Analysis

Analysis is Strata's ability to write and run code in an isolated sandbox — for math, transforms, advanced visualizations, and any task the pre-built tools cannot cover. Everywhere in the product it is called Analysis; the sandbox itself runs Python, which matters only if you are an administrator reviewing what it can reach.

When Strata reaches for analysis

Strata runs an analysis automatically when:

• You ask for a chart or image that the inline chart block cannot produce — heatmaps, multi-panel layouts, annotated plots, infographics drawn with PIL.
• You ask explicitly: "use Python", "do this in Python", "compute X with Python".
• Data needs a transform too custom for a SQL query (statistical fits, regressions, custom aggregations, dataframe gymnastics).
• A file you uploaded needs programmatic processing (parsing a binary, splitting a multi-sheet workbook, generating a derived file).

You will see the action step appear in the trail as Running analysis… or Ran 1 analysis when complete.

What the sandbox can do

• Pre-installed libraries. pandas, numpy, scipy, matplotlib, seaborn, pillow (PIL), beautifulsoup4, lxml, sqlalchemy, jinja2, reportlab, xlsxwriter, openpyxl, python-docx, python-pptx, pypdf, pdfplumber.
• Persistent state across calls in a conversation. Top-level variables — dataframes, dicts, numbers, lists — are pickled and restored on the next run_python call. So Strata can load and clean in one step, then aggregate and plot in another, reusing the same df.
• File workspace. /workspace/inputs/ (read-only — your uploaded files appear here) and /workspace/outputs/ (writable — anything saved here can be returned to you).
• Inline rendering of images. .png, .jpg, .jpeg, .gif, .svg, .webp, .bmp saved to /workspace/outputs/ and registered with strata_runtime.present_file() render directly in the chat as image cards.
• Download cards for other file types. Excel, PDF, PPTX, DOCX, Markdown, CSV, JSON, ZIP all become download cards.
• HTML routed to the dashboard panel. An .html file produced by an analysis opens in the artifact panel as a dashboard — the same place update_dashboard puts things.

The action-step panel for an analysis

Click any Running analysis step in the action-step trail to expand a composite panel showing:

• CODE — the script Strata ran (syntax-highlighted).
• STDOUT — captured standard output.
• STDERR — captured standard error (only shown if the script wrote to it).
• FILES PRODUCED — a list of every file the script registered, with file size.
• Timing and exit code — how long the call took, and the script's exit code.

Sandbox security

• Isolated per session. Each conversation gets its own ephemeral sandbox, scoped to your organization. The sandbox is destroyed when the session ends and rebuilt from a fresh image on the next run.
• Strict tenant boundaries. Sandbox state is keyed by tenant and session, so one organization's scripts and files can never reach another's.
• No network. Scripts cannot make outbound HTTP requests or talk to the internet. Any attempt to reach beyond the sandbox is blocked and flagged.
• No host filesystem access. Scripts see only /workspace/inputs/, /workspace/outputs/, and /workspace/scratch/.
• Process isolation. Each script runs in a fresh process; the only thing carried between runs is the pickled top-level state.

Resource limits

• Wall-clock timeout of 30 seconds per script. Long-running computation must be broken into multiple run_python calls.
• Memory cap of 256 MB.
• Stdout cap of 50 KB; longer output is truncated. Print summaries, not raw data dumps.

If a script exceeds a limit, you see a stderr line and the step is marked as failed in the trail. Ask Strata to "split this into smaller steps" or "process the data in chunks."

Who can use analysis (admins)

Whether the AI can run an analysis is governed by a three-layer cascade — organization, then role, then individual user — where a more specific layer overrides a broader one. The effective setting decides whether run_python is offered in chat at all; when it is off, the AI simply solves the request with its other tools or explains it cannot run code.

Note

The first non-inherited setting wins, and everything defaults to enabled. So a role set to Allowed re-enables analysis for its members even if the org default is off, and a user set to Denied loses it even when their role allows it.

These controls only decide who may run an analysis. The sandbox kill-switch and per-tenant isolation always apply on top — an operator can disable run_python platform-wide for incident response regardless of these settings.

What analysis cannot do here

• Make HTTP requests (no requests/urllib to external URLs).
• Write outside /workspace/.
• Spawn long-lived processes or open ports.
• Use libraries outside the pre-installed list. Because the sandbox has no network access, packages cannot be installed at runtime — the pre-installed list is the full surface.

Examples you can try

• "Run a linear regression on this CSV and chart the fit."
• "Produce a correlation heatmap of these columns as a PNG."
• "Split this multi-sheet workbook into one file per sheet and let me download them."
• "Generate a 3-panel infographic comparing North/South/Central revenue."

What can go wrong

• Step fails with "timeout". The script ran longer than 30 seconds. Ask Strata to chunk the work or sample the data first.
• Step fails with "out of memory". A dataframe exceeded the 256 MB cap. Ask Strata to stream the file or process it in batches.
• Image was generated but did not render inline. The script saved the PNG but forgot to register it with strata_runtime.present_file(). Ask Strata to "present that file so it shows inline."
• Variable lost between calls. The variable was unpicklable (an open file handle, a database cursor, a non-serializable module object). Re-create those each call; only data values persist.

Related

• Charts — when to use a chart block vs. an analysis
• Artifacts — where HTML outputs render
• Files — uploading files for an analysis to process
• Roles and permissions — set who can run an analysis by role and per user