The behaviour-policy library: one page, two views, a preview panel, scenarios, and a top-level place on the site
A top-level page, and a name a stranger recognises. The directory of vaults was a list of
fifteen white tiles with two-letter glyphs under Live demos, and the tiles did nothing when
clicked. It is now Behaviour policies↗, a top-level menu item at
/agent-behaviour-policy (/abp/ and the old abp-vaults.html redirect to it), and it is
framed as what it is: the library of template policies — the building blocks a real
deployment's policy is made of. One per target application, and one per business function.
Two views of one set. A grid of tiles with the product's own mark, and a list with the four
counts aligned and sorted by what is unbounded; a toggle top right, and the same search and
filters over both. Search matches names, vendors, OAuth scopes and permissions, tool names and
the 23 capability ids, so send.message.world finds every policy that can send mail whatever
the product calls it. A by behaviour facet lists the 23 with their glosses, so one click
answers which policies can delete files — the first visible edge of the graph the debrief of
15 September describes (the brief is in docs/briefs/).
A preview panel, for demos. Click a tile or a row and the policy appears on the right
without leaving the page: the card, the grant against the mandate row by row with its barrier
and its status, the four counts and the shortfall, two buttons — the policy page, the vault
opened read-only with its public key — and the key itself one tap away. On a phone it is a
sheet. A link with #policy=<slug> opens the page on that policy.
Scenarios: the mandate changes, the grant never does. Every vault now carries six
scenarios in data/scenarios.json, three normal and three advanced, each a deployer's sentence
and the primitives it wants and refuses. The panel recomputes the delta as you click: a morning
digest wants a schedule the scope does not grant, so shortfall appears; an inbox agent that
sends wants two things the grant does not have. The generator validates every scenario against
the vocabulary and refuses one that wants and refuses the same row; the zip and the README carry
them. All fifteen vaults were re-pushed.
Business functions, as a second axis. Access to the CRM, the customer-service desk, finance data: a policy for what the agent is for, whichever product holds the data, listed beside the target-specific policies as asked for.
Open source, said on every page. The GitHub link is in the header of every page and the licence line is in every footer: code Apache-2.0, pages and policies CC BY 4.0, with the Creative Commons mark, following open-source.sgit.ai↗ — the point of saying so is that anyone can take it, which is the pitch. A script adds it and CI checks it. The product marks on the tiles are the CC0 Simple Icons set, used to identify the product a policy is for.
Also. A brief, the policy is a graph, and every stakeholder gets a projection of it, turns the voice debrief of 15 September into a vault structure — behaviours as addressable nodes with outward links and metrics, edges per path rather than per row, views per audience, and the prompt and script shipped with every projection so a customer can regenerate it — and a build order.