Neo4j runs hands-on workshops where every learner works in a real AWS or Databricks environment to build AI agents with Neo4j. In this webinar, Ryan Knight, Partner Architect at Neo4j, shows how his team hosts those workshops on Vocareum Cloud Labs, with budget limits, locked-down permissions, and short-lived credentials built in. He also walks through the open-source tools he built so coding agents can build, test, and run the courses.
Captions available
On AWS, Vocareum gives each student a separate AWS account and runs CloudFormation templates to set up the environment when the lab starts. On Databricks, students share one workspace, and each student gets isolated resources inside it. Either way, a learner clicks Start Lab and gets a working environment with credentials already in place, so a four- to five-hour workshop can start right away instead of losing time to setup.
Students work with real Bedrock models and embeddings and real AgentCore, not a mock. Compute is limited to the small VMs the labs need, model calls run on a budget, services and privileges are restricted, and credentials are short-lived: temporary keys on AWS and a session token on Databricks. As Ryan put it, too tight breaks the lab and too loose costs money, so finding the right permissions is part of building the course. Learn more about Vocareum Cloud Labs.
Ryan built Vocareum Utils, a set of open-source tools for AWS and Databricks that wrap Vocareum’s REST APIs. With them, a coding agent can scaffold a course, publish it from a pinned Git commit, check that the live lab matches the release, troubleshoot failures, and end labs for a whole cohort. The tools preview changes by default and check every upload and delete. Ryan says the Vocareum-specific work for each new course is now minimal, so he can spin up new courses quickly.
Each Neo4j course lives in a GitHub repository with all the content and Vocareum assets together. The AWS workshop is a series of six Jupyter notebooks. The first notebook checks the environment and builds the initial Neo4j graph. Later notebooks build an agent that uses the graph, deploy it to AgentCore on AWS, and add memory. Ryan also publishes a microsite for each course, so learners can read the concepts behind what they’re building as they go.
A learner clicks the link in their invite email and lands in the Vocareum lab environment. A dialog shows the AWS environment being prepared, which takes a couple of minutes. From there, learners can work in VS Code in the browser, use the command line, or open the AWS console. In the console, Ryan showed the CloudFormation stack Vocareum had already provisioned with the starting resources for the course.
The first notebook runs a sanity check on Bedrock model access, embeddings, and AgentCore Gateway access. When every check passes, any problem later in the lab can be traced to the workshop itself rather than the setup. Learners then add their Neo4j credentials to a config file, and the notebook installs dependencies, loads the workshop code, and starts loading documents into the graph.
Ryan then showed Vocareum Utils, the open-source toolkit he built on Vocareum’s REST APIs, with versions for AWS and Databricks. It works alongside the workshop repository, so a coding agent can scaffold, publish, test, and troubleshoot the course. Inside the workshop repository, the Vocareum-specific folder is small: mostly the course definition and the lab template that sets up the infrastructure.
These exchanges came from the live session’s Q&A and chat, which the published recording does not include.
Learners now start in a working environment instead of a blank account. Earlier providers didn’t support custom infrastructure such as CloudFormation templates, so students provisioned every resource themselves in a raw AWS account, which could take an hour or two of a workshop. Those providers also had no hosted cloud notebook that connected easily to learners’ resources on AWS or Databricks. Vocareum provides both.
Building and testing a notebook end to end. Given high-level requirements, such as a notebook that teaches a set of Neo4j and AWS concepts, an agent can build the notebook, run it in the Vocareum cloud sandbox, read the errors, fix them, and run it again. Before agents had the tools to run notebooks themselves, every error had to be carried back to the agent by hand.
By making the tools safe by default. Every command previews its changes unless explicit flags are passed to publish or delete, and guards check the credentials, account, and region before anything runs. Each upload and delete is verified afterward, and fixed exit codes and JSON output let the agent see exactly what failed. An audit log of permissions and security boundaries also supports a proper security audit of the course.
A cleaned transcript of the published recording. Filler, crosstalk and transcription errors have been removed and product and technical terms corrected; what was said is otherwise preserved. The recording covers the presentation and demonstration, so the live Q&A that followed it is not included here.
I will kick us off. I’m going to go ahead and share my screen. And I’ll just give a quick intro to Vocareum, and then I’ll hand it off to Ryan to talk about the exciting part of today’s webinar, which is how Neo4j has been using Vocareum to run their hands-on labs.
So, I’m Mary Gordanier, I’m a Solutions Engineer at Vocareum, and Ryan Knight is joining us today from Neo4j.
For anyone who’s not familiar, Vocareum is a platform for hands-on learning at scale. We have a whole bunch of different solutions for hands-on learning labs, and that includes built-in sandbox resources, built-in guardrails, different integrations, and all sorts of good teaching and learning tools.
So, we have a pretty large scale at this point. Last year, in 2025, we had about a million unique learners, and we partner with a lot of folks to provide training both to their customers and also to universities, both in direct partnership with universities and through some of these partners. Those include AWS Academy and Databricks, and obviously Neo4j, who we’re going to be learning more about today. We also work directly with a bunch of universities and help them get these hands-on labs into the hands of their students.
So, just a quick overview of the catalog and where the labs that we’re going to be talking about today fit into it. We have Cloud Labs. Cloud Labs and Data are really going to be the focus of what we’re discussing today. Cloud Labs include AWS, Azure, and Google Cloud Platform, giving direct access to those resources and those consoles. Data platforms include, most topically for today, Databricks, which also requires that cloud connection, so some of these work together in tandem. We also offer an AI Gateway for budgeted AI keys, agent builders, lots of developer tools, and integrated development environments. So today you’ll see the Visual Studio Code IDE.
So all of these can sort of be… it’s kind of a puzzle. You can fit the pieces together a little interchangeably, so you can have a Databricks lab with AWS, or an AWS lab with VS Code. We also have virtual machines and our latest tool, Vocareum Atlas, which was the focus of our last webinar, for building AI-powered learning experiences: using plain language to prompt and develop really customized learning experiences. So all of these can be used separately or together in tandem to build really robust and really custom environments that suit each of our clients’ needs.
So, as I mentioned, in this cloud computing and data platforms world, we have AWS, Azure, and Google Cloud Platform, and then Databricks. I think Ryan is going to talk more about some of the tricky points that we’re helping to manage for these, but one of the things is just direct access to these resources in a budget- and policy-controlled environment. A student learning about using any of these tools, directly or indirectly, needs a safe sandbox to learn in, right? Because these tools aren’t inherently built to make it really easy to put a limit on how much you spend. That’s not what they’re for. They’re for providing all the resources you can dream of. So we try to make it as easy as possible to build in those controls, so students can learn in a safe space, and our customers are protected from anyone who’s trying to get around and take advantage of the offered resources in inappropriate ways.
So, with that, I just wanted to keep that super short, because I think the really interesting thing here today is what Ryan’s going to talk through in terms of how Neo4j is actually using Vocareum for their hands-on workshops. So I’ll hand it right over to Ryan.
Thanks, Mary.
I’m Ryan Knight, I’m a partner architect at Neo4j, and my role is to help customers, partners, and the general audience learn about how Neo4j works with AWS and Databricks, and how we build joint solutions between the two. So I do a lot of hands-on teaching and a lot of enablement sessions. When we started wanting to build out these courses, we wanted to find an easy-to-use environment that could be run in the cloud, so we could do this virtually or in person. And a lot of what Mary talked about, having a sandbox environment with proper security constraints and budget controls, was really critical. It’s really hard to build yourself, so we’ve been really grateful to partner with Vocareum on building these out.
So, let me start with just a brief background. If you’re not familiar with Neo4j, Neo4j offers graph databases. One way to think about it is it’s basically modeling your business domain as a digital twin. So, as an example, if I were to model an aircraft along with the aircraft systems, the aircraft would be the nodes (the nouns, or the things that I’m modeling), and then the relationships, like “aircraft has a system,” are the relationships in that graph database. And it’s a labeled property graph, because each node has properties. For example, this node has an aircraft ID, and the relationship “affects system” has the property of what time it was reported.
And then we’re seeing a large amount of adoption in the AI space. One of the primary use cases is GraphRAG, so you can build out these graph databases and then use them to enable agents to get better context and to search through your data, whether it’s your unstructured or your structured content, and provide grounded context. We call it graph-enhanced reasoning around that data.
And so, for these use cases, we partner a lot with AWS, Databricks, GCP, and Azure, all the major hyperscalers, in offering these solutions and these joint solutions around Neo4j plus agentic AI. What we were looking for with Vocareum is a way to host a live environment where students could get hands-on experience building these solutions with Neo4j plus AWS or the other cloud partners.
So what I want to walk through today is, first, how we host our Cloud Labs in Vocareum, and then, second, the tools we built so coding agents can run them.
So, there are a lot of challenges. There’s something really different between building a workshop versus running workshops. Actually building a workshop tends to be a fairly hard process, because you have to think about: What is the participant experience? What tools are they going to have access to? How can they simulate a real cloud environment and have the experience of spinning up these resources, accessing large language models, and deploying agents? You want them to have the full environment experience, but you don’t want it to be unlimited, so you can keep your security constraints and your billing constraints under control. You want it locked down so no one’s spinning up something expensive. The other challenge is being sure that everything gets shut down and cleaned up, so everything is gone at the end. So our answer for this was Vocareum, with our own tools on top of it.
So, to give you an overview of how we host a course on Vocareum, let me walk through the two courses we have. All of our courses are Neo4j-plus-a-hyperscaler courses on Vocareum. They’re joint integration stories of Neo4j plus one cloud’s services, and they’re built end-to-end in a real cloud account. Every course runs on Vocareum and provides a full environment around these different hyperscalers. Today we have four courses: AWS, Databricks, Google Cloud, and Azure. They all have a very similar student experience: you just click Start Lab, and you get a full working cloud. All of the infrastructure and complexity is hidden away from the students, and they can just get the hands-on experience of building the joint solution.
So, the two courses that I’ll go over, and that I maintain, start with Grounded AI Agents with Neo4j and AWS. In this course, students build a hotel booking agent on AWS Bedrock AgentCore. It uses Neo4j to hold the hotel knowledge, the indexes, and the rules of reservation to do the GraphRAG and provide the context for the agents. Bedrock provides the reasoning over the evidence and the query embeddings. What we needed from Vocareum is a notebook environment for students to walk through the workshop materials in a real AWS account, with credentials so they could do things such as deploying agents and calling the models. And in Neo4j, we provided an AuraDB instance for each student. So this is bringing together a lot of different resources into a single sandbox environment for students to get the hands-on experience.
And then we have a similar course around Databricks. The Databricks course is around commercial aviation fleets. In this case, Aura holds the aircraft data, the flights, the maintenance, and the unstructured content around manuals. Then from Databricks, we have lakehouse data around engine sensor readings, which is time-series data from our aircraft. Students build a LangGraph supervisor and deploy that into the Databricks environment. It can route the questions to either the lakehouse search or Aura to provide a combined context for those agents.
And so, when we host these courses on Vocareum, we have a course repository with all the content and Vocareum assets together. Then, inside of Vocareum, you create the lab type, the session lengths, and the budgets. The lab type is what kind of cloud it is. Then you set up the startup of the lab. When these labs start up, depending on the hyperscaler or the cloud, you have to run different types of setup scripts. For AWS, it’s CloudFormation. Databricks doesn’t have a Terraform type of tool, so we use shell hooks instead. And then Aura is set up outside of the lab. Beyond just hosting those courses, we also wanted to run a check to prove the labs come up as students would expect: ensure that all the notebooks are properly deployed, we’re on the right version, all the resources were provisioned, and the environment was completely set up. Then we also wanted to run a check at the end to clean up and be sure nothing was left behind.
So, one of the complications we ran into was that AWS labs and Databricks labs differ quite significantly. Within AWS, it’s actually somewhat easier, because AWS allows you to provision a single account per student, and we could use CloudFormation templates to provision the environment. Databricks works very differently. What Vocareum provides is a shared workspace, and then each user gets their own isolated resources inside of that workspace. So it’s a very different setup and provisioning, and because of this, it would get really complicated if we tried to manage and build all of this on our own.
Let me see here. Yeah, so what we wanted to do is lock everything down, but still provide a full experience. Some of the risks we considered were big compute. If we provided a full AWS EC2 instance, people could go in and spin up expensive GPUs and run their own machine learning, crypto mining, whatever. We want to avoid that and keep it locked down to just the small VMs necessary for running the labs. We want to control the budget of the model calls: allow students to call the LLM and get the full experience of an agent calling an LLM and running the agents, but keep a budget on those. We also wanted to limit the services. We didn’t want to allow a full AWS experience and have students spinning up a lot of resources outside of that. There’s obviously the risk of privilege escalation, so we want to lock down the privileges that students could have. And we want to be sure that there are no forgotten resources left behind, so everything is reclaimed.
So once we locked it down, what students would get was a real IDE or notebook lab, real Bedrock models and embeddings, and real AgentCore, not a mock. So this provides them a real environment. And it’s a trade-off, because too tight breaks the lab and the students can’t run the notebooks, and too loose costs money. So finding the right set of permissions is difficult. Finding the right controls is difficult. And so we built a number of tools around this, which I’ll go through.
And then the other challenge is the cloud notebook. So, for example, with AWS and Databricks, we wanted to have a common cloud notebook experience where students could log into that cloud notebook, walk through the labs, get the hands-on experience, and have the AWS or Databricks credentials already provided for them, so they wouldn’t have to set anything up. Most of these workshops are four to five hours, so one of the goals was that as soon as they log into the cloud, it quickly provisions the infrastructure and they can get started immediately, without having to spend any time going through setup processes. And when you’re provisioning these environments, you have to be sure you don’t have long-lived keys. We want to be sure students don’t copy and paste the credentials out and then use them elsewhere after the course to continue running things, so you want short-lived keys that are shut down at the end of the course. For AWS, we did temporary keys. Databricks is a token inside of a live session.
Let me walk through just a high-level overview now of what these look like. Let’s see here. Oh yeah, I’ll cover these last two, and then I’ll walk through it. So what Vocareum provides is an isolated environment per student. How it works is you add students to the workshop. You can upload a CSV file of all the students, or you can add them one by one. Once you’ve added them to the course, the students get an email inviting them to participate in the workshop. They click on that workshop, go into the workshop environment, and get their own cloud account. As they log in to that workshop, it provisions the CloudFormation, runs the environment, and sets everything up. Then they have a VS Code experience in the browser. In that environment, they can see their budget and session limits, so they know where they are with the timeouts and the costs. And for us, we want to be able to manage the course in terms of rosters and enrollment: see who started a lab and see who’s enrolled. To do all this, we use a lot of the REST APIs that Vocareum provides for managing our courses.
Now, let me show you an example. We’ll provide links to all these resources so you can access them and see them yourself. If you wanted to build an AWS or Databricks course, or any of these courses with the hyperscalers, you’re welcome to copy our GitHub repos and adapt them to your own needs. We have a lot of resources out there that can help you get started with building your own workshops.
This is the AWS workshop. As an example, it’s a series of six notebooks. Each notebook is simply a Jupyter notebook, right? The first notebook is just: verify the environment, build the graph. It’s a series that goes from building the initial Neo4j graph, to building an agent that uses that graph, and then you take that agent, deploy it to AWS, and run it in the AgentCore environment. Then you access it through the AgentCore Gateway, and then we add memory to it. So this is a full course that walks through the entire process of building an agent with Neo4j and AWS.
Another thing I provide along with these is a microsite for each of them. That’s the course material. So this is the course material that walks through that same content and gives students the hands-on content as they’re walking through everything, to explain what they’re building, explain the concepts, and show how Neo4j and AWS work together.
And then, to show what the Vocareum environment looks like: a student gets an email, clicks on the email link, and comes into an environment that looks like this. When it first opens up, they see a little dialog that says “Preparing the AWS environment.” It takes a couple of minutes to provision the AWS environment. If they want, they can access the cloud directly through the CLI or an SSH key from the command line. Or they can click on Open AWS Console, get into the AWS environment, and see what’s been provisioned. For example, if I go in here and look at CloudFormation, I’ll see that it’s provisioned a CloudFormation stack and set up the initial resources for the students, things like that.
And then the students go into the notebooks and walk through them one by one. As a first example, the first thing I have them do is just verify AWS Bedrock access, to be sure everything’s provisioned and set up properly. This is critical because AWS changes things; there are always a lot of shifting changes in environments. So first, it’s just a sanity check to be sure model access is working and AgentCore Gateway access is provisioned. By running this, we know up front that everything is set up and provisioned properly. That way, as they get farther into the lab, if they run into problems, we know it wasn’t the provisioning or the access controls. That’s all set up properly, so now we can just jump into troubleshooting what’s wrong with how they’re doing the workshop.
So down here, we see “pass.” It was able to call 4.6, it was able to invoke the model, and it was able to call Nova Multimodal Embeddings, so it’s able to connect to the AWS environment. Actually setting up a cloud notebook and connecting it to a secure AWS environment is something we looked into doing ourselves, and it ends up being fairly complicated, so having this all just provisioned for the student was really nice.
And then the next one… oh, let me show this. For the students to be able to access Aura, and if they want to configure some other settings, we have a config file. They fill in the Neo4j credentials, and then when they run the notebook, it reads that config file and runs everything. So I can just run through this. We can see it’s going to prepare the workshop dependencies and load the workshop code. You can see what’s already in the graph. I already ran it once, so I already had 13 documents. Then it’s going to walk through loading the documents, processing them, and going through that unstructured content.
All right, so now we’re back to how we use Vocareum and how we worked with Vocareum. Vocareum provides a really nice set of APIs, nice sandbox environments, and a lot of tools for running and maintaining your courses. What I want is to be able to use a coding agent to not only build the course, but also give the coding agent complete control over building it, running it, troubleshooting it, probing it, and inspecting it. Basically, I want to be able to work with a coding agent to build the course from the ground up, run and test everything, validate permissions, and have all the tools and utilities to do that.
So, just a high-level overview: when you build a Vocareum course, the key parts of every course are the Vocareum structure, where the course holds the assignments and the assignments hold the parts. You have infrastructure, which is your lab template. You have your content, which is the notebooks and the configs, all the content that your course contains. And then there’s the course definition. I also added a shipping gate, to define what a finished lab holds and check that everything was shipped as expected. And then there are all the settings around it.
When you’re building these accounts, one of the complications is that to properly provision and set up these accounts, you have to have two roles. You have a deployer role that runs the lab templates at startup and attaches the role policy grants to the student session role. Then the student session role runs the notebook code, calls Bedrock AgentCore, et cetera. These roles need different sets of permissions, and that’s part of these sandbox environments. Being able to manage, run, and work with these is why I wanted to build the tools, so a coding agent has all the tools it needs to do this itself.
So, what I built was Vocareum Utils. It’s all open source, and we can share the links. I can show this just briefly. The goal is to provide the agents everything they need to build these courses. I was trying to do this by hand, where I’d have a coding agent build the course material and then do a sync. After syncing the course, I’d have to go in and manually run everything by hand and hit things like, “Oh, permissions were not right,” or “Infrastructure wasn’t set up right.” You have, like, five notebooks, and you want to run through them all and be sure they all work. I wanted to automate that entire process, so I built a set of tools around this.
The way this works is that it’s basically two repositories. One is the core workshop repository, which is your course and all your lab setup, and the other is Vocareum Utils, which is the utilities used for building it. So let’s see here… yep, there it is. Vocareum Utils provides a full set of utilities for coding agents to build and run the courses. This is for AWS. I also built the same thing for Databricks: a full set of Databricks Vocareum utilities for building and running workshops.
Everything is open source, so feel free to fork it and use it as you need. It walks through the entire process of creating the course, adding the tools, and scaffolding the hooks. So these are the two things: you can use the Vocareum Utils repository to build your own course, and then you can customize the workshop to what you need. In the workshop itself, for example, here under Vocareum, I have the Vocareum-specific parts of this course. What’s nice is that what I have to build specifically for Vocareum for this course is actually very minimal, because now that I’ve set up all the agent coding tools and harnesses, I have a very repeatable process for building new workshops. I just have to modify what the course is, what’s expected, and the lab template, which is the infrastructure startup. So what’s actually needed to build a course in Vocareum is now very minimal, and it’s really nice because I can quickly spin up new courses.
We’ve talked about the Cloud Lab challenges. This was built by wrapping the Vocareum REST APIs.
So the goal is entirely agent-driven operations. The agent is the operator. The person says what the goals are and what the risky steps are. CLAUDE.md is the manual: it’s all the commands and the rules, and it teaches the coding agent how to work with these tools. Then docstrings carry the reasoning behind each guard. A key part was that every answer is checkable, so I wanted a fixed set of exit codes and JSON output, so the agent can easily reason about when errors happen, what happened, and why.
And then I made all the tools safe for an agent, so they’re preview-by-default. You don’t accidentally delete your content, delete your permissions, or mess up the course. You have to pass in the right flags and be very explicit about when you publish, delete resources, etc. There are guards at multiple levels that check the credentials, the accounts, and the regions. So I put a lot of checks and security in place to try to make it safe for the coding agent to work with these workshops.
And everything is built on proof, not trust. Every time it uploads, it pulls to be sure it was properly uploaded. When something’s deleted, it pulls to be sure everything was deleted. And then there’s a full suite of offline tests.
So, the tools provide tools around building a course: connect to a Vocareum course and scaffold out its files. If we were to log into the instructor view or the administration view, what you see is a folder of all the files that are going to be provisioned for a course. It’s all the scaffolding and templating, these nested folders, in an admin view. What I want is to allow coding agents to connect to the course and scaffold out its files, with offline checks before anything ships, so the agent knows the proper structure of the files and builds them all out.
And then there’s the ability to build the student files from a pinned commit. I want to be able to pin a specific Git commit and ship that, and know that I always have this specific version. Then I want to be able to publish the template and the student files together, so I can release a pinned version of that course and confirm the live course matches the release. The nice thing about being able to pin these commits is that I can pin a specific version of the workshop, the templates, and the infrastructure all at one commit, and then release different versions. For example, I might want slightly different versions of the course for different audiences, or I might want to roll back to the last good release.
And then I needed tools for troubleshooting and probing: being able to diagnose why a stack failed or why a lab environment couldn’t see the console, and allowing the coding agent to run and inspect the environments itself so it can troubleshoot. When you’re building out this content, it’s fairly complex content, combining Neo4j plus AWS. So maybe you have your sandbox environment and your permissions all set up. Then you need to run the notebooks in those environments and see: Do they pass? Are there errors or bugs in the notebooks themselves? And are those bugs in the coding logic of the workshop, or are they in the permissions?
There’s a gate to ensure the lab holds what it should, and then the ability to repair accounts and stacks after rotation. The way AWS works with Vocareum is it’s basically a pool of accounts that get rotated, and what I found is sometimes we have to repair those accounts, so I provided tools around that. And then, mostly for testing, I want to be able to sweep, so as I’m testing out these accounts, I can clean them up. They’ll automatically clean up after a fixed time limit, but if you’re testing and you want to say, “All right, I only want it to run for an hour or two, and then manually sweep everything,” there are tools for that.
And then there are tools for actually running the workshop and running a cohort. This is useful at the end of the day. Maybe I have a four-hour workshop and I put six hours on it, but I want to cut it down to four hours. I can just run “end all” to end everyone’s labs. If a student’s lab gets stuck for some reason, there are tools to end that specific student’s lab. And then there’s reporting on what their spend is, and things like that.
Let’s see here. Yeah, so some of the things I learned: put every grant where CloudFormation applies it, grant in an uploaded policy. What I found is that grants in an uploaded lab policy do not reach all the session roles, so every grant is an AWS IAM role policy. Confirm the account before you trust the result, which means checking that the accounts were provisioned as expected. AWS cloud environments are always shifting and always changing. There are a lot of moving pieces. So, on Vocareum’s side and on our side, there’s a large surface of potential attacks, and AWS, Vocareum, and Neo4j are always having to look for potential vulnerabilities, lock things down, and change permissions to ensure we’re keeping these sandbox environments locked down properly. But this can also sometimes have an unexpected impact on your Bedrock model calls, for example. So we wanted to be sure you check your environments first, to understand what the errors are.
And the Databricks environment has exactly the same kind of tools: scaffolding a course, publishing it, proving the live lab came up, everything like that.
So, in terms of adopting the pattern, feel free to copy the AWS workshop, the Databricks workshops, and the Microsoft and GCP workshops we have out there. As you build your notebooks, be sure to find the guardrails: what the student account allows and blocks. Vocareum has been great to work with. As I was building the course, especially with AWS, I was really pushing the boundaries of what we could and couldn’t do. So I’d build the course out, run the permission checks, and say, “Hey, I need this specific IAM policy.” I’d ping Vocareum, and they’d get that enabled within a couple of hours for me. So it is a process to go through, finding what the proper permissions are. On the Vocareum side, I completely understand they need a locked-down sandbox environment to control their costs and their security surface. You just need to find what your guardrails are and what you’re trying to do, and fit the notebooks into those. And be sure to preview, to see what a change will do before it runs. I also found it really helpful for agents to keep an audit log, like, “Okay, these are all the permissions that I found, these are the security boundaries, and this is what we want the notebooks to do inside those security boundaries.” That can allow you to do a proper security audit of your course.
And the key takeaway is that this isolation really fits the cloud: an account on AWS, a user on Databricks. It fits really well into these cloud environments and makes hosting on Vocareum really easy. And then setup as code, which is the general concept of infrastructure as code and versioning as code, makes it really easy to repeat these courses, use them, and continue to build on them.
So, that’s all I had for today. Thank you so much.
This page draws entirely from How Neo4j Builds Its Hands-On Workshops, recorded October 14, 2026. The published recording covers the presentation and demonstration; the live Q&A that followed it was not included in the upload, so answers drawn from it are marked as such. We attribute figures and capability statements to the speaker who made them.
Tell us which clouds and tools your workshop uses, and we’ll show you how Vocareum can give every learner a real environment with budgets, permissions, and cleanup built in.
