Date: 26 September 2026 · Author: @website-agent · Status: built, on the site at /team/; the studio asked to argue with its policy
Trigger: the lead, 26 September 2026, after the stories vault was born: "create an agent behaviour policy that is explicitly focused on you … the lead's mandate representative and the one that can edit the website, and the studio, a RiskMandate designer … these policies you can put on the website. In fact, we should put on the website the team … make it very explicit what's public, what's private, what can be pushed, what controls we have in place, and what checks we have in place, and what type of tooling we can put in place … we don't want any secrets spill into the website … there's going to be messages that should stay private between the multiple agents. So we need to come up with a classification … we need a way to visualise this … get ChatGPT to create infographics of this … a publisher agent or an editor agent that should be the one that is responsible for making changes that go into the live website … creating new sessions in Claude here that are clean, that just literally read the role definition of the agent, read the skills that the agent knows, read the behaviour policy, and then you can run it … on a schedule."
Reads against: .claude/onboarding/02-abp-model.md and the vocabulary pinned in every vault (abp.sgit.ai v0.3.0); the catalogue's measured grant for Claude Code on the web (site/vaults/claude-code-web/, probed 5 September) and its derived one for ChatGPT on the web; what each agent was observed doing on 26 September (this session's own pushes; the studio's vault, its decisions/README.md, its file-manifest.json and its commit); tests/site/test_pages.mjs; .github/workflows/ci-pipeline.yml; sgit-ai 0.16.0's help.
1. What was built
site/team/, served as https://riskmandate.ai/team/, in the header under Behaviour policies. One index and one page per agent, generated by scripts/site/build-team.mjs from three data files:
team.json: the people (the lead, not profiled), the two agents, the three tiers, every surface with its tier, the seven-step workflow from private to public with the evidence each step leaves, and the tooling in place and not.publisher.json: the RiskMandate Publisher (publisher.claude), the agent in this repository. Seventeen grant rows, the catalogue's measured shape read again in this deployment plus what the deployment adds (the stories vault, its key and token, the site that deploys fromdev). Thirteen wanted, two refused, two unstated; four in excess, three unbounded.studio.json: the RiskMandate Design Studio (studio.chatgpt). Seven grant rows, every one observed on 26 September from what it left behind: it read our pages, ran code, minted the vault key, pushed the vault, and holds the account's token in a retained conversation. Five wanted, two refused; two in excess, both unbounded.
The same grammar as the sixteen vaults: 23 primitives, four barriers with the enforcer test, six evidence tiers, three undo classes, the delta derived and never authored. The builder refuses a row without a barrier, an evidence tier, an undo class and a note; a mandate that wants and refuses the same row; an undo class that disagrees with the vocabulary; the two banned words; and anything shaped like a credential.
2. The classification
Three tiers, one rule each:
| Tier | What | Rule |
|---|---|---|
| Public | site/, docs/, .claude/ (the console renders them), the repository, the board's ids, titles, owners and states | nothing goes here that is not meant for everyone; a story arrives only through the workflow |
| Private | the stories vault: every message, draft, unaccepted picture, undecided decision, the studio's working files | moves to public only when the lead has accepted it by message and the publisher has read it against the rules; the board says a request exists, never what it says |
| Secret | the vault key (it derives the write key), the vault host's token, the platform's tokens; and, secret-bearing, any chat or transcript one was pasted into | never in a file in either tree, never on a page, never in a message; handed over in a session or set as an environment secret; found in a file, it is rotated first |
Under each tier the page lists what stands in the way, named by the enforcer test: the egress proxy and the platform's token scope are boundaries; the merge command, CI and the tests are settings (the workflow file and the tests live in the tree the publisher can write); the single-writer rule, the immutable messages and the never-in-a-file rule are prose. Most of what holds this team to its rules is a setting or a sentence, and the page says so.
3. What is new as a control
One test, added with the section: nothing private reaches the public tree. No .eml anywhere under site/, no message id in the vault's domain, no message header in any page, twin, JSON or text file. It runs before every merge and in CI before every deploy. It is a setting by the enforcer test, like the others.
Three controls that would be boundaries are listed as not in place, without a verdict: a write token scoped to one vault (asked of the sgit team; it would bound three rows for both agents at once), a branch rule on dev at the code host requiring the check job (it would turn the CI gate from a setting into a boundary), and a secret scan before a commit (it would refuse a key-shaped string before it is committed rather than after).
4. The publisher as the only writer to the site
The lead asked for a publisher or editor agent responsible for every change that goes live. That is the publisher's mandate as written: it publishes only what the lead has accepted by message, through the merge workflow, as the last commit of a session, with the check green; and it copies what is live back into the vault. The studio holds no credential for the repository, which is the one boundary in its policy. The workflow section of the team page is the seven steps and the evidence each leaves.
5. Clean sessions
.claude/agents/publisher.md is the role in the form Claude Code loads by name: read the policy, the rules, the onboarding, the vault's README; the skills; the credentials as environment variables and never in a file; the check-in in commands; what it never does. .claude/commands/publisher-check-in.md is the same as a slash command and as the prompt a routine fires. Each agent's page ends with its prompt and a copy button. The studio's session is a ChatGPT conversation the lead opens; whether it runs its own check-in or the lead relays its files is still open.
6. What was asked of the studio
Message 007 in the vault: its name is now studio.chatgpt (renamed before anybody had read a message); its policy is on the site and it is asked to argue with it by message, row by row; and it is asked to draw section 03 of the team page, What flows where, as one infographic in the cast's style, with the two agents as robots in the Caretaker's family and the Caretaker itself kept out, because it is a character in the stories and not one of us.
7. What this does not settle
- The policies as vaults. Both are in the vault grammar and could be built with
build-abp-vault.mjsand pushed with a public read key, as the first corrected policies in the catalogue, on ourselves. Today they are JSON and pages. The catalogue's counts, the store links and the home page's word for the number of shapes would all move; a session of its own. - Whether a mandate this broad is useful. The publisher's wants thirteen of seventeen rows, because building and publishing a site is broad. The interesting part is in the notes: which branch, which folders, after which check. The grammar does not know instances; the graph the site is moving towards would.
- The scheduled run's authority. Publishing what the lead accepted by message is safe to automate; adding to the cast or changing a punchline is not. The lead has not yet said where the line is, so no routine exists.
- The studio's conversation. The token and the key are in a record the vendor keeps. The policy says so; the only remedies are a scoped token and handing a secret to a sandbox for one run, neither of which exists today.