We work out the product in public. This is where the research, the interface mockups and the open proposals live, before any of it is a feature. If you want to argue with us, this is the surface to argue with — and the arguing is the point.
This is a dated edition of a page that changes. The Lab holds our current thinking, and current thinking moves. This PDF does not: it is what we thought on the date stamped below, kept so the reasoning can be followed rather than only its conclusion. The live page may since have been corrected, extended or withdrawn — and if it has, the edition list on it will say so.
We work out the product in public. This is where the research, the interface mockups and the open proposals live, before any of it is a feature. If you want to argue with us, this is the surface to argue with — and the arguing is the point.
In reading order rather than by date — the finding comes first because everything after it leans on it. Each entry says what state it is in, because a finding and a mockup are not the same kind of claim and should not be read as though they were.
When somebody connects an assistant to their mailbox or their drive, what do they actually grant it? We read four vendors' own documentation and the answer is consistent: the unit of restriction is the application, never the data. The narrowest mail scope that can read a message reads every message. The default file corpus is, in the publisher's own words, files owned by or shared to the user. And in four places a vendor's own marketing and their own scope list disagree with each other.
Twelve stages from the first question a stranger reads to a delivered, recomputing vault with a read key they can hand to an underwriter. Five of those stages are drawn here as interface mockups, including the one that matters most: what a draft policy looks like, and what correcting it feels like. None of this is built. The mockups exist so the flow can be argued with before it is written.
The model and its data live on a separate site, maintained by somebody else. This is our open request list against it: one new property for the capability grammar, four deployment shapes we would like published, and the provenance conventions we would need in order to render any of it. Published rather than emailed, so the reasoning is checkable and the answer can be public too.
The build specification for the first thing anybody will ever use: a page that asks what you run, computes what you granted, and hands you the gap. Three tools, two vaults, two documents — and the arithmetic that decides what may leave the browser. A twenty-connector multi-select carries about 20 bits, which is more entropy than a well-known browser-fingerprint study measured in a whole fingerprint, so the full shape is computed locally and only bands and categories are ever submitted.
The author name and address on a commit are free text — git's own reference says the name has no effect on authentication, the code host's write interface takes both as parameters needing only contents write, and the host attributes the result to whoever owns that address with no consent step and no notification. Exactly one thing prevents it, and it is a repository setting. Alongside the finding: the eight-line prompt we would ship, with every line marked by what actually enforces it, and six documented incidents whose fixes have one thing in common.
Ask any deployer whether their agent should attack other people's systems and you get the same answer — it is the easiest line in any policy to agree. It is also the one where the grant cannot be enumerated at all: it is every address the process can route to, nobody granted it, and the measure we have been using since Lab 04 does not apply. A vendor's own documentation says the fetch allow list does not prevent network access because the shell can reach any URL; the setting that does hold covers shell subprocesses only, does nothing when written into a repository, and fails open. Includes what the machine that published this page can reach, measured.
The first behaviour-policy vault, built and pushed rather than drawn. Eight files derived from three inputs — a measured grant, a starting mandate and a pinned vocabulary — for Claude Code on the web with one repository attached. The delta is recomputed and checked against the published record; a Licence to Operate gets a referent; two generic files tell the agent what the others are and, in their own words, what a file like that cannot do. The session that built it read the grant back against what it had actually done, and the template makes the second shape one command.
The rest of this site says only what we can defend. The Lab is looser on purpose — but only about status, never about sourcing. A guess here is labelled a guess; a quote is still a quote with a link and a date.
| State | What it means | How much to trust it | |
|---|---|---|---|
| Finding | finding | Something we read in a primary source and can quote | As much as the source. Every claim links to it, with the date it was read |
| Mockup | mockup | An interface or a flow drawn to be argued with. Not built | As a proposal. If it looks like a screenshot, it is not one |
| Proposal | proposal | A change we are asking somebody else to make | As our opinion, with the reasoning attached |
| Open | open | A question we cannot currently answer | Not at all. It is here so nobody has to rediscover it |
Every entry is also cut as a dated PDF, and the old ones are kept. Send the file rather than the link when what matters is what we thought then — a link shows the reader whatever the page says by the time they arrive.
All 7 entries, in reading order, as a single PDF, 85 pages. This is the one to attach when you want somebody to follow the whole journey rather than land in the middle of it.
Digests for every edition are in lab-editions.json, so a PDF somebody was sent can be checked against this list.
Everything here is cheaper to change now than after it ships. If a finding is wrong, a mockup is unusable, or a proposal is misguided, that is the most useful thing you could tell us today.