Studio experiment E09 · the explainer

Mandate against grant, frame by frame

The one sentence: an Agent Behaviour Policy writes down, for one agent in one deployment, what it is for (the mandate), what it can actually do (the grant), the gap between them (the delta), and what stands in the way of each thing in the gap (the barrier). Part one ended on E02's blast radius; E09 names its rings.

The frames (v1)

Seconds from the start; it ends at 54 s and holds still. The line under the headline gives the source's own definition of the object being built.

From	What is on screen
0 s	The definition of an Agent Behaviour Policy, in RiskMandate's words, and the example: Claude Code on your own machine, confirmations on.
2 s	The mandate: a ring at the centre, its four granted items numbered 1 to 4 and listed. The model says a mandate is elicited; this one is the site's own first draft, not elicited from a deployer: the line under the headline says so, and the list heading reads "elicited (here, the site's own draft)" (deck's review; changed in run r12-e02-v3).
12 s	The grant: two more rings, unstated and refused, and twelve more numbered dots, faint until the delta; the heading says the model measures the grant and this example derives it (0 of 22 rows measured), and the line under the headline gives what "host" means in this example.
22 s	The delta, derived: the twelve outside the mandate light in the agent colour and are listed 5 to 16 in the source's words; excess 12, shortfall 1: the fifth mandate item, asked and not granted (`send.endpoint.allowed`), appears as a dashed dot, since the shortfall is part of the derived delta.
32 s	The barrier on every row, one after another: abp.sgit.ai's shapes (filled for nothing, double circle for a rule in prose, half filled for a switch the agent's own account can flip, an empty circle for a boundary), with the key in the source's own meanings, the enforcer test in the source's words, and the count: 12 of 12 excess with no control. No row has a boundary, and the key says so.
42 s	The chat example beside it, in one line: mandate 1, grant 1, excess 0. The line under the headline gives the no-rating rule and the caution about published drafts.

The sixteen rows, in the slide's numbering

Each label is the source's (capabilities.json); the slide drops a bracketed aside at the end of two labels, rows 6 and 15 ("(any branch it can reach)", "(a cron, a service)"), for width. The reach is this example's own where the file gives one; for rows 1, 2, 4 and 16 the file gives none for this example, so the general meaning of the reach is shown.

#	Capability	Where it sits	Reach (this example's, else general)	Barrier
1	Change the project it is working on `write.file.project`	mandate, granted	the working tree or workspace it was pointed at	none: nothing
2	Commit to the repository it was pointed at `write.repository.project`	mandate, granted	the working tree or workspace it was pointed at	none: nothing
3	Run programs as the account `execute.process.host`	mandate, granted	your machine, as your user account	setting: the tool's own directory restriction and its confirmation prompt, enforced by the tool, which runs inside the grant; anything that can execute as you steps around it
4	Read the project it is working on `read.file.project`	mandate, granted	the working tree or workspace it was pointed at	none: nothing
5	Reach any host on the internet `send.endpoint.world`	excess, unstated	the internet	none: nothing
6	Push to a code host (any branch it can reach) `write.repository.tenant`	excess, unstated	your accounts, with the credentials in your home directory	expectation: branch discipline in prose, if any
7	Sign commits with the key it holds `authenticate-as.credential.signing`	excess, refused	your accounts, with the credentials in your home directory	none: nothing
8	Act in accounts with the credentials it holds `authenticate-as.credential.tenant`	excess, refused	your accounts, with the credentials in your home directory	none: nothing
9	Publish packages, images or pages under the name it holds `create.record.world`	excess, refused	the internet	none: nothing
10	Delete files anywhere the account can reach `delete.file.host`	excess, refused	your machine, as your user account	none: nothing
11	Read credentials stored where it runs `read.credential.host`	excess, refused	your machine, as your user account	none: nothing
12	Read any file the account can reach `read.file.host`	excess, refused	your machine, as your user account	none: nothing
13	Read a retained record: shell history, past sessions `read.record.history`	excess, refused	your machine, as your user account	none: nothing
14	Change any file the account can reach `write.file.host`	excess, refused	your machine, as your user account	none: nothing
15	Create something that outlives the turn where it runs (a cron, a service) `create.schedule.host`	excess, refused	your machine, as your user account	none: nothing
16	Change its own permission settings `grant.credential.self`	excess, refused	the agent's own process, sandbox or turn	setting: the settings file is owned by the same account

And the shortfall: send.endpoint.allowed, in the mandate and not in the grant. The capabilities file gives it no label, so the slide shows its id.

Where every word comes from

The definitions are the data file's: the policy, the mandate, the grant and the delta as RiskMandate words them, the enforcer test and the no-rating rule as quoted. The slide adds one line of its own, from the data file's own caution: this mandate is the site's own first draft, not elicited from a deployer.
The numbers are the example's fields: mandate 5, aligned 4, grant 16, excess 12, shortfall 1, unbounded excess 12, 0 of 22 rows measured; chat 1, 1, 0. The barrier counts are counted from the rows.
Measured in the model, derived here. The source calls the grant measured; this example's rows are derived from what a CLI running as your account is. The slide says both, so nothing derived is shown as measured.
The same id means different things per example. The slide shows Claude Code's own reach for "host" (your machine, as your user account), as the researcher's caution asks; the other reaches (your accounts, the internet) are in the table above, not on the slide, for space.
0 of 22. The count of rows measured is of tool-level rows (the 16 capabilities over the tools that reach them), which is why it is 22, not 16; the slide says "tool-level rows".
No rating. There is no score, colour of risk or traffic light; the agent colour marks only what is outside the mandate.

Technique

One slide on the engine, driven: SVG and list built once from the two data files, then every frame drawn from the slide's clock by SLIDE_RENDER, so the player can seek, pause and replay it, and ?static shows the whole policy.
Colour carries one meaning, the agent red, for the excess; the heading colour for the mandate. Every text is 20 px or larger on the 1280 by 720 canvas.
It runs only over HTTP. The slide reads both files with fetch when it loads; opened as a file from disk it shows only the headline.

What was tried and left out

The chat example as a second picture. A second ring set beside the first left no room for the sixteen rows in plain words; v1 gives the chat example one line and its one-dot shape.
The other three examples (confirmations off, the browser extension, the CI runner): left for E13, the small multiples.
A word per row on the ring. Sixteen labels at 20 px do not fit round a circle; the dots are numbered and the list carries the words, as in E02 v2.

How it was made

v1 in ruv.sgit run r10-e09-mandate-and-grant: a Ruflo hive with a builder and an editor who checked the slide and this page against the request and the data, and one sgit vault holding the request, each worker's branch and the history. Its row is in the ledger.