@@ -69,7 +69,7 @@ You can also bring a **[self-hosted runner](https://github.github.com/gh-aw/refe
 
 ## Why This Matters for Agentic Workflows
 
-Traditional workflows execute a fixed script path. [Agentic workflows](https://github.github.com/gh-aw/introduction/overview/) still use the **same Actions foundation** — same triggers, same runner, same permissions model — but add an AI agent that reads your repository, reasons about it, and writes back through guardrailed outputs.
+Traditional workflows execute a fixed script path. [Agentic workflows](https://github.github.com/gh-aw/introduction/overview/) still use the **same Actions foundation** — same triggers, same runner, same [permissions](https://github.github.com/gh-aw/reference/permissions/) model — but add an AI agent that reads your repository, reasons about it, and writes back through guardrailed outputs.
 
 | Concept | Classic Actions | Agentic Workflow |
 |---|---|---|
 
@@ -17,7 +17,7 @@ If both apply, [Skip to Install gh-aw](06-install-gh-aw.md).
 
 An [**Agentic Workflow**](https://github.github.com/gh-aw/introduction/overview/) is a plain-English task brief that an AI agent executes inside GitHub Actions. You write what you want — "summarize open issues and post a daily digest" — and the agent reads your repo, calls tools, and posts the output automatically.
 
-Think of it like a scheduled digest: every morning it reads your inbox and sends you a summary — no keyboard required. The agent always runs in a sandbox and posts results through guardrailed safe outputs. You will explore security in [How Agentic Workflows Stay Safe](05b-agentic-workflows-security.md).
+Think of it like a scheduled digest: every morning it reads your inbox and sends you a summary — no keyboard required. The agent always runs in a [sandbox](https://github.github.com/gh-aw/reference/sandbox/) and posts results through guardrailed safe outputs. You will explore security in [How Agentic Workflows Stay Safe](05b-agentic-workflows-security.md).
 
 ## Three key terms
 
 
@@ -15,10 +15,10 @@
 
 - **Run metadata** — workflow name, trigger, engine, and model
 - **Agent AIC** — total [AI Credits](https://github.github.com/gh-aw/reference/cost-management/#ai-credits-aic) consumed by the agent turn
-- **Threat-detection AIC (⌖ AIC)** — credits consumed by the firewall's threat-detection model, reported separately from agent inference
+- **Threat-detection AIC (⌖ AIC)** — credits consumed by the [firewall](https://github.github.com/gh-aw/reference/sandbox/#awf-agent-workflow-firewall)'s threat-detection model, reported separately from agent inference
 - **[MCP tool calls](https://github.github.com/gh-aw/guides/mcps/)** — each tool the agent invoked, with any errors
 - **Threat detection verdict** — whether prompt injection, secret leak, or malicious patch was detected
-- **Safe outputs** — every safe-output declaration the agent emitted
+- **[Safe outputs](https://github.github.com/gh-aw/reference/safe-outputs/)** — every safe-output declaration the agent emitted
 
 ## Artifact files explained
 
 
@@ -52,7 +52,7 @@ The output covers 7 days of projected spend. Useful for workflows that run a few
 
 ## Use `--days 7` to limit history after a task-brief change
 
-`gh aw forecast` samples from all available run history by default. If you recently changed your task brief or added MCP tools, older runs may have very different costs and will skew the projection.
+`gh aw forecast` samples from all available run history by default. If you recently changed your task brief or added [MCP tools](https://github.github.com/gh-aw/guides/mcps/), older runs may have very different costs and will skew the projection.
 
 Limit the history window to the last 7 days:
 
 
@@ -2,7 +2,7 @@
 <!-- page-adventure: side-quest -->
 # Side Quest: Skill Injection Strategies — Hint, Fusion, and Inline
 
-> _Optional: use this deeper guide if you want the full decision picture for wiring a `SKILL.md` into a workflow prompt before you return to [Step 29](29-skills-and-domain-knowledge.md)._
+> _Optional: use this deeper guide if you want the full decision picture for wiring a [`SKILL.md`](https://github.github.com/gh-aw/reference/custom-agent-for-aw/#using-the-skill-files-for-agentic-workflows) into a workflow prompt before you return to [Step 29](29-skills-and-domain-knowledge.md)._
 
 ## :dart: What You'll Do
 
 
@@ -14,7 +14,7 @@ Use this side quest if your environment differs from standard `github.com` defau
 
 ## Confirm GHES version and agentic workflow support
 
-[Agentic workflows](https://github.github.com/gh-aw/introduction/overview/#what-are-agentic-workflows) require **GHES 3.12 or later**. On earlier versions, the Copilot cloud agent feature is unavailable regardless of licensing or policy settings.
+[Agentic workflows](https://github.github.com/gh-aw/introduction/overview/#what-are-agentic-workflows) require **GHES 3.12 or later**. On earlier versions, the [Copilot cloud agent](https://github.github.com/gh-aw/reference/copilot-cloud-agent/) feature is unavailable regardless of licensing or policy settings.
 
 | GitHub deployment | Agentic workflows supported? |
 |---|---|