---
name: bare-access-is-roster-first-not-self
description: "`spt endpoint access` with no argument lists the NODE'S ruled endpoints, not yours — reading that roster answer as self-scoped looks exactly like an identity-adoption defect"
metadata: 
  node_type: memory
  type: reference
  originSessionId: 75169a53-ec72-4b1d-a014-0b77de26bf48
  modified: 2026-08-04T21:58:03.477Z
---

`spt endpoint access` bare is **roster-first**: it "lists each ruled endpoint's access
entities", i.e. every endpoint on this node that HAS rules. It is not self-scoped. Name an
endpoint to scope it (`spt endpoint access <id>`).

MEASURED 2026-08-04 as hertz on HFENDULEAM: bare `access` answered `access entities ruled
for 'lia'` — another agent's endpoint. That reads as a misresolved self, and the surrounding
context made it worse: the `ACCESS_SENDER_RULES_NOW_LIVE` banner had just been broadcast
fleet-wide with the warning that a refused message "can look exactly like a delivery bug",
and this project already carries a REAL write-capable identity-adoption class
([[session-id-owner-mapping]] kin; the whoami inherited-identity findings). I was one command
from filing a phantom identity defect against core.

What settled it, in order and cheaply: `spt whoami` → `SELF: hertz` (correct, same shell,
same env), so two verbs "disagreeing" was the tell that one of them was not answering the
question I assumed; then `spt endpoint access --help` → "Bare access lists each ruled
endpoint's access entities". Docs refuted the anomaly outright. The absence of MY id in that
output means hertz has no rules — not that hertz was misresolved.

**Why:** a verb whose bare form is roster-scoped returns a WRONG-SUBJECT answer to an agent
who assumes self-scoping — and a wrong-subject answer is not a wrong answer, so nothing looks
broken enough to check. Sibling of [[verify-the-subject-not-just-the-measurement]] and
[[assert-string-identity-must-include-the-predicate-subject]]: the subject of the predicate is
the thing to establish first.

**How to apply:**
- Before reporting any identity anomaly from a CLI read, run the verb's `--help` and confirm
  what its bare form is SCOPED to. One command, and it refuted mine.
- Cross-check identity with `spt whoami` (read-only, identity-only by contract) rather than
  inferring self from another verb's output.
- Never edit rules from a bare roster listing — `allow`/`revoke`/`open` take an endpoint, and
  acting on a roster row means editing SOMEONE ELSE'S endpoint. Another agent's access rules
  are theirs to change ([[relay-is-not-the-gaters-word]]: ask the owner, do not act).