A measured vault from an early beta user, a prompt that lets any agent measure its own grant, and the app in its own window on a phone

The first measured grant. An early beta user gave the earlier, prose version of the policy to an agent holding an owner-scoped API key on a self-hosted n8n instance and asked it to find the edges. It built and ran one real AI-agent workflow, created and deleted one test workflow to measure create-change-delete and activation, moved no secret, and wrote down what it did not test. That write-up is now the vault n8n-owner-api-key↗: eight rows, seven of them measured on a live instance — the tier none of the connector vaults can claim. Full control of every automation, an outbound node accepted with no restriction on target, every account on the instance visible, and credential metadata open through the MCP interface and shut on the REST path — shut by the measuring environment's own gateway, not the platform, which the write-up said rather than recording a barrier that was not there. Mandate: a sandbox, one workflow. Delta: four excess rows, all four unbounded. Where the write-up's barrier reading and the vocabulary's differ — it calls the API key a setting; the enforcer test says the key is the grant — the vault records the disagreement unresolved, because the write-up has a point the four barriers cannot say: a gate that is broad but real is not a rule in prose. The brief reading it against the model is in docs/briefs/. The write-up itself and its author are not published with the vault; that is the project lead's to decide.

MAP-A-GRANT.md, in every vault. The question was whether a prompt exists that an agent holding a connector or a credential can be given to map out and draft its own behaviour policy. Now it does, and it travels with every vault like AGENTS.md: the four objects and their verbs, the 23 primitives and the four barriers with the enforcer test, the evidence tiers, whose material; and the rules of measurement the n8n check followed and the ones it wished it had — measure only what you are entitled to run, reversible probes and clean up, never move a credential, note the door (the same operation can be barred through one path and open through another), an error is a symptom not a barrier, say what you did not test. The output is the two JSON files the generator turns into everything else.

On a phone, open it in its own window. The embedded app is the right thing on a desktop and a small thing on an iPhone. Every vault page now has two buttons above the frame: Open the app in a new window, which is the copy this site serves, and Open in the vault browser, which carries the public read key and opens the whole product read-only without a paste.

Fifteen vaults in the directory; all re-pushed to carry the prompt.