## An introduction to the Agent Behaviour Policy

The [Writing](articles.html) section had one article and no front door. The second one is the front
door: [*Somebody will ask what your agent can do. You need an answer they can
check.*](article-what-is-an-abp.html)

It starts where the reader is rather than where the model is. Somebody senior asks what the agent
you just connected can actually do, and there are three answers in circulation. *It drafts replies
and summarises threads* — the product description, from a tile that also lists `forward`,
`create_filter` and `mark_message_spam` among its tools, on the same page, read the same day. *It
has read access to the mailbox* — the name of the credential, when the consent screen carried three
lines and the third one sends. *It only does what we tell it* — the reassurance, which describes the
mandate and says nothing about the grant. None of the three is a lie. They are answers to a question
nobody asked precisely.

Then the model, in the order it is produced: the mandate elicited, the grant measured, the delta
derived, the barrier recorded. The twenty-three primitives, because if every policy invents its own
words then no two can be read side by side. The four barriers and the one test that separates a
control from a rule in prose. Why there is no score anywhere, including in the data.

**The second half is one deployment worked all the way through** — Claude with the Gmail connector,
six capabilities, one wanted, four with nothing in the way, four of the six measured on an account
the deployer runs. Six open questions listed with how each would be settled, five places where the
two vendors' own pages contradict each other and are published unresolved, and four things it cannot
do, each naming what withholds it. Every number on the page links to the record it came from, which
is the article's argument about its own claims as much as about the agent.

**Small repairs.** The rule panels on both articles were rendering their links in the browser's
default blue; they now use the site's green like every other link. A *can not* became a *cannot*.

**And the check that should have caught it.** The v1.27.0 push went red on CI for a file this
release had no business breaking: `paid-t1.html` carries every template's zip size and sha256,
stamped into the page, and the barrier-holder work changed every zip. The stamp was stale and
`npm run check` did not notice, because it ran five of CI's seven checkers and not the two that
would have. It now runs all of them — the vault builds and the generated pages included — and the
new checker was proven to bite by putting a wrong hash in the page and watching the run fail.

**Not changed.** The five queued articles on the index are still marked *not written*, and they are.