image, which your Quint contact arranges. For the Kubernetes snippet, see On Kubernetes on that page. To run Quint in its own containers beside an unchanged agent image, see the Kubernetes setups. A run appears on the workload’s page when a container starts with one of its keys.If the workload page shows “Applying settings…”, start the first container when the notice is gone. See Change settings later.
The workload page
The header shows the workload’s name, whether it is Active or Disabled, and its network mode:- Observe: “Every destination is visible, not restricted.”
- Allowlist: “Anything not on your signed allowlist is refused.”
- Overview has two parts.
- The settings: Notifications, Concurrency cap (billing ceiling), Approval hold budget (seconds), which is the Approval wait in seconds, and Policy pack, the rules in use.
- The counts: Live runs, Runs today (UTC), Blocks today (UTC), Last run and Harnesses, last 30 days. A harness is the agent program, such as Claude Code.
- Runs, Keys and Approvers: see Use a workload.
- History: who created the workload, changed it or its settings, or set its approvers.
Use a workload
Find a run
The Runs tab lists the workload’s runs, newest first, 50 at a time. Load older runs shows more. Each row has the run’s ID, its Status, when it started and ended, and its exit code (the number the container reported when it stopped). Filter by All, Running, Ended or Lost contact. Lost contact means the run stopped reporting before it said it had ended. Runs are kept for at least 30 days.Read a run
Click a run’s ID. The header names the run and its workload, its status, and a line such as “Ran for 4 min 12 s and ended: the agent finished with code 0”. The run has three tabs. Overview has four parts:- Facts: when the run started and ended, its exit code and Ended reason, the agent, the image and the Quint version.
- Events: how many events Quint stored, sent and dropped.
- Effective values: the Stop grace, Flush timeout and Process limit the container ran with, and where each came from.
- What this run’s evidence does not cover: what Quint could not see. Unobserved connections, also under Facts, counts connections Quint could see but not read.
A run’s credential is revoked when its key is revoked or rotated, or when its workload is disabled.
See a refused connection
With Allowlist, Quint refuses any connection to a destination that is not on the list. It also refuses private addresses the workload does not allow. On the run’s Activity tab each refusal is a row of typeHTTP_REQUEST_BLOCKED with the verdict blocked. To list only refusals, pick HTTP_REQUEST_BLOCKED under Event type.
The row’s Tool, model or host cell names the destination when the container’s agent-base image reports it. The images released so far do not, and the cell shows ”—”. In that case, look in the agent’s own output for the address it could not reach.
If the agent needs that destination, add it under Allowed destinations.
Decide held tool calls
A held tool call waits for one of the workload’s approvers for up to its Approval wait. Approvers decide it on the Approvals page, or from the Decide link on the run’s Approvals tab. See Decide an approval. Before a tool call can be held and approved, each of these is needed:- Enforcement is on for your workspace. Until then your own rules hold nothing: the run records what they would have done. See Shadow enforcement.
- The workload has a working channel and at least one approver.
- The run says who started it. Otherwise its held tool calls can be denied but not approved. See Run an agent in a container with Docker.
- The approver is not the person who started the run. An approval takes two people.
Stop a run
A running run’s page has Terminate run. Admins and Owners can use it on any run. A Policy Writer can use it on runs of a workload that names them as an approver. A Read member sees “Admins and approvers can terminate runs.”1
Click Terminate run
A dialog asks “Terminate this run?” and says what will happen. The stop reaches the container at its next heartbeat, within about 30 seconds. The container then exits with code 78, and the agent’s unfinished work is lost.
2
Click Terminate
If you last signed in more than 10 minutes ago, the page says “Sign in again to terminate.” Click Sign in again, then repeat. Otherwise the header shows Terminate requested until the run ends. The ended reason is then “Terminated from the dashboard or by a runtime stop.”
Rotate or revoke a key
The Keys tab lists each key with its Prefix, when it was created, when it Last started a run and its Status (Active or Revoked). The buttons are Create key, Rotate and Revoke.- Rotate creates a new key, shown once, then revokes the old one. Update your CI secret before the next run. Live runs that registered with the old key stop at their next heartbeat with exit code 77.
- Revoke stops the runs that use the key at their next heartbeat, with exit code 77. The page confirms that they stop within about 90 seconds. Containers started with the key can’t register again.
Change settings later
Edit settings opens the same four steps. You can open any step, and one Save saves them all. The name can’t change. Basics gains Status: a disabled workload refuses new runs and stops live ones at their next heartbeat. When you change channels, the old ones get one message saying so. When a workload’s network settings or Approval wait differ from the defaults (Observe, Allowed and 10 min), Quint needs a moment to apply a change, usually under a minute. Meanwhile the workload page shows “Applying settings…”. It does so after a save, right after the workload is created, and when your organisation’s rules are published again, which turning Enforcement on also does. While the notice shows:- Running containers keep their current settings, then pick the change up at their next heartbeat.
- Don’t start a new container yet. With the agent-base images released so far it stops at once, and its log ends with a line containing
variant_not_ready. If that happens, start the container again when the notice is gone.
Where it runs
Workloads run in Docker on Linux, in Docker Desktop on Mac, and on Kubernetes. For Docker Desktop on Windows, rootless Docker or Podman, talk to your Quint contact first. ECS Fargate and gVisor are not supported. On Kubernetes, ClusterIP and API-server addresses count as private networks for the Private networks setting.If this fails
Next
- Run an agent in a container with Docker
- Decide an approval for what approvers see.
- Alerts in Slack, Teams and PagerDuty to connect a channel.