Sandcastles

Sandcastles are interactive web applications that the AI builds for you through conversation. Describe what you need — an approval dashboard, a vendor scorecard, an intake form — and the AI plans, scaffolds, and iterates on a working React app with persistent data storage. The result is a real internal tool your team can use, not a mockup or a chart.

Sandcastles are how you go from "I wish we had an app for this" to a working app in a single chat session, without writing code yourself.

Who can create sandcastles

  • Any workspace member can create a sandcastle by asking the AI to build one in chat.
  • Workspace admins can see and manage all sandcastles in the workspace.

Who can use a sandcastle

Access is controlled by your workspace's permissions system. A sandcastle can be shared with individual users or groups at different permission levels:

  • View — open the app and see the data.
  • Execute — use interactive features (buttons, forms, filters) and trigger data changes through the app.
  • Edit — modify the app's code, rebuild, and manage its data collections.
  • Admin — everything Edit allows, plus manage who else has access and delete the sandcastle.

The person who created the sandcastle gets Admin automatically.

What you can build

Sandcastles are full React single-page applications. They render in the browser with Material-UI components, support local and persistent state, and can include multiple views, forms, tables, charts, and interactive elements. Common examples:

  • Approval workflows with kanban boards and status tracking.
  • Data dashboards that pull from persistent collections.
  • Intake forms that write submissions to a collection for processing.
  • Inventory browsers with search, filters, and drill-down detail views.
  • Scorecard apps that rank vendors, customers, or internal metrics.

What sandcastles cannot do

  • Access external APIs directly. A sandcastle's frontend code runs in the browser and cannot make arbitrary network calls. To connect a sandcastle to an external system, link it to a subagent that has the right tools.
  • Run server-side code. Sandcastles are client-side React apps. Backend logic — scheduled jobs, API integrations, notifications — lives in the linked subagent.
  • Store files. Sandcastles store structured JSON documents in collections, not files. For file storage, use the linked subagent's filesystem.
  • Be accessed without logging into Assist. There are no public URLs today.

How sandcastles work

When you ask the AI to build an app, it works in three phases:

  1. Plan — the AI generates a spec: which data collections the app needs, which views to build, and the implementation steps.
  2. Scaffold — the AI creates the app skeleton, the data collections, and any seed data in one step. A linked subagent is created automatically so the app has an operator.
  3. Edit — you and the AI iterate on the app view by view. Each edit creates a new version. You can preview the app live as you go.

Every version is saved. You can roll back to any previous version if an edit goes wrong.

State collections

Each sandcastle has its own set of collections — persistent document stores similar to a simple database. A collection holds JSON documents, each with a unique ID. The app reads and writes to these collections through built-in hooks (useSandcastleQuery, useSandcastleMutation), and the linked subagent can also read and write to them through state tools.

Collections are created during scaffolding and can be added later. There is a limit of 100 documents per query, so collections are best suited for operational data (hundreds to low thousands of records), not analytics-scale datasets.

Sandcastles and subagents

Every sandcastle with state collections gets a linked subagent automatically. The subagent:

  • Has read/write access to the sandcastle's collections through state tools.
  • Can be scheduled to run maintenance, sync data, or send notifications.
  • Can be wired to a Slack channel so the team can interact with the app's data through chat.
  • Cannot be deleted while the sandcastle link is active (to prevent orphaning the app's operator).

See Subagents overview for the full picture on what subagents can do.

Related guides