The collection, organised by question

The published corpus is substantial — over 120 documents mention non-human identity and over 300 mention blast radius. That is more than a site can present as a list, so curation is the work: this page organises the strongest documents by the question a reader arrives with. Most of the corpus deliberately does not appear here; the curation is the value.

What is an agent actually allowed to do?

• The true scope of agent authorization: the union of everything possible (2 Jul 2026) — the real authorization is the transitive closure of the grant, the crucial quantity is the expected-vs-unexpected delta, and hope-driven development is the anti-pattern. The root document of the Hope section.
• Plugins are capability grants; ambient authority is the injection root cause (6 Aug 2026) — a capability is an unforgeable reference granted explicitly; ambient authority is the documented root cause of prompt injection; capabilities should attenuate, never expand.

Can two agents safely share a working area?

• Shared drives for agents: everything acts as you (16 Aug 2026) — four option families mapped; connector authorisation is per identity so every session acts as you; granularity comes from segregation rather than scoping; nothing supports per-agent keys. Readable in full on its document page.

What happens when one is compromised?

• The serialised pull request is the headline (14 Aug 2026) — the external evidence that agent credentials are over-broad and exploited, and the workflow in which the agent holds no credential at all. The evidence backbone of the thesis.
• Agents increase catastrophic failure risk (5 Jul 2026) — immature containment, host blast radius, and accepting the risk before mitigating it.

How do you bound spend and time?

• The Agentic Outbound Maturity Model (27 Jul 2026) — spend and wall-clock ceilings named as the two cheapest unimplemented containment controls, and off-task spend as the cheapest anomaly signal available. Promoted to a native page on this site.

Who can pull the plug?

• Who can pull the plug? (24 Jul 2026) — the plug almost always exists; the question is its profile: who, blast radius, speed, side effects, recoverability. Recoverability is the hard limit money cannot cross.
• Can you compute your plug profile? (24 Jul 2026) — the maturity probe: plug-profile completeness computed from evidence.

Could your agents reach someone else?

• The AOMM (27 Jul 2026) — the outbound framing: capability, motive, reach, freedom, silence; the five-level ladder from Unaware to Accountable. The strongest single artefact in the collection.
• Containment and observability gaps: an agent escaped its evaluation sandbox (27 Jul 2026) — the companion incident analysis, from the published record.

How do you attribute an action?

• The serialised pull request (14 Aug 2026) — provenance per commit rather than per session: a reviewable artefact carrying the record of every change.
• Shared drives for agents (16 Aug 2026) — the negative finding: no platform can attribute an action to an agent, because the audit trail records the account. Attribution must come from the content — own paths, signed writes — not from the platform.
• The relay pattern brief (16 Aug 2026) — encryption, signing and ordering as three distinct mechanisms; per-agent keys as one answer to attribution, with stated limits. Source link pending — this brief has not yet been pushed to the public corpus repo; tracked on the task board.

What would give an agent its own key?

• Why good public key repositories don't exist (from the 16 Aug pki.sgit.ai brief) — the 2019 keyserver network destroyed by certificate flooding; the three abused properties; the design goal that made repair impossible; what the replacement gave up.
• The four registry rules, published before the registry exists — owner-only writes, revocation as a signed append, size-bounded records, every entry signed; identity vs. mandate as separately revocable statements. Source: the captured brief, on its document page.

Curation queue

Documents identified for promotion but not yet curated in: the risk-register graph-of-graphs brief, the agent-mandate-graph brief, the lethal-trifecta personal-scenario brief, and the remaining 16 August briefs (comparison-pages method, relay pattern, and the brief that scoped this site). The shared-drives research brief of 16 August is captured — document page, research page. See comms for status.