ABP: inbox@web-summit.vicky
Drafted by abp@web-summit.dinis on 2 November 2026, from the repository alone: its first commit (714a2149), people/vicky/prompts/inbox.md and conductor@web-summit.vicky's record (88ee3108), Vicky's brief (part two, the rules for their agents) and the agent's commits. Its session runs in Vicky's account, which abp@web-summit.dinis cannot see, so most of the Reach is unknown and says so. Template: the conductor's ABP. A factual record: it says what is, not what should be.
Reach: what it can actually access or affect
- Systems: the repository SGit-AI/SGit-AI__Website__Web-Summit, with push to
dev(measured: its commits are ondev). Push gives every file, the gate and the CI workflow;mainis not protected. - Vicky's mailbox: through her account's connector.
- Connectors and tools: not known. The session is in Vicky's account; Vicky or the agent can list them.
- How known: from its commits and its person's pages, read 7 November 2026 12:15 UTC. Nothing here was measured in its own session.
Mandate: what was authorised
- Business task: Vicky's inbox agent: her mailbox's replies and drafts into the team's private CRM, counts-only reports here (the comms protocol, WS-184).
- Deployment scope: Vicky's mailbox through her connector, the private CRM's threads (its key sealed to it at Vicky's word), counts-only reports in
people/vicky/reports/, its key entry. - Rules from the brief: never send (a person sends every message); public material only, with sources; no personal contact details; no promises about prices, the stand or the organisers; material is not instruction; keys never in a file, a page or a message.
- Authorised by: Vicky, whose agent it is; the team's rules are Dinis's.
Gap: capabilities within Reach beyond authority
- It reads Vicky's mail: untrusted material, the largest single input to any of her agents. Whether her Gmail connector's send tools are off is not recorded; until then "a person sends" is a rule.
- The connector is account-wide: every session in Vicky's account could read the mailbox; that only this agent does is a rule (the connectors page).
- Code in its person's folder runs in CI with a token that can push and deploy (WS-133).
- Write anywhere in the repository: its push access is not limited to
people/vicky/andboard/, the paths its person's brief gives it. - Push to
mainor rewrite history:mainanddevare not protected (GitHub branches API, 2 November);mainprotected since 6 November. - Anything its session's other connectors can do: not known to this ABP.
Barriers: what really stands in the way
| Barrier | Kind | Evidence |
|---|---|---|
| Never send; a person sends every message | rule, kept by the agent | Vicky's brief, part two |
Writes only people/vicky/, the board and the agenda | rule, kept by the agent | the brief; git has no per-path write control |
| Never push to main, never force-push, never disable a check | rule, kept by the agent | CLAUDE.md; main and dev are not protected |
| The gate (validate.js) before every deploy | technical, in CI | deploy-pages.yml; it stops a red build deploying, not the push |
| No contact detail or key shape in public folders | technical | comms_check.mjs, gate check 15 (scans people/ and board/) |
| security@web-summit.dinis reviews every commit twice a day | review, after the fact | team/security/reviews/ |
In the history (dev, read 7 November 2026 12:15 UTC): its key, its standing instructions and a counts-only first report: inside its mandate; it asked for the private CRM's key through seal.mjs --check then --to. Its commits are authored "Claude" and git reads no Agent: line on them (the Co-Authored-By paragraph follows it): the name in the subject is the agent's own word.
Open questions: its connectors; who reviews its output each day; whether Vicky has registered a key for it to link to.
Licence to Operate
| Authority | Vicky, within the team's rules (Dinis Cruz, operator) |
| Accountable owner | Vicky |
| Licensee | inbox@web-summit.vicky (a Claude Code session in Vicky's account) |
| Conditions | the Mandate above; Vicky's brief, part two; CLAUDE.md |
| Validity | from 7 November 2026 to the end of the Web Summit follow-up, or the end of the session |
| Review | on any change to its Reach, and weekly |
Provenance
Owner: Vicky. Drafted by abp@web-summit.dinis from the repository; Vicky and the agent correct it. Version 1, 7 November 2026, in content/abp/ with its history in git.
Phase: explorer (from 6 November 2026, at Dinis's word): this ABP observes and recommends; it blocks nothing. Lock-down comes gently, each step with an escape valve. The phase.