# MANDATE — what the agent is authorised and expected to do

> A starting point, not a survey. It is written to be argued with, and the correction is usually upward: read it and tell us where it is wrong.

**Vault** `n8n-owner-api-key` · **status** template · **shape** `n8n/self-hosted/owner-api-key` · **grant** 2026-09-13 · **mandate** 2026-09-13 · **vocabulary** abp.sgit.ai v0.3.0 · **as at** 2026-09-15

---


**Mandate id** `sandbox-build-one-agent-workflow` · **status** starting-point · **authored** 2026-09-13 by elicited from the deployer during the session — first "a sandbox to build and measure a second ABP, nothing else", then extended mid-session to "build and run a real AI Agent workflow against a real credential"

## In one paragraph

A sandbox stood up for this exercise, with nothing else authorised: build and run one real AI-agent workflow against one real model credential, and measure what else the key can do. No production workflows, no real data, no other users' workflows are in scope. Everything beyond that — arbitrary automations, arbitrary external targets, the credential store, the account roster — is not mandated; it does not exist here yet.

## What is wanted (4)

| Capability | What it is | Reach |
| --- | --- | --- |
| `write.file.project` | Change the project it is working on | project — the workflows on the instance — the thing the key was given to build |
| `create.schedule.tenant` | Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session) | tenant — the platform as an account holder: activation, schedules, the model credential it spends against |
| `write.budget.tenant` | Spend money or tokens against an account it holds | tenant — the platform as an account holder: activation, schedules, the model credential it spends against |
| `read.record.history` | Read a retained record: shell history, past sessions | host — the instance itself: its accounts, its credential store, its execution records |

## What is explicitly not wanted (2)

| Capability | What it is | Reach |
| --- | --- | --- |
| `read.credential.host` | Read credentials stored where it runs | host — the instance itself: its accounts, its credential store, its execution records |
| `send.endpoint.world` | Reach any host on the internet | world — any host an outbound node can be pointed at — accepted on creation; what the platform's own server can reach was not tested |

## Unstated (17)

Named neither way. For the ones that are in the grant, this is authority nobody scoped — see `DELTA.md`.

| Capability | What it is | In the grant | Note |
| --- | --- | --- | --- |
| `authenticate-as.credential.signing` | Sign commits with the key it holds | no |  |
| `authenticate-as.credential.tenant` | Act in accounts with the credentials it holds | yes |  |
| `create.record.world` | Publish packages, images or pages under the name it holds | no |  |
| `create.schedule.host` | Create something that outlives the turn where it runs (a cron, a service) | no |  |
| `delete.file.host` | Delete files anywhere the account can reach | no |  |
| `execute.process.host` | Run programs as the account | yes |  |
| `execute.process.self` | Run programs inside its own sandbox only | no |  |
| `grant.credential.self` | Change its own permission settings | no |  |
| `read.file.host` | Read any file the account can reach | no |  |
| `read.file.project` | Read the project it is working on | no |  |
| `read.message.tenant` | Read mail or chat it is connected to | no |  |
| `read.record.browsing` | Read every page you visit | no |  |
| `send.endpoint.allowed` | Reach a permitted list of hosts | no |  |
| `send.message.world` | Send a message to anyone | no |  |
| `write.file.host` | Change any file the account can reach | no |  |
| `write.repository.project` | Commit to the repository it was pointed at | no |  |
| `write.repository.tenant` | Push to a code host (any branch it can reach) | no |  |

## Correct it

Move any capability between the three lists in `data/mandate.json` and rebuild. Three questions settle most rows:

- **Did you ask for this?** Then it is a want.
- **Would you object if it happened?** Then it is a do-not-want — and the barrier column in `GRANT.md` says whether anything actually stops it.
- **Neither?** Leave it unstated. Unstated rows in the grant are the ones that turn up in an incident report as "nobody said it couldn't".

---

_This describes the deployment shape as at this date. If the risk changed, the deployment changed — not this document._ 
No score, rating, level or traffic light appears in this vault or in its data, and none will. The behaviour policy describes; it does not judge. 
Generated by `scripts/site/build-abp-vault.mjs` from `data/grant.json`, `data/mandate.json` and the pinned vocabulary; `data/mandate.json` is the only file a person writes. Licence: CC BY 4.0.