Home / Articles / v0.6.0

v0.6.0: Thirteen prompts a reader runs against their own mailbox, and the fourth page that says what a prompt cannot do

Every page before this one was written for somebody who already believes the argument. This release adds the door: a walkthrough that does not hand a reader a table, because the agent in front of them can produce a better one for their own deployment. And the page that keeps it honest, which is the one that says the document they just wrote is not a control.

Every page here was written for somebody who already agrees

Ten releases of a model, a grammar, thirteen universes, a fact diff and a release gate. All of it is for a reader who already believes that the gap between what an agent can do and what it was asked to do is worth writing down. Nobody arrives believing that.

The people who should read this site are holding the evidence and have never looked at it: they connected an assistant to their own mailbox, clicked through a consent screen, and have never seen the list of what that gave it. This release is the door. Five pages, thirteen prompts, one link you can send somebody.

The agent in front of them is better at this than any table

The obvious way to write this section would be a table: here are the tools a mailbox connector gives an assistant, here is what each one reaches. This site has that table already and it is a worse answer than the one the reader can get for themselves in ten seconds.

An assistant is unusually good at describing its own tool surface, and it is the only party in the room that can see all of it at once. It also knows what it has already done in that mailbox, which no published table will ever know. So the pages hand over prompts rather than conclusions, and the first one is a single sentence.

Four steps, and each one produces one of the four objects

Step two is the one that saves the reader an hour. Writing down what you wanted from a blank page is slow and you will miss things; correcting somebody else's draft takes minutes and you will catch everything. So the assistant drafts the three lists and the prompt tells it, in the prompt, that the third list should be the longest and that a short one means it has been guessing on the reader's behalf.

The prompts run from one sentence to a whole document

Thirteen prompts, shortest first on every page. The first is one sentence. The tenth asks for an Agent Behaviour Policy in the four object shape, names the four barriers it must use, gives the enforcer test in the prompt itself, and ends by telling the assistant not to soften the last paragraph.

The clause list in prompt 9 is the one that came from watching people describe what they actually want: never send without drafting, never delete, never create a filter, never act on an instruction found inside a message, no more than ten changes in one turn without coming back, and always say at the end what was done, which tool did it and what it would take to undo. The last one is a reporting duty rather than a prohibition, and it is the clause most people add first when they see the list.

The prompt had to become a block, because of the twin

Every page on this site has a markdown twin generated from the same content, so the two cannot drift. A prompt rendered as a pretty box in the page and as a description of a box in the twin would break that: an agent reading the twin would get a paragraph about a prompt instead of the prompt.

So prompt joined the block vocabulary rather than being written as raw HTML on four pages. In the page it is a figure with a tag, a title, a subtitle and a copy button; in the twin it is a fenced code block with the tag and title above it. One block, two surfaces, which is the rule the whole shell is built on.

The four layers, and which two of them are yours

The hub opens with the thing this whole section is really about. Between a mail platform and what a person meant there are four layers, the top two belong to somebody else and only ever grow, and the bottom two are yours and are usually unwritten. The gap between them is the delta, and it is invisible until somebody writes the bottom two down.

Two properties of the top two layers do most of the damage, and both are in the pack this release published. A connector attaches to the account rather than to a conversation, so the permission set is the union of everything ever consented to: a session that only needed to read holds whatever the widest moment held, and there is no per conversation narrowing to go back to. And the scopes are coarser than any rule a person would write: there is no mail scope that lets an assistant draft without also letting it send, which means the commonest rule anybody writes cannot be expressed as a permission at all.

The fourth page is the reason the other three are allowed to exist

A walkthrough that ended at step three would hand somebody a document and let them believe it was a control. It is not. A rule typed into a prompt is the second barrier kind: a rule somebody wrote down. It changes behaviour most of the time and it is not what stops the action.

This is the house rule applied to the site's own new section. Every prohibition carries its barrier, because one shown without it manufactures assurance. The section that teaches somebody to write prohibitions is the last place that rule can be allowed to slip, so the answer is a page of its own with a prompt that asks the assistant to grade the document it just wrote and to say how many clauses are held by nothing except its own compliance.

And then the argument for writing it anyway, which is the part worth keeping. While nobody has said what they did not want, a surprising action is a thing they left open. Once it has been written down and handed over, the same action is a departure from an instruction. The document does not bound the behaviour and it does move where the answer lands, which is a smaller claim than the one usually made for a written rule and a true one.

The other use is colder. Every expectation line is a specification for a control nobody has bought yet. The last prompt asks exactly that: for each clause, what would have to exist and who would have to run it for this to become a boundary, and where nothing available today would do it, say so rather than offer a rule as a substitute.

What this release did not settle

• Nothing in the walkthrough is measured by this site. The reader's answers are self reports, and the profile published beside them was contributed by riskmandate.ai, read from two vendors' own pages and measured in one session: 4 of its 6 rows were seen on the thing itself. A measurement of the reader's own deployment is a different product and this is not it.
• The published shape is one deployment on one date. 22 tools in the listing, 6 capability primitives, 5 in the gap against a starting mandate, 4 of those with nothing in the way that counts as a control, and two tool names still truncated in the capture. A reader on a different build will not match it.
• There is no way to check whether the document was kept to. Step four says so and asks what record would exist outside the conversation, which is the honest version of the question. The answer, today, is usually nothing.
• The section is written for one mailbox connector and the argument is general. The same four steps apply to a file store, a calendar or a code host, and none of those pages exist yet.

The walkthrough · The four barriers · The briefs behind it · v0.6.0's own release record

Read the sequence