# OpsDesk · Business leaders & first-time builders · Part 6

## Instructions for the agent

Extend the same working OpsDesk app. Read applicable project instructions, inspect the baseline and preserve unrelated work. Use synthetic data and the learner’s explicitly selected model. Never invent an answer, token count, trace or acceptance result. Keep credentials in private server-side configuration. Do not publish, buy credits, activate cloud services, change IAM or expand access without exact authority.

## Learner and method

No IT knowledge / C-level

Browser-first. Describe the outcome, use a builder and validate the result in plain language.

## Prerequisites

An owned builder account, available build credits and an explicitly selected app AI/backend option. No terminal is required for this route.

## Starting state

The same app with the tested security controls from Part 5.

## New capability

A reviewed hosting adapter, release packet and optional authorized OCI deployment.

## Follow this workflow

## Words used in this route

- **Backend:** The private part of the app that calls AI and runs approved lookups; your builder can generate it.
- **Tool evidence:** Information returned by an actual permitted lookup, not a model’s guess.
- **Guardrail:** A rule enforced by the app before an action can run.

1. Keep the app baseline and ask the coding assistant for a hosting handoff packet.
2. Review who can access it, which identity it uses, how costs are monitored and who owns rollback.
3. Use only a separately authorized prepared OCI target for a live walkthrough; otherwise label the handoff design-only.
4. Explain the actual app result and available trace evidence. Leave hosted acceptance pending when you cannot invoke the target.

## Request for the implementation agent

Extend our existing OpsDesk app for Part 6: A reviewed hosting adapter, release packet and optional authorized OCI deployment. Follow this No IT knowledge / C-level learner route. Explain the next action in plain language and use the builder UI; do not require me to run terminal commands. Implement backend checks in code, not just in a prompt. Use synthetic data and my explicitly selected backend. Never invent a successful answer, usage or trace. Keep keys in server secrets. Do not publish, buy credits, activate cloud services or change permissions without specific authority. Complete the route actions, verify actual results and report blockers honestly.

## Completion gates

- [ ] Validate the local release and adapter contract without losing prior features.
- [ ] Live deployment completion additionally requires authenticated hosted invocation and independent telemetry readback; otherwise mark deployment pending.

## If blocked

If access, credentials or native model support are missing, preserve the working app and mark that acceptance checkpoint blocked. A local model-double test or static preview is not a real app/model/provider result.

## Handoff

Record files or builder changes, exact synthetic input, actual app outcome, start/stop or reopen steps, evidence references and unresolved gaps. Preserve the working app for the next part. Mark results as local/model-double/browser-reference/provider-verified; do not merge these evidence classes. Never claim that a successful login or preview completes the real AI journey.

## Deeper explanations

- [OCI applications and deployments](https://docs.oracle.com/en-us/iaas/Content/generative-ai/applications-deployments.htm): Understand runtime configuration versus an active deployment image.
- [Course implementation reference](../replicate.html): Use the detailed setup, contracts and troubleshooting when you need the technical layer.

## First-time builder help

Start with the visible app definition in prompts/01-build-app.md. Then connect the actual AI action using prompts/02-connect-agent.md and API-CONTRACT.md. Ask your builder to implement server code through its supported backend features; a chat subscription alone is not a runtime integration. Use langfuse.html for observability and GUARDRAILS.md for enforced controls. If you require a local-code alternative, switch explicitly to the IT starter route rather than pretending the browser-only route has been executed.