The map — what each agent can reach
23 capabilities across 9 products and setups: what each one can reach, what stands in the way, and how sure anyone is. Generated from the data pack; change it with a pull request.
Source: https://what-can-it-do.games.sgit.ai/map/index.html↗ · site v0.8.0 · this file is generated from the same content
as the page, so the two cannot drift. Every page on this site has a .md twin; internal links
below point at them.
What each agent can reach
Every question the game asks is a cell in this table. 23 capabilities — a verb, an object and how far it reaches — against 9 products in the setups people actually run them in. The fill says how open the door is; the glyph says the same thing without the colour.
9** products × setups · **23 capabilities · 13 of them cannot be undone · 21/99 rows measured, not derived
Legend: ● none — nothing in the way · ◉ expectation — a rule in prose, enforced by nobody · ◐ setting — a switch the agent's own account can flip · ○ boundary — enforced above the grant, out of the agent's reach · · not in this grant
| Capability | Undo | Claude Code (web container) | Claude Code (local · confirm off) | Claude Code (local · confirm on) | Claude Desktop (local tools) | Claude.ai (connectors on) | Browser extension (all sites) | Scheduled job (service account) | GitHub Actions (hosted runner) | ChatGPT (no connectors) |
|---|---|---|---|---|---|---|---|---|---|---|
| filesystem — files and directories | ||||||||||
Read the project it is working on read.file.project | yes | ● | ● | ● | ● | ● | · | · | ● | ● |
Change the project it is working on write.file.project | with-effort | ● | ● | ● | ● | · | · | · | ● | · |
Read any file the account can reach read.file.host | no | ● | ● | ● | ◐ | ○ | · | ● | ● | · |
Change any file the account can reach write.file.host | with-effort | ● | ● | ● | ◐ | · | · | ● | ● | · |
Delete files anywhere the account can reach delete.file.host | no | ● | ● | ● | · | · | · | · | ● | · |
Read a retained record: shell history, past sessions read.record.history | no | ● | ● | ● | ● | · | · | · | · | · |
| process — programs and their execution | ||||||||||
Run programs as the account execute.process.host | with-effort | ● | ● | ◐ | ◐ | · | · | ● | ● | · |
Run programs inside its own sandbox only execute.process.self | yes | · | · | · | · | · | · | · | · | · |
| network — endpoints and hosts | ||||||||||
Reach a permitted list of hosts send.endpoint.allowed | no | ○ | · | · | · | · | · | · | · | · |
Reach any host on the internet send.endpoint.world | no | · | ● | ● | ● | · | ● | ● | ● | · |
| identity — credentials and who the agent can act as | ||||||||||
Read credentials stored where it runs read.credential.host | no | ● | ● | ● | ● | · | · | · | · | · |
Act in accounts with the credentials it holds authenticate-as.credential.tenant | no | ○ | ● | ● | ● | ○ | ◐ | ● | · | · |
Change its own permission settings grant.credential.self | yes | · | ◐ | ◐ | ◐ | · | · | · | · | · |
| communication — messages to people | ||||||||||
Send a message to anyone send.message.world | no | · | · | · | · | · | · | · | · | · |
Read mail or chat it is connected to read.message.tenant | no | · | · | · | · | ○ | · | · | · | · |
| code — repositories and what lands in them | ||||||||||
Commit to the repository it was pointed at write.repository.project | with-effort | ● | ● | ● | · | · | · | · | ○ | · |
Push to a code host (any branch it can reach) write.repository.tenant | with-effort | ◐ | ◉ | ◉ | · | ○ | · | · | · | · |
Sign commits with the key it holds authenticate-as.credential.signing | no | ● | ● | ● | · | · | · | · | · | · |
Publish packages, images or pages under the name it holds create.record.world | no | · | ● | ● | · | · | · | · | · | · |
| money — budgets and spend | ||||||||||
Spend money or tokens against an account it holds write.budget.tenant | no | · | · | · | · | · | · | ● | · | · |
| schedule — things that outlive the turn | ||||||||||
Create something that outlives the turn where it runs (a cron, a service) create.schedule.host | yes | ○ | ● | ● | · | · | · | ● | · | · |
Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session) create.schedule.tenant | yes | ◐ | · | · | · | · | · | · | · | · |
| browser — what a browser extension or automation can see and do in your browser | ||||||||||
Read every page you visit read.record.browsing | no | · | · | · | · | · | ● | · | · | · |
How to read it
- A filled cell means the agent can. What the fill shade adds is what stands between it and the capability: nothing (●), a rule somebody wrote down (◉), a setting the agent's own account could change (◐), or a boundary enforced above it that it cannot reach (○). Darker is more open.
- Hover a cell for the control, the evidence tier and the tool that reaches it. Click it for the row on that product's page.
- The Undo column is the row's weight. A capability that cannot be undone — read a credential, send a message, delete at host reach — is a different kind of thing from one that can, however many cells it fills. The game's levels are built on that.
- Host, tenant and world mean what the profile says they mean. For an agent in a vendor's container, host is the container and tenant is a scoped token — not your machine and not your accounts. Each product's page names its reaches.
How sure is any of this
Not very, in most places, and every row says so. Of 99 tool-capability rows across the set, 21 were measured — a probe run on an instance, dated — and the rest are derived from what a thing architecturally is, or documented by the vendor. A derived row is a claim until somebody runs the probes and contributes the file, and the honest reading of this table is mostly claims, structured so that each one can be replaced by a measurement.
That is what the pull request is for. How to contribute↗ — a row, a whole profile, a mandate, or a correction.
The rest of the map
Every product, one page each — Tool by tool: what it reaches, the control on the path, the evidence, what the profile says is out of reach and why, and the reductions that narrow it. The products↗
The capabilities — The 23 primitives the questions are built from — which products grant each, what narrows it, which questions ask about it, and which mandates want it. The capabilities↗
Mandates, and the deltas — What a reasonable person wanted, per setup — and the gap against what was actually granted, as a matrix: excess in one colour, shortfall in the other. The mandates↗ · The deltas↗
Above the ceiling — The 17 things no agent in this set can do, each naming the control outside the agent that stops it. The ceiling↗
The questions — 25 questions the games ask, with what each one is for — the seed of a question pack that could be customised. The questions↗
The data pack — All of it as JSON, at a stable URL with CORS, which is how the game reads it. Fork it, change it, point the game at yours. The pack↗ · Contribute↗