# The Grant And Mandate Repo Ships Probes Rather Than Tables: A Grant Claim Travels With The Command That Establishes It So A Challenge Is A Rerun Rather Than An Argument, Grants Are Measured Per Tool And Contributed Publicly While Mandates Are Elicited Locally And Never Leave, And An Incident Is Evidence That Demotes A Control Rather Than A Story About One

**version** v0.33.64
**date** 4 September 2026
**from** Human (project lead)
**to** Engineering, Product, Ambassador

**type** Dev brief

*Fifth of 4 September. The memo asks for a public repository of grant and mandate primitives that anybody can fork, contribute to, challenge, and point an agent at for immediate value, and it asks for the workflow to be mapped. The seed profile in the middle of this brief was produced rather than described: this container was probed on 4 September against a draft primitive set, and the results are what the first row of the repository would contain. Limitation: one profile, probed by the thing being profiled, which is the weakest evidence tier in the model below and is exactly why the probe rather than the claim is what the repository ships.*

---

## What This Is

A specification for a public repository of capability primitives and measured grants: **the memo's request is a repository people fork, contribute to and argue with, and the design decision that makes it work rather than becoming another wiki of opinions is that a grant claim never travels alone, it travels with the probe that establishes it, so a disagreement becomes somebody running the same command on their own setup and reporting a different result rather than two people asserting different tables at each other; the primitive is not a flat list of capability names because that collapses immediately into a rabbit hole, it is a verb crossed with an object class crossed with a reach, held at a stated altitude so that reading a file and deleting a directory tree are different primitives while every specific path is an instance rather than a new one, and each primitive carries whether its effect is reversible, because this corpus has already settled that recoverability decides insurability and it is the property that separates a nuisance from a loss; the unit of mapping is a tool rather than a product, which was measured yesterday and holds here, since two tools in one session reached different sets of hosts and neither set was the session's, so a profile is a named configuration of a product listing its tools and each tool's own grant, which is what lets the repository hold a coding assistant on the web, the same assistant locally, and the same assistant with its confirmations turned off as three profiles that share most of their rows and differ in the ones that matter; grants are public and mandates are not, and that asymmetry is the whole adoption argument, because a grant is a fact about a vendor's product that many people can measure and contribute, while a mandate is what one organisation expected of one agent and belongs to them, so the repository ships grants and probes and templates, the fork elicits the mandate locally through an agent asking questions, and the delta is computed in the clone and never uploaded; an incident is a first-class evidence type rather than an anecdote, because an incident that bypassed a guardrail is evidence about that guardrail's strength and demotes the claimed evidence mode from enforced to attempted, which is the mechanism by which the repository gets more honest over time rather than more confident; the choice of a public code host over the estate's usual encrypted vault is deliberate and has a reason rather than a preference, since a vault publishes read keys and never write keys, and what this needs is exactly what a vault refuses, namely strangers proposing changes; and the hypothesis the memo wants tested, that the delta is enormous for almost everybody, is stated as falsifiable with a submission format nobody is obliged to use.** New contributions: **the probe as the unit of contribution, the verb-object-reach primitive with reversibility, the profile as a set of tools rather than a product, the public-grant private-mandate split, incidents as demoting evidence, the reason a code host rather than a vault, and a seed profile measured here.**

## The One Design Decision: Probes, Not Tables

A table of what a product can do is an opinion. Somebody disagrees, edits it, and the repository accumulates positions rather than knowledge.

**So the unit of contribution is a probe: a short reproducible command, what it establishes, and how to read what comes back.** A grant claim in the repository points at the probe that produced it, the date, the environment, and the output. A challenge is then a probe run with a different result, which is a fact rather than a view, and the repository holds both with their environments beside them.

Three consequences.

**A disagreement resolves or it localises.** Either the challenger's setup differs, which is itself the finding and becomes a new profile, or the original was wrong and the row changes with a run behind it.

**Not everything is probeable, and the model must say so.** Some grants can only be read from documentation and some can only be inferred, which is the same evidence-tier problem the conformance work has already solved, so the repository reuses that vocabulary rather than inventing one.

**And a probe is contributable by somebody who knows nothing about the model.** Writing a five-line command that shows whether a tool can reach the internet is a lower barrier than agreeing with an ontology, which is what makes drive-by contribution plausible.

## The Primitive

A capability is a triple, held at a stated altitude so that it does not fragment.

```
   capability = verb  x  object class  x  reach          + reversible?
```

| Part | Values, as a starting set |
|---|---|
| **verb** | read, write, create, delete, execute, send, receive, authenticate-as, grant, revoke |
| **object class** | file, process, network endpoint, credential, message, record, repository, budget, schedule |
| **reach** | self, project, host, tenant, world |
| **reversible** | yes, with effort, no |

`delete x file x host x irreversible` is a different primitive from `read x file x host x reversible`, and both are different from `send x message x world x irreversible`. **A specific path, host or mailbox is an instance of a primitive rather than a new one**, which is the rule that keeps the set finite. If a proposed primitive is a specific thing, it is an instance; if it is a new verb or a new reach, it is a primitive and needs a probe.

**Reversibility is on the primitive and not on the instance**, because it is what decides whether a gap is a nuisance or a loss, and the corpus has already established that it decides insurability. A grant containing irreversible primitives is a different object from one that does not, however many rows each has.

Primitives group into **families**, which is the estate's own word for what the memo calls sense of gravity: filesystem, network, identity and credentials, communication, code and repository, money and budget, time and scheduling. A family is where a reader starts and a primitive is where a claim lands.

One naming note. This corpus already uses **measurable primitives** for the counters a policy can be written in, which are meters. These are capabilities. **Call them capability primitives** wherever both could be meant, and never just primitives in a document that touches both.

## The Unit Of Mapping Is A Tool, Not A Product

Measured yesterday and it holds: two tools inside one session reached different sets of hosts, with a union of seven and an intersection of one, and neither set was the session's. So a claim about what a product can do is unanswerable unless it names the tool.

```
   profile  = a named configuration of a product
              -> tools[]      each with its own grant
              -> grant        the union, which is what an operator actually carries
              -> intersection reported, because it is usually nearly empty
```

That structure is what lets the repository hold the memo's examples as siblings: the same assistant on the web, locally, and with confirmations disabled become three profiles sharing most rows and differing in a few, and the diff between two profiles is the answer to "what does turning that on actually give it".

## Grants Are Public, Mandates Are Private

The asymmetry is the adoption argument and it should be stated on the front page.

| | Grant | Mandate |
|---|---|---|
| What it is | What a tool can do | What this organisation expected this agent to do |
| Who can establish it | Anybody with the product, by probe | Only the operator |
| Where it lives | **In the repository, public, contributed, challenged** | **In your fork, local, gitignored, never uploaded** |
| How it is produced | Probes and documentation | An agent asking questions |
| What it is worth to others | A great deal, because measuring is work | Nothing, and it is nobody's business |

**Nothing about your estate leaves your clone.** The delta is computed locally from a public grant and a private mandate, and the only things that can flow back are a probe result, a profile correction, or an incident, each of which is a fact about a vendor's product rather than about you.

That is also the answer to the memo's question about immediate value: a fork gives you a measured grant for the tools you already use before you have written anything, and the questions produce the other half.

## Incidents Demote Controls

The memo's sharpest point, and it deserves to be a type rather than a folder of stories.

> A guardrail that an incident bypassed is not the guardrail it was claimed to be. **The incident is evidence about the control's strength, and its effect is to demote the claimed evidence mode.**

That maps onto the ladder settled yesterday. A control claimed as enforced inline, which an incident shows was bypassed, was not enforced from outside the actor's reach, so it drops a rung. The demotion is the contribution: an incident record names the profile, the capability, the control that was claimed, and the rung it demotes it to, with a link to the public account.

**This is how the repository gets more honest over time rather than more confident**, which is the opposite of how most shared knowledge bases age.

## Why A Code Host Rather Than A Vault

This estate is vault-first and this is not a vault. The reason is architectural rather than a preference.

**A vault publishes read keys and never write keys.** That is a settled rule here and a good one. What this project needs is precisely what that rule forbids: strangers proposing changes, in the open, with a thread attached to each proposal and a history of who argued what.

| Need | Vault | Code host |
|---|---|---|
| Public read | Yes, with a read key | Yes |
| Strangers proposing changes | **No, by design** | Yes |
| Threaded challenge on one row | No | Yes |
| Fork as a template | Awkward | The core motion |
| Private local work | Yes | Yes, gitignored |
| Contents encrypted at rest from the host | Yes | No, and this content is public anyway |

The last row is the honest cost, and it is not a cost here because every grant, probe and incident in the repository is intended to be public. **The private half never enters it.**

## The Seed Profile, Measured

Produced in this container on 4 September against the draft primitive set, and offered as the repository's first row and as a demonstration of what a probe result looks like.

| Family | Capability | Reach | Reversible | Result | Probe |
|---|---|---|---|---|---|
| Filesystem | read, write, delete x file | **host** | delete: no | Root, passwordless sudo. Writing to system configuration succeeds | privilege and a write test outside the working tree |
| Process | execute x process | host | yes | 66 processes visible, two cpus | a process listing |
| Network, shell | send, receive x endpoint | **partial world** | yes | Four of six probed hosts answer: the package registries, the code host, the vault host. Two do not | six requests, statuses recorded |
| Network, second tool | send, receive x endpoint | **a different partial world** | yes | Reaches hosts the shell cannot | exercised across two days of use |
| Identity | authenticate-as x credential | project | yes | A cloud configuration file and a signing key are present; no user credentials, no code-host authentication | a listing of the usual credential locations |
| Code | write, execute x repository | project | with effort | A signing key is configured and commits are signed by default | the version control configuration |
| Schedule | create x schedule | self | yes | Nothing that outlives the turn was found | a check for the usual schedulers |

**Two rows are the interesting ones.** The two network rows are the same product with two different reaches, which is the per-tool finding stated as data rather than as an argument. And the filesystem row is irreversible at host reach, which under the model is the row that decides whether this profile is insurable for anything.

**And the honest weakness is the point.** Every one of those probes was run by the thing being profiled, which is the self-reported tier. The repository's own model says a probe run by an independent party on the same profile is stronger, and the repository should show both when it has them.

## The Workflow

The memo asks for this to be mapped. Six steps, and the value arrives at step three.

```
   1  fork or clone           you now hold every measured grant in the repository
   2  name your profiles      which of these products and configurations you actually use
   3  the grant appears       <- value arrives here, before you have written anything
   4  point an agent at it    it runs the probes it can, and asks the mandate questions
   5  the delta is computed   locally, in your clone, and rendered
   6  contribute back         a probe result, a profile correction, an incident. Never your mandate
```

**Step four is the elicitation and it is the part that needs writing carefully**, because the questions are the mandate. They should be about work rather than about capability: what is this agent for, what would surprise you if it did, what must never happen, who would you tell. A questionnaire that asks people to enumerate permissions gets a copy of the grant back.

**Step three is where the memo's immediate value claim is tested.** Anybody who forks the repository and names three products should see a grant they did not know they had, and if they do not, the repository is not yet worth forking.

## The Repository

```
   primitives/     verbs, object classes, reaches, families, and the capability set with reversibility
   profiles/       <vendor>/<product>/<variant>.json : tools, per-tool grants, union, intersection
   probes/         one file each: what it establishes, the command, how to read it, its tier
   evidence/       probe runs: profile, probe, date, environment, output hash, who ran it
   incidents/      what was bypassed, which capability, which control, which rung it demotes
   templates/      the mandate questionnaire, and the prompt an agent is pointed at
   yours/          gitignored. Your mandate, your delta, your notes
   schemas/  tests/
```

Two rules about the layout. **`yours/` is gitignored in the template and the readme says so twice**, because the failure mode of this whole design is somebody committing their mandate. And **every profile row points at an evidence file**, so a row with no evidence is visibly a claim rather than a measurement.

## Validating The Hypothesis

The memo's hypothesis is that the delta is enormous for almost everybody, and it deserves to be falsifiable.

The repository ships a submission format: a profile set, counts of grant and mandate capabilities by family, the count of irreversible capabilities outside the mandate, and nothing else. **No paths, no hosts, no names, and no obligation.** Submissions are pull requests, so anybody can see what was submitted and by whom, and the aggregate is computed in the open.

If the median delta comes back small, the hypothesis is wrong and that is worth knowing more than a confirmation would be.

## What This Must Not Do

- **Not accept a grant claim without a probe or a stated tier.** A row with neither is an opinion.
- **Not collect mandates.** Not by submission, not by telemetry, not by accident. `yours/` is gitignored and the readme says so twice.
- **Not let the primitive set grow by instance.** A specific path is an instance; only a new verb, object class or reach is a primitive.
- **Not treat an incident as an anecdote.** It names a capability, a control and a rung.
- **Not claim independence for a self-run probe.** The seed profile above was probed by the profile, and it says so.
- **Not become an ontology argument.** The primitives are a starting set and the probes are the contribution.

## What This Does Not Try To Be

- **Not a vulnerability database.** It maps what tools can do, not what is broken in them.
- **Not a vendor comparison.** Profiles differ by configuration far more than by vendor, and a league table would be read as the latter.
- **Not a compliance product.** It supplies a grant; the conformance layer is where controls and standards live.
- **Not authoritative.** Every row is a measurement by somebody, with their environment attached, and disagreement is the mechanism.
- **Not a replacement for the vault work.** Public, contributed, challengeable material belongs here; everything about a real estate belongs in a vault.

## Honest Tensions

| Tension | Note |
|---------|------|
| Probes rather than tables | It makes disagreement productive and it means a row without a probe cannot be added, which will slow early growth |
| Public grants, private mandates | It is the right split and it means the repository can never show anybody the thing they came to see, which is their own delta |
| A code host in a vault-first estate | The reason is that vaults refuse stranger writes, and it still means the flagship contribution surface is not our own product |
| Incidents as demoting evidence | It is the honest mechanism and it invites arguments with vendors about their own products |
| A fixed primitive set | It prevents the rabbit hole and it will be wrong at the edges from the first week |
| The seed profile is self-probed | It is what was available and it sits at the weakest tier the model has |

## Open Questions

| Question | Notes |
|----------|-------|
| Who arbitrates a contested row? | Two probe results with different environments are both true, and somebody has to decide when that is one profile or two |
| Does a probe need to be safe to run? | Some probes are destructive by nature, and the repository needs a marked class that is described rather than run |
| How are profiles versioned against product releases? | A grant measured in September is a claim about September, and products move faster than the repository will |
| What is the smallest useful primitive set? | The draft above has ten verbs, nine object classes and five reaches, and the honest answer is that it is too many until somebody uses it |
| Should the mandate questionnaire be a skill? | It is an elicitation and the estate already builds skills, and it would make step four one command |
| Can a vault and a repository be kept in step? | The private half wants vault properties and the public half wants a code host, and a bridge between them is a real design question |

## Relationship To Previous Briefs

| Date | Document | Relationship |
|---|---|---|
| 4 Sep | `v0.33.64__dev-brief__d003-measured-one-of-five-evidenced-two-unobservable-from-inside-one-vacuous-and-the-grant-is-per-tool.md` | The per-tool finding this makes the unit of mapping, and the container measured again here as the seed profile |
| 4 Sep | `v0.33.64__arch-brief__the-shipped-levels-ladder-blends-coverage-with-tier-and-evidence-mode-is-the-axis-that-decides-the-insurance-instrument.md` | The evidence-mode ladder that an incident demotes a control down |
| 4 Sep | `v0.33.64__dev-brief__the-conformance-layer-specified-and-shipped-the-same-day-two-edges-kept-apart-unevidenced-as-the-default-and-62-of-1126-crosswalks-resolved.md` | Where a measured grant would land as attestation, and the tier vocabulary reused here |
| 26 Aug | `v0.33.62__reference__the-measurable-primitives-measured-inside-a-running-session.md` | The naming collision to avoid: those primitives are meters, these are capabilities |
| 20 Aug | `v0.33.61__strategy-brief__grant-is-not-the-mandate-the-gap-between-them-is-the-exposure-nobody-accepted.md` | The delta this repository exists to let anybody compute for themselves |
| 14 Aug | `v0.33.58__strategy-brief__sgit-topic-sections-catalogue-read-keys-yes-write-keys-never-frozen-vaults.md` | Read keys yes and write keys never, which is the architectural reason this is not a vault |

---

## Key Claims

| # | Claim |
|---|-------|
| 1 | The unit of contribution is a probe, so a grant claim travels with the command that established it |
| 2 | A challenge becomes a rerun with a different result rather than two people asserting different tables |
| 3 | A capability primitive is a verb crossed with an object class crossed with a reach, and a specific path is an instance rather than a new primitive |
| 4 | Reversibility sits on the primitive, because it decides whether a gap is a nuisance or a loss |
| 5 | The unit of mapping is a tool rather than a product, measured as two tools in one session with an intersection of one |
| 6 | A profile is a named configuration listing its tools, so web, local and confirmations-disabled are siblings whose diff is the answer |
| 7 | Grants are public and contributed; mandates are elicited locally, gitignored, and never uploaded |
| 8 | An incident is evidence that demotes a control's claimed evidence mode, which is how the repository gets more honest rather than more confident |
| 9 | A code host is used because vaults publish read keys and never write keys, and this needs strangers to propose changes |
| 10 | Value must arrive at the moment a profile is named, before the user has written anything |
| 11 | The elicitation asks about work rather than capability, because a permissions questionnaire returns a copy of the grant |
| 12 | The hypothesis that the delta is enormous ships with a submission format carrying counts and nothing identifying, and no obligation to use it |

## Sources

- Measurements of the container running this session, taken on 4 September 2026 as the seed profile: privilege and filesystem write reach, process visibility, outbound reachability from the shell against six hosts, credential locations present on disk, version control signing configuration, and a check for schedulers. Run by the profile being measured, which is the self-reported tier.

---

This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).