## The behaviour-policy library: one page, two views, a preview panel, scenarios, and a top-level place on the site

**A top-level page, and a name a stranger recognises.** The directory of vaults was a list of
fifteen white tiles with two-letter glyphs under *Live demos*, and the tiles did nothing when
clicked. It is now [Behaviour policies](agent-behaviour-policy.html), a top-level menu item at
`/agent-behaviour-policy` (`/abp/` and the old `abp-vaults.html` redirect to it), and it is
framed as what it is: the library of template policies — the building blocks a real
deployment's policy is made of. One per target application, and one per business function.

**Two views of one set.** A grid of tiles with the product's own mark, and a list with the four
counts aligned and sorted by what is unbounded; a toggle top right, and the same search and
filters over both. Search matches names, vendors, OAuth scopes and permissions, tool names and
the 23 capability ids, so `send.message.world` finds every policy that can send mail whatever
the product calls it. A *by behaviour* facet lists the 23 with their glosses, so one click
answers *which policies can delete files* — the first visible edge of the graph the debrief of
15 September describes (the brief is in `docs/briefs/`).

**A preview panel, for demos.** Click a tile or a row and the policy appears on the right
without leaving the page: the card, the grant against the mandate row by row with its barrier
and its status, the four counts and the shortfall, two buttons — the policy page, the vault
opened read-only with its public key — and the key itself one tap away. On a phone it is a
sheet. A link with `#policy=<slug>` opens the page on that policy.

**Scenarios: the mandate changes, the grant never does.** Every vault now carries six
scenarios in `data/scenarios.json`, three normal and three advanced, each a deployer's sentence
and the primitives it wants and refuses. The panel recomputes the delta as you click: a morning
digest wants a schedule the scope does not grant, so shortfall appears; an inbox agent that
sends wants two things the grant does not have. The generator validates every scenario against
the vocabulary and refuses one that wants and refuses the same row; the zip and the README carry
them. All fifteen vaults were re-pushed.

**Business functions, as a second axis.** Access to the CRM, the customer-service desk, finance
data: a policy for what the agent is *for*, whichever product holds the data, listed beside the
target-specific policies as asked for.

**Open source, said on every page.** The GitHub link is in the header of every page and the
licence line is in every footer: code Apache-2.0, pages and policies CC BY 4.0, with the
Creative Commons mark, following [open-source.sgit.ai](https://open-source.sgit.ai/) — the
point of saying so is that anyone can take it, which is the pitch. A script adds it and CI
checks it. The product marks on the tiles are the CC0 Simple Icons set, used to identify the
product a policy is for.

**Also.** A brief, *the policy is a graph, and every stakeholder gets a projection of it*, turns
the voice debrief of 15 September into a vault structure — behaviours as addressable nodes with
outward links and metrics, edges per path rather than per row, views per audience, and the prompt
and script shipped with every projection so a customer can regenerate it — and a build order.