Capability record template
Action, surface, preconditions, verification method, and verification date.
Capability catalog
List what a system could do separately from the register of what it is permitted to do, so knowing a capability never grants it.
- 1 Evidence
- 2 Authority acts here
- 3 Decision
- 4 Consequence
- 5 Challenge
- 6 Reconsideration
- 7 Correction
Where it acts
At Authority, one of the seven stages every consequential decision passes through. It keeps what the system can do apart from what it is permitted to do, so a capability is never read as a permission.
Steps
Put the mechanism in motion
3 steps, in order. Check each one off as it is done; the records below show the work was done.
0 of 3 steps complete
Records this mechanism keeps
What a team running this mechanism keeps, and what each record is for.
Discovery endpoint contract
Read-only interface that returns capabilities and their grant status without granting anything.
Refusal message pattern
Standard wording that cites the capability, the required grant, and its state.
Reuse-ready snippets
Copy policy, audit, and incident language
Use these snippets in requirements, audits, and postmortems with the mechanism permalink.
Policy requirement
Policy requirement (MEC-17 Capability catalog) - Maintain a catalog of what the assembled system can do, separate from the register of what it is permitted to do. - Discovery of a capability confers no authority; execution requires a grant in the allowed state. Reference: https://ethotechnics.org/mechanisms/patterns/capability-catalog
Product requirement
Product requirement (MEC-17) - Capability discovery succeeds for actions the system cannot lawfully perform. - A refusal names the capability, the required grant, and the grant's current state.
Audit evidence checklist
Audit evidence checklist (MEC-17) [ ] The catalog lists capabilities reachable through tools and sub-agents. [ ] Each capability records its verification method and date. [ ] Attempts to execute ungranted capabilities are refused and logged.
Postmortem trigger
Postmortem trigger (MEC-17) Trigger review when a newly reachable capability was exercised without a grant being issued for it.
Example usage
An agent that can see the payout tool it may not use
One scenario with each part of the mechanism in place.
How it plays out
An operations agent discovers the payout tool in the catalog, reads that the matching grant is in review_required, refuses the action citing the grant identifier and state, and files a request for authorization instead.
Anti-patterns
Common failure cases and counterfactuals
Each case passes on paper and fails in operation. The counterfactual shows what would have worked.
Discover equals permit
Anything the system can reach is treated as something it may do, so capability growth silently widens authority.
Counterfactual: Discovery and authorization are separate surfaces, and execution checks the grant.
Exception: Hiding a capability is not a substitute for refusing it; a hidden capability that executes is still ungoverned.
Catalog without verification
Capabilities are listed from documentation, so the catalog describes intent rather than what the system can do.
Counterfactual: Each entry records how the capability was tested and when.
Exception: Verification can be sampled; the record should say which entries are asserted rather than tested.
Diagnostics for this mechanism
Tools that size the risk this mechanism addresses.
Diagnostic
Delegation audit
Walks a team through one workflow against six questions and returns an exposure score, the permissions nobody can justify, and whether its decisions can be undone. Start here when the system keeps no decision records yet; use the record conformance checker once it does.
Cite this page · v1.2.1 · updated Oct 6, 2026 · CC BY-SA 4.0
APA
Ethotechnics Institute. (2026). Capability catalog (MEC-17). Ethotechnics Institute. https://ethotechnics.org/mechanisms/patterns/capability-catalog
MLA
Ethotechnics Institute. "Capability catalog (MEC-17)." Ethotechnics Institute, 2026, https://ethotechnics.org/mechanisms/patterns/capability-catalog.
Chicago
Ethotechnics Institute. "Capability catalog (MEC-17)." Ethotechnics Institute. Oct 6, 2026. https://ethotechnics.org/mechanisms/patterns/capability-catalog.
BibTeX
@misc{mechanism_capability-catalog,
title={Capability catalog (MEC-17)},
author={Ethotechnics Institute},
year={2026},
howpublished={Ethotechnics Institute},
url={https://ethotechnics.org/mechanisms/patterns/capability-catalog},
version={v1.2.1}
}
RIS
TY - WEB TI - Capability catalog (MEC-17) AU - Ethotechnics Institute PY - 2026 UR - https://ethotechnics.org/mechanisms/patterns/capability-catalog ER -