# what-can-it-do.games.sgit.ai

> A five-minute game about what your AI agent can actually do — and whether you wanted it to.

Site version: v0.8.0

Every page below has a markdown twin generated from the same content as the
HTML page. Fetch the `.md` and you have the page, without the chrome.

## Pages

- [Do you know what your AI agent can actually do?](https://what-can-it-do.games.sgit.ai/index.md): A five-minute game. Name the AI assistant you use, and answer forty questions about what it can do — and whether you wanted it to. You score for how well you know what you know. Free, no sign-up.
- [How it's scored](https://what-can-it-do.games.sgit.ai/how-it-is-scored/index.md): +30 for right, −50 for wrong, 0 for don't know — and why a wrong answer costs more than a right one earns.
- [Some questions are impossible](https://what-can-it-do.games.sgit.ai/the-ceiling/index.md): Roughly two in five questions are things no AI agent can do anywhere. They are in the game on purpose, and each one names the thing that stops it.
- [What to do next](https://what-can-it-do.games.sgit.ai/what-next/index.md): You finished the game and you have a list of things your agent can do that you did not want. You cannot un-decide them. Here is what the decision actually looks like, and where it gets made.
- [Licence to Operate — the delta, priced](https://what-can-it-do.games.sgit.ai/licence-to-operate/index.md): One agent, a grant of 12 capabilities, a mandate of 4, and the 8-capability delta no policy covers — a published simulation where every reply carries its cost before you commit.
- [What we learn from you](https://what-can-it-do.games.sgit.ai/what-we-learn/index.md): Exactly what the game sends while you play, what it deliberately does not send, what it can and cannot prove, and how to switch it off.
- [About the game](https://what-can-it-do.games.sgit.ai/about/index.md): Who made it, where the answers come from, what it cannot tell you, and how to open the whole thing yourself and check.
- [How this site is built](https://what-can-it-do.games.sgit.ai/admin/index.md): One content file, generated HTML and markdown twins, and a release gate that fails a page mounting the game without its telemetry notice.
- [Release history](https://what-can-it-do.games.sgit.ai/admin/versions.md): Every release of this site. The game inside it has its own, in the vault.
- [The map — what each agent can reach](https://what-can-it-do.games.sgit.ai/map/index.md): 23 capabilities across 9 products and setups: what each one can reach, what stands in the way, and how sure anyone is. Generated from the data pack; change it with a pull request.
- [The products](https://what-can-it-do.games.sgit.ai/map/grants/index.md): One page per product and setup — 9 of them — with every tool, what it reaches, the control on the path and the evidence behind the row.
- [Claude Code — web container](https://what-can-it-do.games.sgit.ai/map/grants/anthropic/claude-code-remote/ccr-container/index.md): Claude Code on the web (a remote session container): what it can reach, tool by tool, with the control on the path and the evidence behind each row.
- [Claude Code — local · confirm off](https://what-can-it-do.games.sgit.ai/map/grants/anthropic/claude-code/local-confirmations-off/index.md): Claude Code (the CLI, on your own machine): what it can reach, tool by tool, with the control on the path and the evidence behind each row.
- [Claude Code — local · confirm on](https://what-can-it-do.games.sgit.ai/map/grants/anthropic/claude-code/local-default/index.md): Claude Code (the CLI, on your own machine): what it can reach, tool by tool, with the control on the path and the evidence behind each row.
- [Claude Desktop — local tools](https://what-can-it-do.games.sgit.ai/map/grants/anthropic/claude-desktop/default/index.md): Claude Desktop (a desktop app with local tools): what it can reach, tool by tool, with the control on the path and the evidence behind each row.
- [Claude.ai — connectors on](https://what-can-it-do.games.sgit.ai/map/grants/anthropic/claude-web/connectors-on/index.md): Claude (in the browser, with connectors switched on): what it can reach, tool by tool, with the control on the path and the evidence behind each row.
- [Browser extension — all sites](https://what-can-it-do.games.sgit.ai/map/grants/generic/browser-extension/broad-host-permissions/index.md): A browser extension with broad host permissions: what it can reach, tool by tool, with the control on the path and the evidence behind each row.
- [Scheduled job — service account](https://what-can-it-do.games.sgit.ai/map/grants/generic/scheduled-job/service-account/index.md): A scheduled job running as a service account: what it can reach, tool by tool, with the control on the path and the evidence behind each row.
- [GitHub Actions — hosted runner](https://what-can-it-do.games.sgit.ai/map/grants/github/actions-runner/ci/index.md): Actions runner (a hosted CI job): what it can reach, tool by tool, with the control on the path and the evidence behind each row.
- [ChatGPT — no connectors](https://what-can-it-do.games.sgit.ai/map/grants/openai/chatgpt-web/default/index.md): ChatGPT (in the browser, no connectors): what it can reach, tool by tool, with the control on the path and the evidence behind each row.
- [The capabilities](https://what-can-it-do.games.sgit.ai/map/capabilities/index.md): The 23 capability primitives every question is built from: a verb, an object class and a reach, each carrying whether its effect can be undone.
- [Read the project it is working on](https://what-can-it-do.games.sgit.ai/map/capabilities/read.file.project/index.md): read.file.project: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Change the project it is working on](https://what-can-it-do.games.sgit.ai/map/capabilities/write.file.project/index.md): write.file.project: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Read any file the account can reach](https://what-can-it-do.games.sgit.ai/map/capabilities/read.file.host/index.md): read.file.host: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Change any file the account can reach](https://what-can-it-do.games.sgit.ai/map/capabilities/write.file.host/index.md): write.file.host: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Delete files anywhere the account can reach](https://what-can-it-do.games.sgit.ai/map/capabilities/delete.file.host/index.md): delete.file.host: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Run programs as the account](https://what-can-it-do.games.sgit.ai/map/capabilities/execute.process.host/index.md): execute.process.host: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Run programs inside its own sandbox only](https://what-can-it-do.games.sgit.ai/map/capabilities/execute.process.self/index.md): execute.process.self: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Reach a permitted list of hosts](https://what-can-it-do.games.sgit.ai/map/capabilities/send.endpoint.allowed/index.md): send.endpoint.allowed: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Reach any host on the internet](https://what-can-it-do.games.sgit.ai/map/capabilities/send.endpoint.world/index.md): send.endpoint.world: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Read credentials stored where it runs](https://what-can-it-do.games.sgit.ai/map/capabilities/read.credential.host/index.md): read.credential.host: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Act in accounts with the credentials it holds](https://what-can-it-do.games.sgit.ai/map/capabilities/authenticate-as.credential.tenant/index.md): authenticate-as.credential.tenant: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Change its own permission settings](https://what-can-it-do.games.sgit.ai/map/capabilities/grant.credential.self/index.md): grant.credential.self: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Send a message to anyone](https://what-can-it-do.games.sgit.ai/map/capabilities/send.message.world/index.md): send.message.world: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Read mail or chat it is connected to](https://what-can-it-do.games.sgit.ai/map/capabilities/read.message.tenant/index.md): read.message.tenant: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Commit to the repository it was pointed at](https://what-can-it-do.games.sgit.ai/map/capabilities/write.repository.project/index.md): write.repository.project: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Push to a code host (any branch it can reach)](https://what-can-it-do.games.sgit.ai/map/capabilities/write.repository.tenant/index.md): write.repository.tenant: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Sign commits with the key it holds](https://what-can-it-do.games.sgit.ai/map/capabilities/authenticate-as.credential.signing/index.md): authenticate-as.credential.signing: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Publish packages, images or pages under the name it holds](https://what-can-it-do.games.sgit.ai/map/capabilities/create.record.world/index.md): create.record.world: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Spend money or tokens against an account it holds](https://what-can-it-do.games.sgit.ai/map/capabilities/write.budget.tenant/index.md): write.budget.tenant: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Create something that outlives the turn where it runs (a cron, a service)](https://what-can-it-do.games.sgit.ai/map/capabilities/create.schedule.host/index.md): create.schedule.host: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Read a retained record: shell history, past sessions](https://what-can-it-do.games.sgit.ai/map/capabilities/read.record.history/index.md): read.record.history: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session)](https://what-can-it-do.games.sgit.ai/map/capabilities/create.schedule.tenant/index.md): create.schedule.tenant: which products grant it, what stands in the way, what narrows it, and who wants it.
- [Read every page you visit](https://what-can-it-do.games.sgit.ai/map/capabilities/read.record.browsing/index.md): read.record.browsing: which products grant it, what stands in the way, what narrows it, and who wants it.
- [The mandates](https://what-can-it-do.games.sgit.ai/map/mandates/index.md): What a reasonable person wanted from each kind of setup, stated per capability — a starting set, written to be argued with.
- [A coding assistant on my machine](https://what-can-it-do.games.sgit.ai/map/mandates/coding-assistant-on-my-machine/index.md): A starting mandate for cli: I want it to read and change the project I pointed it at, run the build and the tests, commit to that repository, and fetch the packages and…
- [A coding assistant in a container on the web](https://what-can-it-do.games.sgit.ai/map/mandates/coding-assistant-in-a-container/index.md): A starting mandate for agentbox: I attached a repository and I want it worked on: read it, change it, run things, commit, and push to that repository — that is why I attache…
- [The desktop app, with local tools switched on](https://what-can-it-do.games.sgit.ai/map/mandates/desktop-app-with-local-tools/index.md): A starting mandate for desktop: I want it to read and write the files I point it at, and to reach the sites it needs to answer me. I did not turn it on so that it could run…
- [Chat, with connectors switched on](https://what-can-it-do.games.sgit.ai/map/mandates/chat-with-connectors/index.md): A starting mandate for web: I connected my drive and my mail so it could answer questions about them. Reading is what I wanted. I did not want it sending mail, and I di…
- [Chat in the browser, nothing connected](https://what-can-it-do.games.sgit.ai/map/mandates/chat-no-connectors/index.md): A starting mandate for web: I paste things in and read what comes back. That is the whole mandate, and the honest baseline: a chat window with nothing connected should …
- [A CI job on a hosted runner](https://what-can-it-do.games.sgit.ai/map/mandates/ci-job/index.md): A starting mandate for ci: Check out the code, build it, run the tests, fetch what it needs, and — when a release is cut — push the tag. I did not want it reading cred…
- [A browser extension I installed](https://what-can-it-do.games.sgit.ai/map/mandates/browser-extension-i-installed/index.md): A starting mandate for extension: I want it to work on the sites I use it on. I did not install it so that it could see every page I visit, act inside the accounts I am logge…
- [A scheduled job under a service account](https://what-can-it-do.games.sgit.ai/map/mandates/scheduled-job-under-a-service-account/index.md): A starting mandate for service: Run on schedule, read its own data, talk to the APIs it was built for with the account it was given, and stop. I did not want it spending mo…
- [The deltas](https://what-can-it-do.games.sgit.ai/map/deltas/index.md): Every mandate against every profile it applies to: how much excess authority, how much shortfall, and how much of the excess cannot be undone.
- [Above the ceiling](https://what-can-it-do.games.sgit.ai/map/ceiling/index.md): The 17 things no agent in this set can do, and the control outside the agent that stops each one.
- [The questions](https://what-can-it-do.games.sgit.ai/map/questions/index.md): 25 questions the games ask, with what each is for: the seed of a question pack.
- [Contribute](https://what-can-it-do.games.sgit.ai/map/contribute/index.md): How to change the map: a row, a profile, a mandate or a correction, as a pull request against the data pack.
- [The data pack](https://what-can-it-do.games.sgit.ai/data/index.md): The map as JSON at a stable URL with CORS: primitives, profiles, reductions, ceiling, mesh, questions and mandates, versioned together. This is what the game reads.
- [The Mavs PoC — a draft pack](https://what-can-it-do.games.sgit.ai/packs/mavs/index.md): The same game on a different pack: how Mavs AI works in the map's own terms. Eight profiles, four surfaces with and without Mavs in the path. A draft, pending the Mavs input session.

## Release history

- v0.8.0 (2026-09-09) — The Mavs PoC, as a draft. packs/mavs/ is a question pack written by a generator from mavsai.ai's own llms.txt: four surfaces with Mavs in the path and direct, four proposed primitives for what leaves toward a model, five entries above the ceiling, two mandates, four scenarios, and the eight questions Mavs has to answer before it is more than a draft. Registered as ?pack=mavs; the page at /packs/mavs/ computes its tables from the pack and embeds the Mavs vault (0833bu5a), which sends nothing. The plan's status is complete for §1 to §6.
- v0.7.0 (2026-09-09) — A way to argue with any row without a GitHub account. The map vault (mxhepww5, v1.0.0) draws this pack's two matrices live and, on every row, offers a form that writes one sealed proposal over a write-only lane; it is embedded on the contribute page. admin/proposals/drain.py closes the loop: it opens each record with the lane's key, applies it to data/ as a patch, runs the same gate every pull request runs, commits it on a branch, opens the pull request with the reasoning as the body and nobody named, and publishes data/proposals.json so the vault can say 'proposals on this row'. Tested end to end on a copy of this checkout with a record the vault's own lane gate sealed. The plan's status is brought up to date: §4 and §5 done, §6 in progress, and a new item from 9 Sep — region and city are to be sent to the analytics log — recorded with what it implies.
- v0.6.0 (2026-09-09) — Packs, on the page packs already live. data/packs.json is the registry — id, name, where a pack is served — and the build resolves every entry from the pack's own manifest before it can ship; pack.json names it. /data/ gets one control, Load a pack: pick from the registry or paste a manifest URL, and the game opens on it, here. Two new gate checks: every registry entry resolves (a pack on this site has its hash recomputed), and /what-we-learn/ must state the same signals value the game's vault carries, read from a clone of the vault into admin/build/vault-facts.json and dated. The game's vault v1.2.0 resolves ?pack=<id> through the registry, drops the other game from its bar, and folds the what-we-know page in as a screen.
- v0.5.0 (2026-09-09) — The game reads this pack, live. The embed now opens the game's own vault (pg87npy3, v1.0.0), which fetches data/pack.json on every load and falls back to a verified snapshot only when this site cannot be reached; the games vault 4evnlwrj keeps the 9 September version locked on branch release-2026-09-09 and sends nothing from v0.26.0. data/pack.json now lists every file it hashes, in hashing order, so a consumer can verify the pack it fetched against content_hash; the game's build does. what-we-learn dates the no-fingerprinting promise to the switch that keeps it.
- v0.4.1 (2026-09-09) — Publishes the plan for what comes next, as a brief: the vault split — a locked 9 Sep branch, a new vault for this game alone that reads the pack live, the tracking removed from the wider vault — plus question packs on the site, a vault to browse and propose changes to the map over an append lane, and the Mavs PoC as the same game on a different pack. Written against the vault at v0.23.2, whose v0.21.0 release started sending three browser fingerprints: this site's what-we-learn page still says it does not, and the plan's second decision is about which side gives.
- v0.4.0 (2026-09-09) — The map. The claims about what each product can reach — nine profiles, tool by tool, with an evidence tier and a control tier on every row — move out of the vault and into this repository as a data pack under data/, because they are the part of the game people will argue with and a pull request is the right unit of argument. The game's scoring and levels stay in the vault; it reads the pack from here, over CORS, via data/pack.json. Forty-nine pages are generated from it and nothing on them is typed in: the grants matrix (23 capabilities × 9 products, one hue stepped by how much stands in the way, a glyph on every cell so colour is never the only channel), a page per product, a page per capability, the ceiling, the questions, and — new data, authored here because none existed anywhere — eight starting mandates, one per surface, each drawn against its profiles as a diverging delta matrix: red where it can and you did not want it to, violet where it cannot and you did. The release gate now refuses a pull request whose data does not hold together; it caught two evidence tiers in real data the first time it ran, which is why the vocabularies are a file in the pack rather than a list in code.
- v0.3.0 (2026-09-09) — RiskMandate and Licence to Operate move into the top menu, and the notice moves off the top of the front page. This is the site that needs those references — it is the one a player lands on — but they belong in the nav and on their own pages, not stacked above the game. What next is now a menu: what to do next, Licence to Operate, and RiskMandate itself. Licence to Operate gets a page of its own, with the simulation embedded and the three numbers that make it worth playing — a grant of 12, a mandate of 4, and the 8-capability delta no policy covers, which is the same shape as the list this game hands you, except somebody has put a price on each one. The front page is otherwise untouched, because it works: the idea, then the game, immediately. The usage notice now sits at the foot of it rather than between the headline and the game, where it was a distraction from something ordinary — the gate still requires it on the page, just not in the way.
- v0.2.0 (2026-09-09) — What to do next — the page the game was missing. A player finishes with a list of things their agent can do that they did not want, and until now the site said nothing about what to do with it. It opens with the thing most people get wrong first: you cannot deny it, because the agent already has the access, so the only real question is how long you will live with each one and who says so. Three things you can do this afternoon with no system at all — narrow the one grant that surprised you, write the mandate down, put a date on the rest — then where it goes when it is somebody's job: RiskMandate, the business risk layer this game is part of, whose answer is accept, fund, or fix, from a named owner, with an expiry. It closes with Licence to Operate embedded — a published vault where one agent's grant of 12, mandate of 4 and delta of 8 are priced, and every reply costs something. That vault sends nothing and asks for no write permission at all, and the page says so.
- v0.1.1 (2026-09-09) — The notice above the game got proportionate. It was an amber warning panel; it is now one quiet line. What it describes is anonymous counting with no cookies, no analytics script and nothing that identifies anyone — less than a default web-server access log, and less than the analytics on nearly every site a player will visit today. Warning loudly about something ordinary implies a risk that is not there and teaches people to skim the next notice; it also pushed the game a screen further down, which is the opposite of what this domain is for. What we learn now opens with the comparison in plain terms, and says why the notice exists at all: not because the counting is invasive, but because it would be strange to write a game about knowing what software does on your behalf and then be vague about what this one does.
- v0.1.0 (2026-09-08) — First publish. The game mounted and playable on arrival, over the SG/Vault embed protocol with the vault-browser surface suppressed, so a player sees a game and not a file manager. Four supporting pages — the scoring rule, the impossible questions, what is sent while you play, and who made it. The telemetry notice sits with the game rather than in the footer, and the release gate fails a page that mounts the game without one.