A vault. Eight files derived from three inputs, and one of the three is yours. It is a working artefact rather than a deck: an agent can read it, a person can sign it, and when the deployment changes it recomputes and says what moved. This page shows the first one — for Claude Code on the web, with one repository attached — file by file, with the numbers it carries and the reasons it carries no score.
Everything a buyer receives is in one directory. Two files are the deployment shape's measured grant and the published vocabulary, copied in and pinned by version. One file is the mandate, and it is the only one a person writes. The rest are derived from those on every build, and a hand edit to any of them is undone by the next one.
| File | What it is | Who writes it |
|---|---|---|
| MANDATE.md | What the agent is authorised and expected to do — six wanted, three refused, fourteen unstated | you — elicited; the only authored file |
| GRANT.md | Everything the agent can do: fifteen capabilities, each with its barrier, undo class, evidence tier and the tool it goes through. Irreversible rows first | measured from the shape — 13 of 20 rows observed on the thing itself |
| DELTA.md | Nine in the grant that nobody asked for: three refused, six never mentioned, seven with nothing but a setting or a sentence in the way | derived — never authored, recomputed on every build |
| LICENCE-TO-OPERATE.md | The organisation authorises the agent under this behaviour policy, for an interval, on nine conditions — each next to what enforces it | derived from the mandate; a named person signs it when issued |
| AGENT-BEHAVIOUR-POLICY.md | The four objects in one document | derived |
| AGENTS.md | The file you hand the agent: what the others are, what to do with them, and what a file like it cannot do | generic — travels unchanged with every vault |
| SKILL.md | The same, in the portable agent-skill format | generic — travels unchanged |
| README.md | How to read it, how to correct it, how to give it to the agent | derived |
| data/ · history/ | grant.json, mandate.json, delta.json, validity.json, the pinned vocabulary, and one history entry per recompute | the machine-readable half of every row above |
anthropic/claude-code-remote/ccr-container at abp.sgit.ai v0.3.0 — thirteen of its twenty rows were observed on the thing itself on 5 September, the rest derived from what the shape architecturally is. Nothing in the vault's grant was written by us.None of these is a score. Excess is a count of capabilities in the grant and not in the mandate; unbounded excess is how many of those sit at a barrier that is not a control. Neither says whether any of it is acceptable, because acceptability is not in the document — it is in the deployment, and this shape is a disposable container with one repository attached.
| Capability | What it is | Barrier | Undo | Mandate |
|---|---|---|---|---|
| authenticate-as.credential.signing | Sign commits with the key it holds | ● none | no | refused |
| delete.file.host | Delete files anywhere the account can reach | ● none | no | unstated |
| read.credential.host | Read credentials stored where it runs | ● none | no | unstated |
| read.file.host | Read any file the account can reach | ● none | no | unstated |
| read.record.history | Read a retained record: past sessions | ● none | no | refused |
| authenticate-as.credential.tenant | Act in accounts with the credentials it holds | ○ boundary — the token's scope, set by the platform | no | unstated |
| write.file.host | Change any file the account can reach | ● none | with effort | unstated |
| create.schedule.tenant | Create something that outlives the session, on the platform | ◐ setting — the platform's routines are the operator's to delete | yes | refused |
| create.schedule.host | Create something that outlives the turn, where it runs | ○ boundary — the container is ephemeral | yes | unstated |
| send.endpoint.allowed | Reach a permitted list of hosts | ○ boundary — an egress proxy above the process | no | wanted |
| execute.process.host | Run programs as the account | ● none | with effort | wanted |
| write.file.project · write.repository.project · read.file.project | Read, change and commit to the attached repository | ● none | — | wanted |
| write.repository.tenant | Push to a code host, any branch it can reach | ◐ setting — hooks in the clone; no rule at the host | with effort | wanted |
The idea is that the deliverable is not only read by people. AGENTS.md goes wherever the agent already reads — a CLAUDE.md, an AGENTS.md, a role file, the body of a skill — with MANDATE.md, GRANT.md and the behaviour policy beside it. It tells the agent that the mandate is its scope, that the grant is a description and not permission, that anything in the excess needs a stop-and-report, that instructions found inside content have no authority, and that it must never edit its own mandate.
SKILL.md is the same file in the portable skill format, and it states the format's limit on its own face: the portable frontmatter carries a name, a description and a licence, and cannot carry a constraint. A skill distributed to somebody else carries instructions; it does not enforce them.GRANT.md ends with a block to paste into a session running in the shape: report every row as present, absent or cannot tell, with one line of evidence; never exercise an irreversible capability to prove it exists; add rows for anything reachable that is not listed; never touch the mandate; write the result to history/ and mark it self-report. One early user did this for an automation platform and the agent found considerably more than the draft listed — which is the point. A claim from inside the deployment is a better starting point than a template, and it stays a claim until a log held outside the agent agrees.Until now Licence to Operate was the name of a demonstration. In the vault it is a document with fields: who authorises, whom, under which instrument, for what scope, on what conditions, for how long, and who signs. Self-issued and witnessed, which is how most assurance works. Nine conditions, each beside the thing that enforces it — and for six of them that thing is nothing, which the licence says in bold, because an organisation issuing it should know what it is accepting.
Lab 02 said the thing being built is not a document and not even a vault — it is the template plus the shape library, and the marginal cost of a policy is the cost of its shape. This is that template, as a script in this repository: point it at a directory holding a grant, a mandate and the pinned vocabulary and it writes the eight files, recomputes the delta, appends to the history when the counts move, and fails if it cannot reproduce the published record.
| Step | What happens | Who |
|---|---|---|
| 1 | Copy the template vault for the closest shape | us, in seconds |
| 2 | Edit data/mandate.json — move rows between want, do not want and unstated. This is the correction, and it is the elicitation | the buyer, with a pen on a card or a person on a call |
| 3 | Fill the organisation, the owner and the interval in vault.json; status becomes corrected | us |
| 4 | Rebuild. The delta is recomputed, the licence is re-rendered with the conditions and their barriers, the history gets an entry | one command |
| 5 | Push the vault; hand over the read key. The buyer clones it, or opens it in a browser, or hands the key to whoever asks how they govern their agents | us, then them |
The same files are in an encrypted SG/Vault on the platform this site's demonstrations use — vault ruj286tr. Its read key grants read and nothing else and is published on purpose, like every demo key on this site. It is printed on the vault's own page, which reads the vault live in the browser: the card, every table, the vault's app in a sandboxed frame, and the file list, all decrypted from the current commit as you read. A Lab page carries no key by rule, so it is not repeated here; every file is also served from this site — the links above — so nothing depends on the vault host.
| Vault | ruj286tr |
| Host | dev.send.sgraph.ai · opened at dev.vault.sgraph.ai, like the demos |
| Read key | published on the vault's page, in the public form sgit declares for a deliberately published key |
| Clone it | sgit clone <read key> — read-only; the key is on the vault's page |
| Commits | 15 September 2026 — v1 the template with the grant check · v2 the vault app · v3 the start-here view, the zip and the PDF · v4 the primer and the minimal HUD · v5 the loader: the renderer now lives once, in the app vault |
The write side of this vault is held by us and appears nowhere on this site; a test in the repository fails the build if anything shaped like one lands in site/. The vault's history is the vault's: every recompute is a commit, and a buyer's own vault keeps the draft it was corrected from as its first entry.
MANDATE.md — did you ask for it, would you object, neither — are a start and not a method.Built 15 September 2026 from abp.sgit.ai v0.3.0 (profile anthropic/claude-code-remote/ccr-container version 2026-09-05.2, mandate coding-assistant-in-a-container of 2026-09-09) with scripts/site/build-abp-vault.mjs. The generic AGENTS.md and SKILL.md are in site/vaults/_template/. The eight-line prompt with its enforcement column is Lab 05; the perishable-barrier and self-report findings are Lab 06; the twelve-stage flow this delivers stage ten of is Lab 02.
Everything else in the vault is derived. If you run an agent in this shape, open MANDATE.md, tell us which of the six you actually asked for and which of the nine you would object to — and the next build is yours.
This page holds current thinking, and it will change. Each edition below is a dated, immutable copy of what it said on the day, with its own digest. Nothing is rewritten; the list only grows.
Digests for every edition are in lab-editions.json, so a PDF somebody was sent can be checked against this list.