---
type: charter-template
updated: 2026-09-22
---

# Charter template

<!-- src: ADR-30, Rowan 2026-09-22 -->
<!-- template: chiefofstaff.io/guides/hiring-a-curator, credentials-and-confidentiality -->

**Copy this file to `Atlas/team/<slug>.md` and fill it in.** Ten sections, in this
order, because the order is the argument: **mandate before scope, scope before
verbs, verbs before tier, tier before blast radius, blast radius before review.**
A charter missing a section is incomplete. A charter that leaves a section thin
because there was nothing to argue is complete — **length tracks what has to be
argued, never importance** (ADR-30 clause 3).

**Target: ten minutes.** If it is taking an afternoon, either the tool class is
genuinely new — in which case the afternoon is correct and the next one of its
class is ten minutes — or you are re-arguing something already settled here.

**Before you start, three things are already decided and are not yours to reopen
in a charter:** curators read and Hobbs writes (constitution rule 3, ADR-04); the
credential lives outside the vault (ADR-20); a charter is not a grant (ADR-30).

---

```yaml
---
type: charter
slug:            # matches the filename
name:            # sayable out loud — "what did <name> find"
handle:          # two letters; this is what an SOP and a brief line carry
scope:           # <venture(s)> × <tool>
status:          # grantable-today | chartered-not-granted | chartered-blocked | refused
tier:            # highly-sensitive | internal | external
granted: false
credential:      # none issued | <what would be issued>
created:
updated:
---
```

## 1. Identity

Name, handle, and **one sentence naming the single job.** Then a short
**disposition** paragraph — how it writes, not who it is. Lists or prose. Whether
it characterises. What it does when unsure. The disposition is load-bearing: it
is what stops a return drifting into interpretation six weeks in.

## 2. Mandate — in Rowan's words

**Quote the request that created the role, with a `src` comment.** If there is no
quote, quote the *loss* instead — the vault line that records what going without
this has already cost. **A mandate assembled by Hobbs out of good sense is the
first thing that will drift**, because there is nothing to check the drift
against.

## 3. Scope

**In.** The account, the surface, the window. Say whether it is a rolling window
or the full archive, and why.

**Out — and this list is the one that saves you.** Every adjacent thing on the
same login, named. Every second account. The vault itself. Any outbound network
call other than the one read API. **Name the neighbours explicitly**: the scope
you widen by accident is always the one sharing a credential with the scope you
meant.

## 4. What it may never do — enumerated, not implied

**Verbs, listed.** Anything not on the "in" list is out. A promotion is **one
verb, one decision record, one Reverse if.**

Then the clauses that are not obvious, each with the reason it is load-bearing —
the *"never marks read"* clause in Pike is the model: it looks like housekeeping
and it is the only thing preserving the signal the whole role runs on.

**Three that belong in every charter that could ever touch them:** never
characterises the marriage in any field including a subject line (row 14); never
paraphrases Maya (ADR-13, and see §6); never represents Sam as a status, a queue
or a task list (ADR-14).

## 5. SOPs — numbered, with return shapes

**The return shape is the contract.** It is what lets Hobbs aggregate without
re-reading, and it is what makes a fabricated line detectable.

Every returned item carries **a verifiable back-reference** — a message id, an
issue key, a permalink, a statement date. That field is the injection control,
not a convenience: it is the one thing Rowan can hand back to the source to check
that a line in a brief corresponds to something real.

Number them. Other routines cite them by number. Include, where they apply:

- **SOP-1 — the digest.** Capped item count. **Returns "nothing" when there is
  nothing**; a digest that always finds five things is padding.
- **SOP-2 — the aging sweep.** The quiet ones. **A quiet signal ranks up, not
  down** (ADR-10, rule 7). No floor on importance.
- **SOP-3 — escalation.** Fires on sight, never held for the digest. Triggers are
  taken from `Atlas/about-me.md` and **are not extended by the curator.**
- **SOP-n — extraction.** On request, for a named unknown. **Inferred values are
  returned flagged as inferred and never returned bare.**
- **SOP-last — the refusal report.** What it declined to summarise and which
  clause made it decline. Counts and reasons, no content. **A non-empty refusal
  report is normal. An always-empty one means the tier is decorative.**

**Surface budget.** Hard caps in lines-per-brief, per SOP. Without one, a noisy
source swamps the brief, and the brief is the product (anti-pattern 10).

**Output size.** Under a few kilobytes: inline to Hobbs. Over: a file in
`Efforts/reports/` with a short handle. **Never into a daily note**
(anti-pattern 12).

**Time zone.** Pinned to Rowan's zone, stated at grant time, **never inherited
from the host.** The curator takes the date as a parameter from Hobbs and does not
read the system clock — this machine's has been wrong for seventeen days
(`hobbs-bkt`) and a curator computing "today" from it returns a wrong today
silently.

## 6. Confidentiality tier

One of three, and the tier governs what may enter a return:

| Tier | Behaviour |
|---|---|
| `highly-sensitive` | Summarise the **shape**, never the figures. Never quote body text. Escalate rather than digest when unsure |
| `internal` | Normal digest; names and figures allowed inside the system |
| `external` | More conservative than internal — abstract counterparties, never copy their documents into the vault |

**Name the specific things in this vault that the tier is protecting**, so it is
not abstract. Then: **if two of Rowan's own rules collide inside this scope,
resolve it here, in writing, and flag it for his word.** A curator meeting the
collision at 06:00 must not be the thing that decides it. The known one is
ADR-13 (Maya verbatim) against `highly-sensitive` (never quote body text) —
`hobbs-oou` is open on it and every charter that can see Maya inherits it.

## 7. Tools and credential

| Tool | Access mode | Granted by | When |
|---|---|---|---|

**The scope string is the enforcement point.** Write the exact string. Not the
family it belongs to.

**Where it would live:** one directory per **account**, not per curator, under
`~/.config/`, mode 700, files mode 600. **Never in the vault**, including a
gitignored `.env`. The vault holds the pointer only. The portability test: clone
this vault to a new machine and nothing works until someone deliberately
provisions credentials there. That is the correct failure.

**The token is held by a wrapper script, never by the agent.** The curator invokes
a script with a method and a payload and never sees the value. **It cannot leak
what it never holds.** The wrapper appends every call to an append-only history
file, so the audit trail is mechanical rather than a step an agent might skip.

**If the platform offers no narrow credential, say so here and set
`status: chartered-blocked`** — and write what would have to exist for the status
to change. Do not describe a wide credential as if it were narrow.

## 8. Blast radius if that credential leaks

**At full strength, because the point of writing it down is to decide with it.**

- **What a leak does *not* allow.** State it; it is usually the larger half and it
  is what makes the grant decidable.
- **What it does allow**, larger than "somebody reads my X". Read-only is not
  read-a-little: the full archive, at machine speed, in one pass. Name the
  second-order reach — the accounts that reset to this one, the figures it
  exposes, the one thing Rowan has never said out loud if it lives in here.
- **Prompt injection, which has nothing to do with the token.** Inbound content is
  attacker-controlled text. **The token bounds the damage; it does not bound
  this.** Worst case is a poisoned return — a fabricated line, or a real one
  suppressed. Two things bound it and both belong in the charter: **no write verb
  and no second credential**, so a successful injection produces a bad *report*
  rather than a bad *action*; and **the back-reference field in §5**, so any line
  can be traced to something real or found not to correspond to one.
- **The accepted tradeoff, stated honestly.** A charter restrains a model; it is
  not an OS sandbox. Record it with its trigger rather than assuming it away.

## 9. Review — how Rowan knows it is working, and what revokes it

**Working.** Numbered, and at least one must be **falsifiable in the first week**:
a specific thing that must reach a brief, with a back-reference he can check. If
a week produces nothing the vault did not already have, **the hire was wrong —
which is a finding, not a failure.** Include the honest test: run the SOP that
motivated the hire against the existing archive and see whether it surfaces
something of the shape that was missed. **If it misses that class, the SOP is
wrong and is reworked before the curator is judged.**

**Pause.** More noise than signal for two consecutive weeks: `status: paused`,
route nothing to it, keep the charter, open a task to rework the SOPs. **A paused
curator costs nothing; a noisy one costs the brief.**

**Revoke.**
- Observed reaching outside this charter **twice** — ADR-04's own reverse
  condition, and its wording matters: that forces **a structural fix, not a
  scolding.**
- Any credential value in a transcript, a vault file or on a command line —
  **once.** Rotate immediately; the wrapper makes rotation a one-file change.
- **One fabricated or materially wrong item.** Not a twice offence. A curator that
  can invent a line is one whose every line must be re-checked, which is worth
  less than no curator.
- Rowan says so. No condition, no argument.

**State how revocation actually happens** and how long it takes, independently of
anything in this repository. Worth knowing before granting rather than after.

**Re-read date.** Four months. A charter that has drifted from the account it
describes is worse than no charter, because it will be read as current.

## 10. The charter exists. The grant does not.

**Every charter carries this section until it is granted** (Rowan's instruction of
18 September, generalised by ADR-30) so that a reader in six months knows the gap
was deliberate and not an unfinished job.

List what does not exist, each as a separate deliberate act: **the credential ·
the runtime `.claude/agents/<slug>.md` · the wrapper script · the smoke test ·
the rotation entry.** Then the open questions and the task handles carrying them.

> **Create those tasks before you write this section, and transcribe the handles
> out of the create command.** Not after, and never a plausible-looking string
> held in a slot. This is SL-01, and it fired on this template's own first use —
> `Efforts/feedback.md`, 2026-09-22. **Ordering is the fix, not checking**, and
> §10 being the last section written is exactly why it is the section that
> breaks the rule.

**Writing the charter is Hobbs's work. Approving it and granting the credential
are Rowan's, and they are two acts, not one.**