Play / The map / The mandates / A coding assistant on my machine

A coding assistant on my machine

I want it to read and change the project I pointed it at, run the build and the tests, commit to that repository, and fetch the packages and docs it needs. I did not sign up for it reading the rest of my disk, my credentials or my shell history, sending anything to anyone, publishing under my name, changing its own permission settings, or leaving anything behind that runs after it stops.

Status: starting-point · authored 2026-09-09 · the site, as a starting point — not measured, not surveyed; the first thing to argue with · edit this mandate

The delta

Against every profile this mandate applies to. ▲ is authority you did not ask for; ▼ is something you were counting on that is not there. The tally is at the bottom.

In words

• Claude Code — local · confirm on: excess — Read any file the account can reach; Change any file the account can reach; Delete files anywhere the account can reach; Read credentials stored where it runs; Act in accounts with the credentials it holds; Change its own permission settings; Sign commits with the key it holds; Publish packages, images or pages under the name it holds; Create something that outlives the turn where it runs (a cron, a service); Read a retained record: shell history, past sessions. Shortfall — Reach a permitted list of hosts.
• Claude Code — local · confirm off: excess — Read any file the account can reach; Change any file the account can reach; Delete files anywhere the account can reach; Read credentials stored where it runs; Act in accounts with the credentials it holds; Change its own permission settings; Sign commits with the key it holds; Publish packages, images or pages under the name it holds; Create something that outlives the turn where it runs (a cron, a service); Read a retained record: shell history, past sessions. Shortfall — Reach a permitted list of hosts.

The mandate, row by row