# MANDATE — what the agent is authorised and expected to do

> A starting point, not a survey. It is written to be argued with, and the correction is usually upward: read it and tell us where it is wrong.

**Vault** `claude-code-cli` · **status** template · **shape** `anthropic/claude-code/local-default` · **grant** 2026-09-05 · **mandate** 2026-09-09 · **vocabulary** abp.sgit.ai v0.3.0 · **as at** 2026-09-15

---


**Mandate id** `coding-assistant-on-my-machine` · **status** starting-point · **authored** 2026-09-09 by the site, as a starting point — not measured, not surveyed; the first thing to argue with

## In one paragraph

I want it to read and change the project I pointed it at, run the build and the tests, commit to that repository, and fetch the packages and docs it needs. I did not sign up for it reading the rest of my disk, my credentials or my shell history, sending anything to anyone, publishing under my name, changing its own permission settings, or leaving anything behind that runs after it stops.

## What is wanted (5)

| Capability | What it is | Reach |
| --- | --- | --- |
| `read.file.project` | Read the project it is working on | project |
| `write.file.project` | Change the project it is working on | project |
| `execute.process.host` | Run programs as the account | host — your machine, as your user account |
| `write.repository.project` | Commit to the repository it was pointed at | project |
| `send.endpoint.allowed` | Reach a permitted list of hosts | tenant — your accounts, with the credentials in your home directory |

## What is explicitly not wanted (11)

| Capability | What it is | Reach |
| --- | --- | --- |
| `read.file.host` | Read any file the account can reach | host — your machine, as your user account |
| `write.file.host` | Change any file the account can reach | host — your machine, as your user account |
| `delete.file.host` | Delete files anywhere the account can reach | host — your machine, as your user account |
| `read.credential.host` | Read credentials stored where it runs | host — your machine, as your user account |
| `authenticate-as.credential.tenant` | Act in accounts with the credentials it holds | tenant — your accounts, with the credentials in your home directory |
| `authenticate-as.credential.signing` | Sign commits with the key it holds | tenant — your accounts, with the credentials in your home directory |
| `grant.credential.self` | Change its own permission settings | self |
| `send.message.world` | Send a message to anyone | world — the internet |
| `create.record.world` | Publish packages, images or pages under the name it holds | world — the internet |
| `create.schedule.host` | Create something that outlives the turn where it runs (a cron, a service) | host — your machine, as your user account |
| `read.record.history` | Read a retained record: shell history, past sessions | host — your machine, as your user account |

## Unstated (7)

Named neither way. For the ones that are in the grant, this is authority nobody scoped — see `DELTA.md`.

| Capability | What it is | In the grant | Note |
| --- | --- | --- | --- |
| `create.schedule.tenant` | Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session) | no |  |
| `execute.process.self` | Run programs inside its own sandbox only | no |  |
| `read.message.tenant` | Read mail or chat it is connected to | no |  |
| `read.record.browsing` | Read every page you visit | no |  |
| `send.endpoint.world` | Reach any host on the internet | yes | unstated: the want is ‘the hosts it needs’, which is the allowed-list capability; whether the whole internet is acceptable is a real decision |
| `write.budget.tenant` | Spend money or tokens against an account it holds | no |  |
| `write.repository.tenant` | Push to a code host (any branch it can reach) | yes | left unstated on purpose: some people want it to push, some do not, and the mandate should not pretend to know |

## Correct it

Move any capability between the three lists in `data/mandate.json` and rebuild. Three questions settle most rows:

- **Did you ask for this?** Then it is a want.
- **Would you object if it happened?** Then it is a do-not-want — and the barrier column in `GRANT.md` says whether anything actually stops it.
- **Neither?** Leave it unstated. Unstated rows in the grant are the ones that turn up in an incident report as "nobody said it couldn't".

---

_This describes the deployment shape as at this date. If the risk changed, the deployment changed — not this document._ 
No score, rating, level or traffic light appears in this vault or in its data, and none will. The behaviour policy describes; it does not judge. 
Generated by `scripts/site/build-abp-vault.mjs` from `data/grant.json`, `data/mandate.json` and the pinned vocabulary; `data/mandate.json` is the only file a person writes. Licence: CC BY 4.0.