Mycelium / live demo
The demo
Synthetic corpus. Four seeded documents and two principals, labelled as such. One document is restricted to the broad principal; one is deliberately stale; two disagree about deploys. Anything you add lives in a session-scoped tenant and is deleted by the retention sweep once it is older than 7 days.
You get two real principals with their own bearer tokens, held only by this tab. Switching principals switches which token is sent — the access check runs on the same authentication path production uses. Every server read still requires a token.