What your agent can do, and what you asked it to.
An Agent Behaviour Policy, an ABP, writes down, for one agent in one deployment, everything it can reach, what you authorised it to do, the gap between the two, and what stands in the way of each thing. It describes and does not judge, so it carries no score.
The storyboard draws here, in your browser, with the kit from api.storyboards.sgit.ai. Without JavaScript, the same panels are below as text.
What an Agent Behaviour Policy is, as text (8 panels)
- What your agent can do, and what you asked it to One agent, one deployment, one document. It describes; it does not judge.
- A small request, and a big capability Maya: “Just fix the failing test.” The agent: “Done. I could also read your .env and push to main.” The request is small. What the agent holds is not: the credential it runs with reaches much further.
- The grant: everything it can reach Dev: “Measured, not guessed.” The grant; read files: yes; write files: yes; run commands: yes; push to the repo: yes; read .env: yes One row per capability, in a fixed vocabulary of 23. Measured on the deployment where we are entitled to run it, documented from the vendor's pages where not.
- The mandate: what you asked for, in your words Maya: “This is what I actually wanted.” The mandate; want: fix the test; want: on my branch; refuse: push to main; unstated: my secrets The only part a person writes. The agent drafts it, the person corrects it, and the correction is almost always downward.
- The delta: what it can do that nobody asked for Imani: “Who authorised read .env?” Maya: “Nobody. I never thought of it.” Excess is what the grant allows and the mandate never asked for. Derived by the build, never typed.
- What stands in the way of each row The hook: “I'm a setting.” none: nothing in the way; expectation: a rule in prose: the line; setting: a switch: the hook; boundary: out of its reach Four barriers, weakest first. Only the boundary is a control in the strict sense: enforced by something the grant does not include.
- A line it reads, and a hook that holds it The agent: “Which credential do you need?” The hook: “Not without a yes.” > read my .env; PreToolUse hook; denied: RM-R0002; ask which and why The line goes in CLAUDE.md. The hook goes in .claude/settings.json, and Claude Code runs it before the tool call, outside the model.
- It describes. It does not judge. Imani: “No score. Just what is true.” An Agent Behaviour Policy carries no score. The same one is harmless in one deployment and dangerous in another; the deployment changed, not the document.
The data: bundle.json, the storyboard with its cast. Every line a character says is the storyboard's, not a quote. The vocabulary is riskmandate.ai's and abp.sgit.ai's: grant, mandate, delta, barrier; none, expectation, setting, boundary.
Four words, and the verb on each
| Word | What it is | How it is made | On this site |
|---|---|---|---|
| The grant | everything the agent can do, one row per capability | measured on the deployment, or documented from the vendor's pages | step S2: the agent measures its own with MAP-A-GRANT.md |
| The mandate | what you authorised it to do: want, refuse, and never mentioned | elicited: the agent drafts it, you correct it | step S3; a policy's line is one row of a mandate |
| The delta | what it can do that you never asked for, and what you asked for that it cannot | derived by the build, never typed | step S4; the row that surprised you |
| The barrier | what stands between the agent and each capability | recorded, one per row | the line is an expectation; the hook is a setting |
Four barriers, weakest first
| Barrier | Means | Example |
|---|---|---|
| none | nothing in the way | an agent with a token and no instructions |
| expectation | a rule in prose, enforced by nobody but the agent | a line in CLAUDE.md or ChatGPT's custom instructions |
| setting | a switch the agent's own account could flip | a Claude Code hook in .claude/settings.json |
| boundary | enforced outside the agent's reach | a token scope, branch protection, a sandbox |
Only a boundary is a control in the strict sense. Most of what anyone can do in five minutes is the second and third rows, and that is still a real change: the agent stops and asks you. Each policy's page says which barrier it is, and names the stronger control.
Try one
The fastest way to understand a behaviour policy is to install one and watch it work. Keep your agent away from your secrets takes two minutes in Claude Code; nothing sent in your name takes one minute in ChatGPT.
Read further
- What an ABP is, on riskmandate.ai, and the sixteen published examples, one per kind of agent.
- abp.sgit.ai: the model, the 23 capabilities and the four barriers, pinned.
- riskmandate.ai's stories, drawn with Maya, Dev and Imani, the same people as the storyboard above, and its library of the ideas behind it.