# MANDATE — what the agent is authorised and expected to do

> A starting point, not a survey. It is written to be argued with, and the correction is usually upward: read it and tell us where it is wrong.

**Vault** `claude-m365-connector` · **status** template · **shape** `anthropic/microsoft-365-connector/default` · **grant** 2026-09-15 · **mandate** 2026-09-15 · **vocabulary** abp.sgit.ai v0.3.0 · **as at** 2026-09-15

---


**Mandate id** `search-our-tenant-read-only` · **status** starting-point · **authored** 2026-09-15 by the site, as a starting point — not measured, not surveyed; the first thing to argue with

## In one paragraph

We connected Claude to Microsoft 365 so people could search their mail, their chats and SharePoint. Reading is what we wanted. Nobody asked for it to send mail or post in Teams as them, and the administrator who consented read the page when it said read-only.

## What is wanted (2)

| Capability | What it is | Reach |
| --- | --- | --- |
| `read.message.tenant` | Read mail or chat it is connected to | tenant — the Microsoft Entra tenant the administrator consented for; the user's mailbox, shared mailboxes they are delegated to, and Teams chats |
| `read.file.host` | Read any file the account can reach | host — SharePoint sites and OneDrive files the user can already open — searched tenant-wide |

## What is explicitly not wanted (2)

| Capability | What it is | Reach |
| --- | --- | --- |
| `send.message.world` | Send a message to anyone | world — anyone reachable by mail from the user's address |
| `read.credential.host` | Read credentials stored where it runs | host — SharePoint sites and OneDrive files the user can already open — searched tenant-wide |

## Unstated (19)

Named neither way. For the ones that are in the grant, this is authority nobody scoped — see `DELTA.md`.

| Capability | What it is | In the grant | Note |
| --- | --- | --- | --- |
| `authenticate-as.credential.signing` | Sign commits with the key it holds | no |  |
| `authenticate-as.credential.tenant` | Act in accounts with the credentials it holds | yes |  |
| `create.record.world` | Publish packages, images or pages under the name it holds | no |  |
| `create.schedule.host` | Create something that outlives the turn where it runs (a cron, a service) | no |  |
| `create.schedule.tenant` | Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session) | no |  |
| `delete.file.host` | Delete files anywhere the account can reach | no |  |
| `execute.process.host` | Run programs as the account | no |  |
| `execute.process.self` | Run programs inside its own sandbox only | no |  |
| `grant.credential.self` | Change its own permission settings | no |  |
| `read.file.project` | Read the project it is working on | no |  |
| `read.record.browsing` | Read every page you visit | no |  |
| `read.record.history` | Read a retained record: shell history, past sessions | no |  |
| `send.endpoint.allowed` | Reach a permitted list of hosts | no |  |
| `send.endpoint.world` | Reach any host on the internet | no |  |
| `write.budget.tenant` | Spend money or tokens against an account it holds | no |  |
| `write.file.host` | Change any file the account can reach | no |  |
| `write.file.project` | Change the project it is working on | no |  |
| `write.repository.project` | Commit to the repository it was pointed at | no |  |
| `write.repository.tenant` | Push to a code host (any branch it can reach) | no |  |

## Correct it

Move any capability between the three lists in `data/mandate.json` and rebuild. Three questions settle most rows:

- **Did you ask for this?** Then it is a want.
- **Would you object if it happened?** Then it is a do-not-want — and the barrier column in `GRANT.md` says whether anything actually stops it.
- **Neither?** Leave it unstated. Unstated rows in the grant are the ones that turn up in an incident report as "nobody said it couldn't".

---

_This describes the deployment shape as at this date. If the risk changed, the deployment changed — not this document._ 
No score, rating, level or traffic light appears in this vault or in its data, and none will. The behaviour policy describes; it does not judge. 
Generated by `scripts/site/build-abp-vault.mjs` from `data/grant.json`, `data/mandate.json` and the pinned vocabulary; `data/mandate.json` is the only file a person writes. Licence: CC BY 4.0.