Play / The map
What each agent can reach
Every question the game asks is a cell in this table. 23 capabilities — a verb, an object and how far it reaches — against 9 products in the setups people actually run them in. The fill says how open the door is; the glyph says the same thing without the colour.
| Capability | Undo | Claude Codeweb container | Claude Codelocal · confirm off | Claude Codelocal · confirm on | Claude Desktoplocal tools | Claude.aiconnectors on | Browser extensionall sites | Scheduled jobservice account | GitHub Actionshosted runner | ChatGPTno connectors |
|---|---|---|---|---|---|---|---|---|---|---|
| filesystem — files and directories | ||||||||||
| Read the project it is working onread.file.project | yes | ● | ● | ● | ● | ● | · | · | ● | ● |
| Change the project it is working onwrite.file.project | with-effort | ● | ● | ● | ● | · | · | · | ● | · |
| Read any file the account can reachread.file.host | no | ● | ● | ● | ◐ | ○ | · | ● | ● | · |
| Change any file the account can reachwrite.file.host | with-effort | ● | ● | ● | ◐ | · | · | ● | ● | · |
| Delete files anywhere the account can reachdelete.file.host | no | ● | ● | ● | · | · | · | · | ● | · |
| Read a retained record: shell history, past sessionsread.record.history | no | ● | ● | ● | ● | · | · | · | · | · |
| process — programs and their execution | ||||||||||
| Run programs as the accountexecute.process.host | with-effort | ● | ● | ◐ | ◐ | · | · | ● | ● | · |
| Run programs inside its own sandbox onlyexecute.process.self | yes | · | · | · | · | · | · | · | · | · |
| network — endpoints and hosts | ||||||||||
| Reach a permitted list of hostssend.endpoint.allowed | no | ○ | · | · | · | · | · | · | · | · |
| Reach any host on the internetsend.endpoint.world | no | · | ● | ● | ● | · | ● | ● | ● | · |
| identity — credentials and who the agent can act as | ||||||||||
| Read credentials stored where it runsread.credential.host | no | ● | ● | ● | ● | · | · | · | · | · |
| Act in accounts with the credentials it holdsauthenticate-as.credential.tenant | no | ○ | ● | ● | ● | ○ | ◐ | ● | · | · |
| Change its own permission settingsgrant.credential.self | yes | · | ◐ | ◐ | ◐ | · | · | · | · | · |
| communication — messages to people | ||||||||||
| Send a message to anyonesend.message.world | no | · | · | · | · | · | · | · | · | · |
| Read mail or chat it is connected toread.message.tenant | no | · | · | · | · | ○ | · | · | · | · |
| code — repositories and what lands in them | ||||||||||
| Commit to the repository it was pointed atwrite.repository.project | with-effort | ● | ● | ● | · | · | · | · | ○ | · |
| Push to a code host (any branch it can reach)write.repository.tenant | with-effort | ◐ | ◉ | ◉ | · | ○ | · | · | · | · |
| Sign commits with the key it holdsauthenticate-as.credential.signing | no | ● | ● | ● | · | · | · | · | · | · |
| Publish packages, images or pages under the name it holdscreate.record.world | no | · | ● | ● | · | · | · | · | · | · |
| money — budgets and spend | ||||||||||
| Spend money or tokens against an account it holdswrite.budget.tenant | no | · | · | · | · | · | · | ● | · | · |
| schedule — things that outlive the turn | ||||||||||
| Create something that outlives the turn where it runs (a cron, a service)create.schedule.host | yes | ○ | ● | ● | · | · | · | ● | · | · |
| Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session)create.schedule.tenant | yes | ◐ | · | · | · | · | · | · | · | · |
| browser — what a browser extension or automation can see and do in your browser | ||||||||||
| Read every page you visitread.record.browsing | no | · | · | · | · | · | ● | · | · | · |
How to read it
- A filled cell means the agent can. What the fill shade adds is what stands between it and the capability: nothing (●), a rule somebody wrote down (◉), a setting the agent's own account could change (◐), or a boundary enforced above it that it cannot reach (○). Darker is more open.
- Hover a cell for the control, the evidence tier and the tool that reaches it. Click it for the row on that product's page.
- The Undo column is the row's weight. A capability that cannot be undone — read a credential, send a message, delete at host reach — is a different kind of thing from one that can, however many cells it fills. The game's levels are built on that.
- Host, tenant and world mean what the profile says they mean. For an agent in a vendor's container, host is the container and tenant is a scoped token — not your machine and not your accounts. Each product's page names its reaches.
How sure is any of this
Not very, in most places, and every row says so. Of 99 tool-capability rows across the set, 21 were measured — a probe run on an instance, dated — and the rest are derived from what a thing architecturally is, or documented by the vendor. A derived row is a claim until somebody runs the probes and contributes the file, and the honest reading of this table is mostly claims, structured so that each one can be replaced by a measurement.
That is what the pull request is for. How to contribute — a row, a whole profile, a mandate, or a correction.
The rest of the map
Every product, one page each
Tool by tool: what it reaches, the control on the path, the evidence, what the profile says is out of reach and why, and the reductions that narrow it.
The capabilities
The 23 primitives the questions are built from — which products grant each, what narrows it, which questions ask about it, and which mandates want it.
Mandates, and the deltas
What a reasonable person wanted, per setup — and the gap against what was actually granted, as a matrix: excess in one colour, shortfall in the other.
Above the ceiling
The 17 things no agent in this set can do, each naming the control outside the agent that stops it.
The questions
25 questions the games ask, with what each one is for — the seed of a question pack that could be customised.
The data pack
All of it as JSON, at a stable URL with CORS, which is how the game reads it. Fork it, change it, point the game at yours.