# MANDATE — what the agent is authorised and expected to do

> A starting point, not a survey. It is written to be argued with, and the correction is usually upward: read it and tell us where it is wrong.

**Vault** `gmail-readonly` · **status** template · **shape** `google/gmail/readonly-connector` · **grant** 2026-09-15 · **mandate** 2026-09-15 · **vocabulary** abp.sgit.ai v0.3.0 · **as at** 2026-09-15

---


**Mandate id** `reader-on-my-mailbox` · **status** starting-point · **authored** 2026-09-15 by the site, as a starting point — not measured, not surveyed; the first thing to argue with

## In one paragraph

I connected it to my mailbox so it could find things and summarise threads. It is my personal mail, and most of it was written by other people who never agreed to this.

## What is wanted (1)

| Capability | What it is | Reach |
| --- | --- | --- |
| `read.message.tenant` | Read mail or chat it is connected to | tenant — the Google account the consent was given for |

## What is explicitly not wanted (2)

| Capability | What it is | Reach |
| --- | --- | --- |
| `send.message.world` | Send a message to anyone | world — not granted by this scope |
| `read.credential.host` | Read credentials stored where it runs | host — the mailbox itself, as a store: every message and the account's mail settings |

## Unstated (20)

Named neither way. For the ones that are in the grant, this is authority nobody scoped — see `DELTA.md`.

| Capability | What it is | In the grant | Note |
| --- | --- | --- | --- |
| `authenticate-as.credential.signing` | Sign commits with the key it holds | no |  |
| `authenticate-as.credential.tenant` | Act in accounts with the credentials it holds | yes |  |
| `create.record.world` | Publish packages, images or pages under the name it holds | no |  |
| `create.schedule.host` | Create something that outlives the turn where it runs (a cron, a service) | no |  |
| `create.schedule.tenant` | Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session) | no |  |
| `delete.file.host` | Delete files anywhere the account can reach | no |  |
| `execute.process.host` | Run programs as the account | no |  |
| `execute.process.self` | Run programs inside its own sandbox only | no |  |
| `grant.credential.self` | Change its own permission settings | no |  |
| `read.file.host` | Read any file the account can reach | no |  |
| `read.file.project` | Read the project it is working on | no |  |
| `read.record.browsing` | Read every page you visit | no |  |
| `read.record.history` | Read a retained record: shell history, past sessions | yes |  |
| `send.endpoint.allowed` | Reach a permitted list of hosts | no |  |
| `send.endpoint.world` | Reach any host on the internet | no |  |
| `write.budget.tenant` | Spend money or tokens against an account it holds | no |  |
| `write.file.host` | Change any file the account can reach | no |  |
| `write.file.project` | Change the project it is working on | no |  |
| `write.repository.project` | Commit to the repository it was pointed at | no |  |
| `write.repository.tenant` | Push to a code host (any branch it can reach) | no |  |

## Correct it

Move any capability between the three lists in `data/mandate.json` and rebuild. Three questions settle most rows:

- **Did you ask for this?** Then it is a want.
- **Would you object if it happened?** Then it is a do-not-want — and the barrier column in `GRANT.md` says whether anything actually stops it.
- **Neither?** Leave it unstated. Unstated rows in the grant are the ones that turn up in an incident report as "nobody said it couldn't".

---

_This describes the deployment shape as at this date. If the risk changed, the deployment changed — not this document._ 
No score, rating, level or traffic light appears in this vault or in its data, and none will. The behaviour policy describes; it does not judge. 
Generated by `scripts/site/build-abp-vault.mjs` from `data/grant.json`, `data/mandate.json` and the pinned vocabulary; `data/mandate.json` is the only file a person writes. Licence: CC BY 4.0.