# authorised/ — what you authorised and never asked for

A self-assessment that runs in the browser. It reads the public profiles under `../probes/profiles/`, takes your answers locally, renders the gap between grant and mandate with the irreversible rows first and the reduction on the same screen, and shows the counts-only tuple a submission would contain — without a button that sends it.

## The precedents, and what transferred

Six free assessment services were read on 4 September (brief v0.33.64, the research brief): a network-exposure probe, a transport-security grader, an HTTP-header grader, a website observatory, a breach lookup, and a repository-health scorer. What they share is more consistent than their subjects, and this page copies it where it transfers:

| Property | Here |
|---|---|
| One small input, verdict first, evidence below | Name your tools; the verdict is one line; the rows are under it |
| No account for the basic case | None, and no storage beyond your own browser |
| A shareable result, pleasant when the news is good | The one-liner says "small gap" when it is |
| Published scoring rules | There is no score: the verdict is a count, and the arithmetic is `app.js` |
| A sized ladder rather than a feature matrix | Free through level three; paid is your estate modelled; independence is what costs |
| Structured findings under the verdict | `findings/v1` (Scorecard's probe/finding, plus reversibility and tier) |
| Probing the visitor from a server | **Does not transfer.** There is nothing to probe from outside |
| A letter grade | **Does not transfer.** Nobody has calibrated a scale, so the verdict is a statement |

## Names

- **excess authority** — grant minus mandate; the technical term, in the schemas, settled by the registry pack.
- **"what you authorised and never asked for"** — the public phrase, a sentence, used consistently. Not a coined noun: every clean candidate tested was obscure and every familiar one collided (*blast radius* is the consequence; *unaccepted* is a risk nobody signed; *unauthorised* is wrong on the first word, because the grant is exactly what was authorised).
- **surprise** — an action outside the grant. A measurement failure, and the assessment's validity test. Never the player's feeling; that is the game's **prediction gap**.

## Does not prove

Anything about the visitor's actual environment; that the gap is a loss; that the coarse questionnaire is the mandate; calibration. The site cannot scan anybody, and says so where somebody would expect otherwise.