diff --git a/TODO.md b/TODO.md
index f3925c0a..75faf5f0 100644
--- a/TODO.md
+++ b/TODO.md
@@ -12,6 +12,27 @@ below that proposed deleting it have been removed rather than left to mislead th
 What did NOT reverse: `execution` permissions (terminal, chat, tasks, files, desktop, browser) run as
 the owner's OS user and can never be granted. Indirection there really is accidental complexity.
 
+## Affordances
+
+- [ ] **No way to see which affordances are reaching your agents, or to turn one off.** They are global:
+      `affordanceBlock()` reads every file under `capabilities/affordances/` and is called with no user
+      context (`claude-manager.ts:582`), so every account gets every one, in every conversation.
+
+      That is fine while they are uncontroversial and stops being fine immediately after. "Wait for the
+      question" was written to one owner's taste on 2026-08-21 — probably what most people want, and
+      nobody has asked anyone. An affordance nobody can see and nobody can decline is a preference
+      imposed as a fact.
+
+      Wants: a settings screen listing every affordance with its name, description, where it came from
+      (`officer/core` versus a plugin) and its body, plus a per-user toggle. Storage is one table keyed
+      on user and the affordance's namespaced id. The work is threading a userId into `affordanceBlock`,
+      which today takes only a root path.
+
+      Two things to decide when it is built rather than now: whether a plugin can ship an affordance that
+      is off by default, and whether disabling one should be visible to the agent at all — an agent told
+      "this client renders images" behaves differently from one told nothing, and a THIRD state, "you
+      were told not to", is a different thing again.
+
 ## Plugin infrastructure
 
 - [ ] **A plugin cannot claim a WebSocket provider.** `pluginPermissions` in mount.ts sets `api` and