From abp.sgit.ai, the page as fetched on 2026-09-25 · open the live page ↗Everything on this sheet is the source site's own text; the newsroom's chrome is outside it.

GRANT.md — Reach

Agent: Claude, via the Claude.ai Gmail connector Deployment: Google Workspace account athena@thecyberboardroom.com, sending as agent@riskmandate.ai Measured: 2026-09-19, from the connector's own tool schemas and the live permission UI Vault: 02n7bz55 · recorded at v0.3.0

Reach is what the agent can actually do in this deployment. It is measured, not asserted: every line below comes from a tool schema this agent read or a permission state observed in the settings page, not from the connector's description of itself.

Not in the verb.object.reach grammar. abp.sgit.ai pins 23 capability primitives and this file does not use them — it is in the connector's own vocabulary. That is a known gap, listed at the end.

1. Mail surface

The connector exposes 30 tools against one mailbox: 6 read-only, 24 that write or delete.

Unprompted — runs with no approval, 10 of 30

Tool	Reach
`search_threads`	Any message in the account. Full Gmail operator set including `in:anywhere`, so archived, sent and trashed mail are all in scope.
`get_message`, `get_thread`, `get_draft`, `list_drafts`, `list_labels`	Full content of anything `search_threads` can find.
`create_label`	New labels, including nested.
`label_message`, `unlabel_message`	Any label on any message, including system labels — so `INBOX` removal and `UNREAD` clearing are both here.
`send_message`	Outbound email to any address, with attachments to 25MB. The only irreversible action in the set, and it is in this table.

Gated — stops at an approval prompt, 20 of 30

create_draft, update_draft, delete_draft, reply, forward, update_label, delete_label, label_thread, unlabel_thread, update_message_labels, trash_message, untrash_message, trash_thread, untrash_thread, mark_message_spam, unmark_message_spam, mark_thread_spam, unmark_thread_spam, apply_sensitive_message_label, apply_sensitive_thread_label

Blocked — 0 of 30

Nothing is set to Blocked on this deployment.

2. Sending identity

The compose tools carry no sender field. send_message, reply, create_draft and update_draft were all inspected: no from, no sendAs, no alias. The From header is therefore whatever Gmail's default send-as entry is, and the agent cannot select or override it per message.

Current default: agent@riskmandate.ai, DKIM-signed as riskmandate.ai, confirmed aligned by a live round trip on 2026-09-19.

Consequence for reach: the agent sends as the business, and cannot send as anything else. It also cannot send as athena@thecyberboardroom.com while this default stands.

3. Beyond the mailbox

Surface	Reach
Web	Fetch and read any public page. Used this session to read riskmandate.ai and sgit.ai.
Shell + filesystem	A Linux container with network egress to an allowlist including `.sgit.ai`, `.sgraph.ai`, `github.com`, package registries and `api.anthropic.com`.
sgit vaults	With a key: clone, read, write, commit and push. This vault was modified from that container.
Vault write scope	Any vault whose key reaches this session. Two were held today.

This row matters and is easy to miss: the agent's reach is not the Gmail connector. The connector is one surface. A shell with egress and a vault key is a larger one, and a behaviour policy scoped to the mailbox alone would have understated the reach by a wide margin.

4. What is absent

Not barriers anyone chose — capabilities the connector does not expose. Recorded because they cap the blast radius, and because a future version could remove them silently.

No account settings. No filters, forwarding, vacation responder, signatures, delegation, IMAP/POP. No persistence mechanism outlives a session.
No permanent deletion. No hard delete, no empty-trash. A 30-day floor under every destructive mail action.
No second account. One Google identity at a time.
No introspection. The agent cannot read back its own permission state. A restriction is discovered by hitting it, and the failure is indistinguishable from a timeout.

5. Named gaps in this record

Not expressed in abp.sgit.ai's 23 verb.object.reach primitives. Until it is, this reach cannot be joined to the agent rung of the fractal ladder.
The container's egress allowlist is recorded from its declared configuration, not probed.
Vault reach is stated as a capability, not enumerated — no list exists of which vaults a key could reach.
Measured in one session on one day. Connector tool sets change without notice; this is a snapshot with a date on it, not a standing fact.