## A measured vault from an early beta user, a prompt that lets any agent measure its own grant, and the app in its own window on a phone

**The first measured grant.** An early beta user gave the earlier, prose version of the policy to
an agent holding an owner-scoped API key on a self-hosted n8n instance and asked it to find the
edges. It built and ran one real AI-agent workflow, created and deleted one test workflow to
measure create-change-delete and activation, moved no secret, and wrote down what it did not
test. That write-up is now the vault [n8n-owner-api-key](abp-vault-n8n-owner-api-key.html):
eight rows, seven of them *measured* on a live instance — the tier none of the connector vaults
can claim. Full control of every automation, an outbound node accepted with no restriction on
target, every account on the instance visible, and credential metadata open through the MCP
interface and shut on the REST path — shut by the *measuring* environment's own gateway, not the
platform, which the write-up said rather than recording a barrier that was not there. Mandate: a
sandbox, one workflow. Delta: four excess rows, all four unbounded. Where the write-up's barrier
reading and the vocabulary's differ — it calls the API key a *setting*; the enforcer test says
the key is the grant — the vault records the disagreement unresolved, because the write-up has
a point the four barriers cannot say: a gate that is broad but real is not a rule in prose. The
brief reading it against the model is in `docs/briefs/`. The write-up itself and its author are
not published with the vault; that is the project lead's to decide.

**`MAP-A-GRANT.md`, in every vault.** The question was whether a prompt exists that an agent
holding a connector or a credential can be given to map out and draft its own behaviour policy.
Now it does, and it travels with every vault like `AGENTS.md`: the four objects and their verbs,
the 23 primitives and the four barriers with the enforcer test, the evidence tiers, whose
material; and the rules of measurement the n8n check followed and the ones it wished it had —
measure only what you are entitled to run, reversible probes and clean up, never move a
credential, note the door (the same operation can be barred through one path and open through
another), an error is a symptom not a barrier, say what you did not test. The output is the two
JSON files the generator turns into everything else.

**On a phone, open it in its own window.** The embedded app is the right thing on a desktop and
a small thing on an iPhone. Every vault page now has two buttons above the frame: *Open the app
in a new window*, which is the copy this site serves, and *Open in the vault browser*, which
carries the public read key and opens the whole product read-only without a paste.

Fifteen vaults in the directory; all re-pushed to carry the prompt.