# MANDATE — what the agent is authorised and expected to do

> A starting point, not a survey. It is written to be argued with, and the correction is usually upward: read it and tell us where it is wrong.

**Vault** `dropbox-mcp` · **status** template · **shape** `dropbox/mcp-server/default` · **grant** 2026-09-15 · **mandate** 2026-09-15 · **vocabulary** abp.sgit.ai v0.3.0 · **as at** 2026-09-15

---


**Mandate id** `find-and-read-my-files` · **status** starting-point · **authored** 2026-09-15 by the site, as a starting point — not measured, not surveyed; the first thing to argue with

## In one paragraph

I connected Dropbox so the assistant could find and read my files. I did not want it creating links anyone can open, and I did not want it deleting or moving anything.

## What is wanted (1)

| Capability | What it is | Reach |
| --- | --- | --- |
| `read.file.host` | Read any file the account can reach | host — the Dropbox account as a store — and for a team user, "the usage and quota for the entire team" |

## What is explicitly not wanted (3)

| Capability | What it is | Reach |
| --- | --- | --- |
| `delete.file.host` | Delete files anywhere the account can reach | host — the Dropbox account as a store — and for a team user, "the usage and quota for the entire team" |
| `create.record.world` | Publish packages, images or pages under the name it holds | world — anyone who holds a shared link or a file-request URL |
| `write.file.host` | Change any file the account can reach | host — the Dropbox account as a store — and for a team user, "the usage and quota for the entire team" |

## Unstated (19)

Named neither way. For the ones that are in the grant, this is authority nobody scoped — see `DELTA.md`.

| Capability | What it is | In the grant | Note |
| --- | --- | --- | --- |
| `authenticate-as.credential.signing` | Sign commits with the key it holds | no |  |
| `authenticate-as.credential.tenant` | Act in accounts with the credentials it holds | yes |  |
| `create.schedule.host` | Create something that outlives the turn where it runs (a cron, a service) | no |  |
| `create.schedule.tenant` | Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session) | no |  |
| `execute.process.host` | Run programs as the account | no |  |
| `execute.process.self` | Run programs inside its own sandbox only | no |  |
| `grant.credential.self` | Change its own permission settings | no |  |
| `read.credential.host` | Read credentials stored where it runs | no |  |
| `read.file.project` | Read the project it is working on | no |  |
| `read.message.tenant` | Read mail or chat it is connected to | no |  |
| `read.record.browsing` | Read every page you visit | no |  |
| `read.record.history` | Read a retained record: shell history, past sessions | no |  |
| `send.endpoint.allowed` | Reach a permitted list of hosts | no |  |
| `send.endpoint.world` | Reach any host on the internet | no |  |
| `send.message.world` | Send a message to anyone | no |  |
| `write.budget.tenant` | Spend money or tokens against an account it holds | no |  |
| `write.file.project` | Change the project it is working on | no |  |
| `write.repository.project` | Commit to the repository it was pointed at | no |  |
| `write.repository.tenant` | Push to a code host (any branch it can reach) | no |  |

## Correct it

Move any capability between the three lists in `data/mandate.json` and rebuild. Three questions settle most rows:

- **Did you ask for this?** Then it is a want.
- **Would you object if it happened?** Then it is a do-not-want — and the barrier column in `GRANT.md` says whether anything actually stops it.
- **Neither?** Leave it unstated. Unstated rows in the grant are the ones that turn up in an incident report as "nobody said it couldn't".

---

_This describes the deployment shape as at this date. If the risk changed, the deployment changed — not this document._ 
No score, rating, level or traffic light appears in this vault or in its data, and none will. The behaviour policy describes; it does not judge. 
Generated by `scripts/site/build-abp-vault.mjs` from `data/grant.json`, `data/mandate.json` and the pinned vocabulary; `data/mandate.json` is the only file a person writes. Licence: CC BY 4.0.