The lens: mandate, grant, delta

RiskMandate is not one of the instruments GAMMA-Ray maps. It is how GAMMA-Ray measures.

Two halves

Most of what the questions ask is about what is said: what an agent is for, what its rules are, who answers for it, which controls it has. Those answers are true on paper. Some depend on context, and some are only an intention.

The other half is what the agent can do: the permissions it was actually given. That is a different kind of fact. It is measured on the deployment, capability by capability, and it changes when a token, a scope or a setting changes.

RiskMandate's object	What it is	Where GAMMA-Ray gets it
The mandate	what the agent is authorised and expected to do	the questions, mostly at the Public and Declared tiers
The grant	everything the agent can do	a measured profile of the deployment, in the capability grammar below
The delta	excess where it can and nobody asked; shortfall where it was asked and cannot	derived from the two, never written by hand
The barrier	what stands between the agent and each capability	recorded per capability: nothing, a rule in prose, a setting, a boundary

How the grant changes a level

Two indicators are read from the grant whenever one has been measured, and not from anybody's description:

the grant is enumerated: there is a profile;
a limit is enforced outside the agent's own reach: at least one capability sits behind a boundary.

Both are needed for governance level 3. So a deployment that says it is controlled but whose measured grant shows no boundary does not reach it, and one that says little but is measurably bounded can. Beyond that, the grant is counted and shown, never scored: how many capabilities, how many behind a boundary, and, where a mandate is written, how many in excess.

This is a first rule and a narrow one. How much more of the ladder should be read from the grant is open.

The capability grammar

23 capabilities, each a verb, an object and a reach. Copied from the Agent Behaviour Policy project's published vocabulary (abp.sgit.ai, version v0.12.1, CC BY 4.0), not adapted.

Capability	What it is	Reach	Undo
`read.file.project`	Read the project it is working on	project	yes
`write.file.project`	Change the project it is working on	project	with-effort
`read.file.host`	Read any file the account can reach	host	no
`write.file.host`	Change any file the account can reach	host	with-effort
`delete.file.host`	Delete files anywhere the account can reach	host	no
`execute.process.host`	Run programs as the account	host	with-effort
`execute.process.self`	Run programs inside its own sandbox only	self	yes
`send.endpoint.allowed`	Reach a permitted list of hosts	tenant	no
`send.endpoint.world`	Reach any host on the internet	world	no
`read.credential.host`	Read credentials stored where it runs	host	no
`authenticate-as.credential.tenant`	Act in accounts with the credentials it holds	tenant	no
`grant.credential.self`	Change its own permission settings	self	yes
`send.message.world`	Send a message to anyone	world	no
`read.message.tenant`	Read mail or chat it is connected to	tenant	no
`write.repository.project`	Commit to the repository it was pointed at	project	with-effort
`write.repository.tenant`	Push to a code host (any branch it can reach)	tenant	with-effort
`authenticate-as.credential.signing`	Sign commits with the key it holds	tenant	no
`create.record.world`	Publish packages, images or pages under the name it holds	world	no
`write.budget.tenant`	Spend money or tokens against an account it holds	tenant	no
`create.schedule.host`	Create something that outlives the turn where it runs (a cron, a service)	host	yes
`read.record.history`	Read a retained record: shell history, past sessions	host	no
`create.schedule.tenant`	Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session)	tenant	yes
`read.record.browsing`	Read every page you visit	host	no

The barriers

Barrier	What stands in the way	A control?
none	nothing in the way	no
expectation	a rule in prose, enforced by nobody	no
setting	a switch the agent's own account can flip	no
boundary	enforced above the grant, out of the agent's reach	yes

The test, in the project's words: "A control bounds a grant only if it is enforced by something the grant does not include."

How an answer is known

Every answer and every grant row carries a grade, in the same project's vocabulary, weakest first:

Grade	How it is known
derived	from what the thing architecturally is; a claim until somebody runs the probes
inferred	from another row or another profile, by reasoning rather than by observation
self-reported	reported by the operator, the harness or the tool itself, without an independent probe
documented	the vendor, or a published tool, says so
measured	a probe run on an instance, dated, with an evidence file
observed	seen directly, on the thing itself, by the thing itself

The questions that belong to the lens

6 indicators ask directly for one of RiskMandate's objects:

I20 Its purpose and permitted tasks are stated in writing: the mandate.
I23 What it can reach is enumerated: scopes, permissions, tools: the grant.
I45 A limit on it is enforced by something outside its own reach: a barrier of the kind boundary.
I46 A limit on it is a setting that its own account could change: a barrier of the kind setting.
I47 A limit on it is a rule in prose: a barrier of the kind expectation.
I49 The difference between what it can reach and what it is for is stated: the delta.

Limits

A grant profile describes a deployment shape. Its publisher states that it is not an assessment, an audit or a review of any named product and carries no score. GAMMA-Ray counts its rows and says where they came from; the levels are GAMMA-Ray's own.
Of the 5 scans here, not all have a measured grant, and only one has a published mandate to compute a delta against.