# The lens: mandate, grant and delta

> GAMMA-Ray v0.0.3 (beta, for review; every rating is experimental). How RiskMandate's measurement sits in GAMMA-Ray. The questions measure what is said about an agent; the grant measures what its permissions let it do; the delta is the difference.
> Page: https://gamma-ray.sgit.ai/lens/ · Source: content/lens/index.md


RiskMandate is not one of the instruments GAMMA-Ray maps. It is how GAMMA-Ray measures.

## Two halves

Most of what the questions ask is about what is **said**: what an agent is for, what its rules are, who answers for it, which controls it has. Those answers are true on paper. Some depend on context, and some are only an intention.

The other half is what the agent **can do**: the permissions it was actually given. That is a different kind of fact. It is measured on the deployment, capability by capability, and it changes when a token, a scope or a setting changes.

| RiskMandate's object | What it is | Where GAMMA-Ray gets it |
|---|---|---|
| **The mandate** | what the agent is authorised and expected to do | the questions, mostly at the Public and Declared tiers |
| **The grant** | everything the agent can do | a measured profile of the deployment, in the capability grammar below |
| **The delta** | excess where it can and nobody asked; shortfall where it was asked and cannot | derived from the two, never written by hand |
| **The barrier** | what stands between the agent and each capability | recorded per capability: nothing, a rule in prose, a setting, a boundary |

## How the grant changes a level

Two indicators are read from the grant whenever one has been measured, and not from anybody's description:

- **the grant is enumerated**: there is a profile;
- **it is bounded**: every capability that cannot be undone sits behind a boundary.

Both are needed for governance level 3, and neither can be met by a description. "Bounded" has a scope: **every capability in the grant whose effect cannot be undone** has to sit behind a boundary. A proxy on the network does not bound a push to a repository.

The grant also writes the top of the work order: a capability the mandate refuses that is in the grant anyway comes first, then the capabilities that cannot be undone and are not bounded.

Beyond that, the grant is **counted and shown, never scored**: how many capabilities, how many behind a boundary, and, where a mandate is written, how many in excess.

## The capability grammar

23 capabilities, each a verb, an object and a reach. Copied from the Agent Behaviour Policy project's published vocabulary ([abp.sgit.ai](https://abp.sgit.ai/data/index.json), version v0.12.1, CC BY 4.0), not adapted.

| Capability | What it is | Reach | Undo |
|---|---|---|---|
| `read.file.project` | Read the project it is working on | project | yes |
| `write.file.project` | Change the project it is working on | project | with-effort |
| `read.file.host` | Read any file the account can reach | host | no |
| `write.file.host` | Change any file the account can reach | host | with-effort |
| `delete.file.host` | Delete files anywhere the account can reach | host | no |
| `execute.process.host` | Run programs as the account | host | with-effort |
| `execute.process.self` | Run programs inside its own sandbox only | self | yes |
| `send.endpoint.allowed` | Reach a permitted list of hosts | tenant | no |
| `send.endpoint.world` | Reach any host on the internet | world | no |
| `read.credential.host` | Read credentials stored where it runs | host | no |
| `authenticate-as.credential.tenant` | Act in accounts with the credentials it holds | tenant | no |
| `grant.credential.self` | Change its own permission settings | self | yes |
| `send.message.world` | Send a message to anyone | world | no |
| `read.message.tenant` | Read mail or chat it is connected to | tenant | no |
| `write.repository.project` | Commit to the repository it was pointed at | project | with-effort |
| `write.repository.tenant` | Push to a code host (any branch it can reach) | tenant | with-effort |
| `authenticate-as.credential.signing` | Sign commits with the key it holds | tenant | no |
| `create.record.world` | Publish packages, images or pages under the name it holds | world | no |
| `write.budget.tenant` | Spend money or tokens against an account it holds | tenant | no |
| `create.schedule.host` | Create something that outlives the turn where it runs (a cron, a service) | host | yes |
| `read.record.history` | Read a retained record: shell history, past sessions | host | no |
| `create.schedule.tenant` | Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session) | tenant | yes |
| `read.record.browsing` | Read every page you visit | host | no |

## The barriers

| Barrier | What stands in the way | A control? |
|---|---|---|
| none | nothing in the way | no |
| expectation | a rule in prose, enforced by nobody | no |
| setting | a switch the agent's own account can flip | no |
| boundary | enforced above the grant, out of the agent's reach | yes |

The test, in the project's words: "A control bounds a grant only if it is enforced by something the grant does not include."

## How an answer is known

Every answer and every grant row carries a grade, in the same project's vocabulary, weakest first:

| Grade | How it is known |
|---|---|
| derived | from what the thing architecturally is; a claim until somebody runs the probes |
| inferred | from another row or another profile, by reasoning rather than by observation |
| self-reported | reported by the operator, the harness or the tool itself, without an independent probe |
| documented | the vendor, or a published tool, says so |
| measured | a probe run on an instance, dated, with an evidence file |
| observed | seen directly, on the thing itself, by the thing itself |

## The questions that belong to the lens

6 indicators ask directly for one of RiskMandate's objects:

- `I20` Its purpose and permitted tasks are stated in writing: the mandate.
- `I23` What it can reach is enumerated: scopes, permissions, tools: the grant.
- `I45` A limit on it is enforced by something outside its own reach: a barrier of the kind boundary.
- `I46` A limit on it is a setting that its own account could change: a barrier of the kind setting.
- `I47` A limit on it is a rule in prose: a barrier of the kind expectation.
- `I49` The difference between what it can reach and what it is for is stated: the delta.

## Limits

- A grant profile describes a deployment shape. Its publisher states that it is not an assessment, an audit or a review of any named product and carries no score. GAMMA-Ray counts its rows and says where they came from; the levels are GAMMA-Ray's own.
- Of the 5 scans here, not all have a measured grant, and only one has a published mandate to compute a delta against.