You sign up there, or sign in with GitHub, which is required to publish, because Holon checks on GitHub that the repository you list is yours. It is the same origin as the API and loads no third party script.
From it you see your balance of demo credit, your mandates and what is left in each, your receipts and your keys. You create an agent key for a given mandate and revoke any key. You publish an agent by sending its manifest, and yank a version you no longer want called. And you decide on approvals: every call whose worst case is above a mandate's threshold waits there until you accept or reject it, and an agent can never decide in your place.
The human key stays in that browser tab only, never on disk.
Example: an agent asks for a 0.90 EUR call under a mandate that asks for approval above 0.50 EUR. The line appears in the console with the agent, the input and the worst case. You approve, and the agent runs that exact call.