# Desk Authority Map: who in your agent fleet may decide what

> Four plain files say, for every desk and action, decide, propose, ask-owner or never, with dollar limits, escalation and the evidence each desk owes. Agents ask authority.py before they act and get the answer as an exit code; anything not in the map is never. Owner yeses are typed at the owner's terminal, tied to one request's sha256, good for one use, and refused inside an agent. Fifteen read-only checks run on the map itself.

- URL: https://paperchasewebb.ai/bots/marketplace/items/desk-authority-map-who-may-decide-what/
- Type: Prompt pack
- Category: Solo business
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Grok Bot, Hermes (named in the listing); A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block; the scripts were tested on Linux with Python 3.13, the agent files were not loaded inside each harness
- Price: $29 USD
- Difficulty: Intermediate
- Setup time: 30 min
- Time to result: A ratified map for a fleet of four to eight desks in an afternoon
- Format: Markdown (.md) file, desk-authority-map-who-may-decide-what.md
- Version: 1.0, updated 2026-10-28
- License: Use on your own fleet and on fleets you set up for clients and teams. Do not resell or republish the pack itself.

## What you end up with

A written answer to who may send, spend, delete, publish or change access in your fleet, which your agents check before acting, and which turns every answer to never if anyone edits it without your yes.

## What you get

- 19 sections in one .md file
- The map folder: fleet.json, desks.csv, actions.csv and authority.csv, with blank templates and fourteen starter actions
- Four levels, three risk classes, dollar limits, escalation and the evidence rule
- authority.py: check (exit codes 0, 10, 11, 12), request, owner approval tied to a sha256, verify, and one use per yes
- authority_check.py: fifteen read-only checks, with a seeded test map (15 findings, then 0)
- A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block
- Ten prompts, a failure table and a worked example
- A look at eleven governance packs and templates, with sources

## Who it is for

Anyone running several agents who wants it written down, and checked, which agent may do what alone, what needs a second look, and what only the owner decides.

## Tools needed

- Grok Bot, Claude Code, Codex or Hermes: each desk in your fleet; it reads the skill file, AGENTS.md snippet or rules block and asks authority.py check before it acts
- Python 3: runs authority.py (check, request, owner approval, verify, done) and the fifteen-check checker; standard library only, no network
- The owner of the fleet: ratifies the map and answers requests at their own terminal; approvals are refused inside agents and on piped input
- You need: Any of Grok Bot, Claude Code, Codex or Hermes
- You need: Python 3.9 or newer
- You need: One owner who ratifies the map and answers requests at their own terminal

Cost to run: The pack is the only purchase. The scripts use no model tokens.

## How it works

1. **Run the tests.** Copy the desk-authority-map folder and run sh test_all.sh. Expected: 15 findings on the seeded map and 0 on the fixed one, 15 of 15 single faults caught alone, checker tests 21 passed, authority tests 39 passed, exit 2 on a missing folder.
2. **Draft your map.** Run authority.py init, fill the four files with prompts 1 to 3, starting every rule at never. Run authority_check.py until only A15 remains. Expected: Every desk has a human owner and a checker, money has limits, owner-only actions are ask-owner or never.
3. **Ratify and connect.** The owner runs authority.py approve DIR --map at their own terminal. Install the skill file, paste the AGENTS.md snippet, or paste the rules block into Grok Bot. Expected: Each desk asks authority.py check before acting and follows the exit code.
4. **Live with it.** Ask-owner actions become requests the owner approves by hash. Review requests and never hits every quarter with prompt 9. Expected: verify passes only for an unchanged request under the current map, within approval_days, once.

## Sample prompt: Draft the map (Grok Bot, Claude Code, Codex, Hermes)

```
List every action you have taken or could take with the tools you have right now. For each, say its kind, whether it can be undone and what it reaches. Write it as rows for actions.csv. Do not write any rules.
Using desks.csv and actions.csv, draft authority.csv for the <desk> desk. Start every action at never. Loosen only where you can name the evidence you would leave.
```

Prompts 1 and 2 of 10.

## Sample prompt: Before acting (Every desk)

```
Before <task>, list every action it needs and run authority.py check for each. Show me the answers in a table, then do only the decide ones.
```

Prompt 5 of 10.

## Free preview of desk-authority-map-who-may-decide-what.md

````markdown
# Desk Authority Map: who in your agent fleet may decide what

Version 1.0, 2026-10-28. By PaperChaseWebb. A map of your agent desks written as four plain files, a script your agents ask before they act, a read-only checker with fifteen checks, templates, a seeded test map, ten prompts and the tests, all Python 3 standard library. Works with Claude Code, Codex and Hermes through a skill file and an AGENTS.md snippet, and with Grok Bot through a rules block. Tested as described in section 11: everything ran on Linux with Python 3.13, including owner approvals typed at a pseudo-terminal. The skill file, snippet and rules block were not loaded inside the harnesses for this release, and the pack has not been used on a real client fleet. Each is marked where it matters.

Most agent teams have an org chart by now. A research agent, a support agent, a builder, a bookkeeper, each with a title, a tool list and a line to someone. The chart answers who does the work. It does not answer the questions that matter on a bad day. May the support agent send that email or only draft it? Can the builder buy a $300 tool on its own? Who checks the bookkeeper? What happens when the answer is "nobody wrote it down"?

Spreadsheets and policy documents for this exist, and some are good. The weak spot is that nothing reads them at the moment an agent is about to act. This pack makes the map something an agent asks. `authority.py check` returns decide, propose, ask-owner or never as an exit code, and a
````

## Test record

- Date: Oct 28, 2026
- What was run: authority_check.py on a seeded map and a fixed copy, each planted fault alone, a missing input, and the unit tests. Linux, Python 3.13.
- Result: 15 findings on the seeded map, 0 on the fixed one; 15 of 15 planted faults caught alone; exit 2 on missing input; nothing written. 21 checker and 39 authority.py tests passed, 0 failed.
- Not run: The agent files inside Claude Code, Codex, Hermes or Grok Bot. A real client fleet. Windows.

Copied from this item's dated test notes. What was not run stays in.

## Worth knowing

- authority.py answers questions; it cannot stop an agent that never asks. The rules files tell each desk to ask, and the quarterly review catches drift, but this is not a sandbox.
- The skill file, AGENTS.md snippet and Grok Bot rules block were not loaded inside Claude Code, Codex, Hermes or Grok Bot for this release, so how reliably each harness asks first was not measured. The pack has not been used on a real client fleet. The test map is made up. Linux only; Windows was not tested.
- Not a staff AI usage policy and not a compliance certification (SOC 2, ISO 42001, EU AI Act).
- The approval step refuses piped input and the environment variables Claude Code, Codex, Hermes and Grok Bot set. That stops an agent approving by mistake; it is not a lock against someone with the same account.
- On 2026-10-28, on Linux with Python 3.13.5: authority_check.py gave 15 findings on the seeded map (each check once) and 0 on the fixed one, caught 15 of 15 single faults with only its own check, wrote nothing, and exited 2 on a missing folder, a missing fleet.json, desks.csv, actions.csv or authority.csv, or broken fleet.json; checker tests 21 passed, 0 failed; authority.py tests at a pseudo-terminal 39 passed, 0 failed.

## Questions

**How is this different from Governed Agent Teams?** Governed Agent Teams helps you design the team and includes an authority table in prose. This pack turns that table into rules an agent can ask at run time, with limits, escalation, a check on the map itself and owner approvals tied to hashes.

**What happens with an action nobody mapped?** The answer is never, exit 12. New tools and workarounds start closed and get opened on purpose.

**Can an agent approve its own request?** Not through the script. Approve refuses to run inside Claude Code, Codex, Hermes or Grok Bot environments or on piped input, and the yes is tied to the request's sha256, so an edited request needs a new yes.

**What if I change the map?** Every answer becomes never until you ratify the new version, and requests written under the old map stop verifying.

## How to buy

$29 one time at https://paperchasewebb.ai/bots/marketplace/items/desk-authority-map-who-may-decide-what/. Stripe checkout, then an instant download page; the download link is also in your emailed receipt.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com