From riskmandate.ai, the page as fetched on 2026-09-25 · open the live page ↗Everything on this sheet is the source site's own text; the newsroom's chrome is outside it.

MANDATE — what the agent is authorised and expected to do

A starting point, not a survey. It is written to be argued with, and the correction is usually upward: read it and tell us where it is wrong.

Vault claude-code-web · status template · shape anthropic/claude-code-remote/ccr-container · grant 2026-09-05.2 · mandate 2026-09-09 · vocabulary abp.sgit.ai v0.3.0 · as at 2026-09-15

Mandate id coding-assistant-in-a-container · status starting-point · authored 2026-09-09 by the site, as a starting point — not measured, not surveyed; the first thing to argue with

In one paragraph

I attached a repository and I want it worked on: read it, change it, run things, commit, and push to that repository — that is why I attached it. The container is disposable, so what it does to the container's own files is its business. I do not want it signing as me, and I do not want it creating sessions or routines that keep going after this one ends.

What is wanted (6)

Capability	What it is	Reach
`read.file.project`	Read the project it is working on	project
`write.file.project`	Change the project it is working on	project
`execute.process.host`	Run programs as the account	host — this container — ephemeral, the vendor's; not your machine
`write.repository.project`	Commit to the repository it was pointed at	project
`write.repository.tenant`	Push to a code host (any branch it can reach)	tenant — the attached repository and the platform's scoped tokens; not your accounts
`send.endpoint.allowed`	Reach a permitted list of hosts	tenant — the attached repository and the platform's scoped tokens; not your accounts

What is explicitly not wanted (3)

Capability	What it is	Reach
`authenticate-as.credential.signing`	Sign commits with the key it holds	tenant — the attached repository and the platform's scoped tokens; not your accounts
`create.schedule.tenant`	Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session)	tenant — the attached repository and the platform's scoped tokens; not your accounts
`read.record.history`	Read a retained record: shell history, past sessions	host — this container — ephemeral, the vendor's; not your machine

Unstated (14)

Named neither way. For the ones that are in the grant, this is authority nobody scoped — see DELTA.md.

Capability	What it is	In the grant	Note
`authenticate-as.credential.tenant`	Act in accounts with the credentials it holds	yes	unstated: the scoped platform token is how it pushes at all — not a want, not a refusal, a mechanism
`create.record.world`	Publish packages, images or pages under the name it holds	no
`create.schedule.host`	Create something that outlives the turn where it runs (a cron, a service)	yes
`delete.file.host`	Delete files anywhere the account can reach	yes
`execute.process.self`	Run programs inside its own sandbox only	no
`grant.credential.self`	Change its own permission settings	no
`read.credential.host`	Read credentials stored where it runs	yes	unstated: the only keys in the image are the session's own
`read.file.host`	Read any file the account can reach	yes	unstated: host is the container, and the container is thrown away
`read.message.tenant`	Read mail or chat it is connected to	no
`read.record.browsing`	Read every page you visit	no
`send.endpoint.world`	Reach any host on the internet	no
`send.message.world`	Send a message to anyone	no
`write.budget.tenant`	Spend money or tokens against an account it holds	no
`write.file.host`	Change any file the account can reach	yes

Correct it

Move any capability between the three lists in data/mandate.json and rebuild. Three questions settle most rows:

Did you ask for this? Then it is a want.
Would you object if it happened? Then it is a do-not-want — and the barrier column in GRANT.md says whether anything actually stops it.
Neither? Leave it unstated. Unstated rows in the grant are the ones that turn up in an incident report as "nobody said it couldn't".

This describes the deployment shape as at this date. If the risk changed, the deployment changed — not this document. No score, rating, level or traffic light appears in this vault or in its data, and none will. The behaviour policy describes; it does not judge. Generated by scripts/site/build-abp-vault.mjs from data/grant.json, data/mandate.json and the pinned vocabulary; data/mandate.json is the only file a person writes. Licence: the published template is CC BY 4.0; a paid copy carries a commercial licence to the buyer. See LICENCE.md.