Skip to content

Run with Lens Agents#

Lens Agents provisions Prism Agent as a managed agent inside a project sandbox, from its built-in Prism Agent template. The template pins the published image, exposes the web UI on a private port, mounts a persistent volume, and opts the agent into Lens Agents managed inference — so you don't supply a provider credential the way you do for a native or Docker install. A four-step wizard collects a name, optional Slack and Microsoft Teams credentials, and any extra policies, then creates the credential, agent policy, and sandbox for you.

Use this path when you want Prism Agent governed by Lens Agents: outbound traffic gated by a policy, Slack tokens injected at the boundary proxy rather than living in the agent's environment, and inference routed through the platform.

Create a Prism Agent sandbox#

To provision Prism Agent from the template:

  1. Open the project that will host the agent.
  2. In the Sandboxes section, click Create Sandbox, then select Prism Agent. The wizard opens on the Name step.
  3. Enter a name for the sandbox, then click Next.

  4. Optional. On the Credentials step, connect Slack to let the agent operate in a workspace over Socket Mode. Toggle Slack on and enter both tokens:

    Field Value
    Slack Bot Token The bot token, starting xoxb-.
    Slack App Token The app-level token for Socket Mode, starting xapp-.

    To let the agent operate in Microsoft Teams, toggle Microsoft Teams on and enter the Entra app registration's details:

    Field Value
    Teams App Client Secret The app registration's client secret.
    Teams App ID The app registration's Application (client) ID.
    Teams Tenant ID The Directory (tenant) ID. The app registration must be single-tenant.

    Leave both off to create the agent without them. Click Next.

  5. Optional. On the Policies step, attach existing project or organization policies, or add egress bundles from the policy templates. Each selection merges its allowed domains into the agent policy the wizard creates. Click Next.

  6. On the Review step, confirm the name, image, CPU and memory, the Slack and Microsoft Teams status, the Teams settings and ports, and the attached policies, then click Create.

The wizard creates a credential for each Slack token and for the Teams client secret, an agent policy, and the sandbox. The agent starts on the pinned image and its web UI is reachable on the sandbox's private port. Open the sandbox from the Sandboxes table to view its state and interfaces.

What the template provisions#

The Prism Agent template seeds the sandbox with these defaults:

Setting Value
Image ghcr.io/lensapp/prism-agent:latest
Web UI port 3003, private
Volume /data, for persistent agent state
CPU / memory 1 core / 2Gi (adjustable in the wizard)
Managed inference Enabled — the agent reasons through Lens Agents managed inference, so no provider credential is required
Inference providers Bedrock for chat, with Microsoft Foundry (azure) added for voice. You can deselect Foundry in the wizard.
Image updates Update automatically (imageUpdate: {auto: true})
Teams port 3979, public, only when Microsoft Teams is connected

With Image updates set to Update automatically, the platform checks the registry for a newer image behind :latest and restarts the agent on it once the sandbox has been idle for 10 minutes, or an hour after it finds the image even if the agent is busy. If the sandbox does not start on the new image or fails within 10 minutes, it goes back to the previous one and does not roll that image out again. The agent's state survives on the /data volume. To choose when to update, edit the sandbox and set Image updates to Notify only ({auto: false}): the sandbox page then shows Update available, and Update now restarts the agent on the new image. See Image updates.

When you connect Slack, the template registers credential injections at the boundary proxy: the real bot and app tokens are applied to matching Slack API requests at the sandbox edge, while the agent's environment only ever holds a placeholder. A Slack method the template doesn't cover is denied before it leaves the sandbox and recorded in the audit trail.

When you connect Microsoft Teams, the client secret is stored as an OAuth client credentials credential. The agent's environment holds a placeholder: the platform mints the Bot Framework token from the tenant's token endpoint and applies it to Bot Connector API requests at the sandbox edge. The policy allows the Microsoft sign-in, Bot Framework, Bot Connector, and SharePoint hosts the integration needs. Microsoft delivers messages to the public teams port, where the agent checks the Bot Framework token on every request. Create the Teams app and set its messaging endpoint as Microsoft Teams describes.

To receive webhooks, also publish port 3004 with public auth, as Exposed ports describes, and keep the web port private. The Webhooks page then copies each endpoint's public URL. Give each subscription a token or signature scheme, because a public port accepts requests from anyone.

Note

Connecting Slack through this template requires a Slack app configured for Socket Mode with both a bot token and an app-level token. See Slack for how the agent uses Slack once it's running.