What it gives an Agent Behaviour Policy
Four objects, and which of them a run fills.
The reason this case matters more to RiskMandate than most: a Topgent run on a developer's machine is most of the first pass of an Agent Behaviour Policy for the agents on that machine, and it is measured, on a machine the deployer is entitled to run, rather than read from a vendor's pages. The ABP has four objects. Topgent's output fills the first with evidence, gives the second something to be corrected against, and leaves the third and fourth to the ABP, which is where the blast radius becomes a mandate and a gap.
The ABP objectWhat the product suppliesHow it becomes the ABPWhat stays open
The grant: what the agent can doReachable paths, asked of the kernel; observed activity; declared accessRows in the ABP's vocabulary: read.file.host and write.file.host with the paths as reach; execute.process.host from the process tree; send.endpoint.allowed or send.endpoint.world from the network history; read.credential.host where a reachable path is a credential store. Evidence tier: measured, because the deployer ran it on their own machine. Declared access stays documented; observed becomes observed.Confinement is not evaluated, so a sandboxed agent's rows may be wider than its real reach: the ABP marks such rows measured for the account, not the process.
The mandate: what it was authorised to doNothing. Topgent does not know what the person meant the agent to do.Elicited from the person who installed the agent, in minutes, as the ABP does today. The Topgent inventory is the list they correct: for each reachable path and endpoint, wanted or not.This is the step Topgent's grade stands in for, and the ABP replaces: a grade says how much reach; a mandate says how much was meant.
The delta: excess and shortfallDerived, never typedEvery measured row not in the mandate is excess; the ABP recomputes it when either side moves. The blast radius Topgent draws is the excess before anyone has said what was meant.None: this is arithmetic once the first two exist.
The barrier: what stands in the way of each rowThe evidence kind on each finding, the sensor coverage, and the guarded stopaccount_readable and path_resolves say how the row was established. The stop is recorded as the plug for that host: one command, minutes, held by the machine's owner, a setting rather than a boundary because the same account can stop the sensor. Where Topgent reports a sensor as unsupported, the ABP's row says so rather than saying nothing.Topgent does not bound anything; it reports and stops. Every row it produces starts with none or expectation as its barrier, which is the honest starting point.
ProvenanceContent-addressed, chained evidence records with signed checkpoints; the AI-BOM exportThe evidence file behind a measured row. The ABP's vault keeps the run beside the policy, with the version and the date, and the offline verifier checks the bundle against a key the deployer already holds.A signature proves the chain was not altered after signing, and nothing about whether the sensor was right; the tool's own threat model says so, and the ABP repeats it.
What Topgent sees is one developer machine. The sixteen ABPs published on this site are for connectors and hosted agents, read from vendors' pages; a Topgent-fed ABP would be the first of a third kind, for the agents on a laptop, and the first whose grant is measured row by row rather than documented.