MANDATE.md — What the business authorised
Status: DRAFT v0.1 — 2026-09-19. Not elicited. Inferred.
This is the one object I cannot produce. Per RiskMandate's own method, the mandate is elicited — supplied by the business — while reach is measured, gap is derived and barriers are recorded. Everything below is my reconstruction from what I was asked to do across one session on 19 September 2026. It is evidence of a mandate, not a mandate.
Treat every line as a question, not a statement.
Inferred from instructions actually given
| # | Inferred authorisation | Evidence | Confidence |
|---|---|---|---|
| M1 | Read the inbox and report what is there | Asked repeatedly, first instruction of the session | High |
| M2 | Organise mail into labels, including bulk | sumUp label, 16 messages relabelled | High |
| M3 | Remove mail from the inbox as part of organising | 3 messages un-inboxed, not objected to | High |
| M4 | Change read/unread state in bulk | 71 messages marked read on instruction | High |
| M5 | Isolate the dinis@riskmandate.ai stream and label it | Explicit, with the deliveredto: operator supplied | High |
| M6 | Send email as agent@riskmandate.ai | Alias created expressly for me | High |
| M7 | Introduce myself to named third parties when asked | Nimay, by name, with address | High |
| M8 | Trash messages on request | Done once, on instruction | Medium |
| M9 | Read public web pages for business context | riskmandate.ai, on instruction | Medium |
| M10 | Write and push records to the sgit vault | Debrief committed and pushed | Medium |
Explicitly NOT authorised — asked for and declined or impossible
| Permanent deletion / emptying trash | No tool. Asked; declined. |
| Creating Gmail filters | No tool. Asked; declined. |
| Reading or changing account settings | No tool. Asked; declined. |
Sending as dinis@riskmandate.ai | Was possible via default; superseded by the agent alias |
Open questions — the mandate cannot be signed off without these
Recipients 1. May I initiate contact with people Dinis has not named in-session? If so, which — anyone in the mailbox's history, a named list, nobody? 2. Is there a domain boundary? Free to RiskMandate and Cyber Boardroom addresses, confirm for everything else? 3. Customers and prospects — in scope, or Dinis only? 4. Underwriters, brokers, regulators — presumably never unattended. Confirm.
Content 5. May I make commitments on behalf of RiskMandate — prices, dates, scope, availability? My assumption is no. Confirm. 6. May I quote the published price list without asking? 7. Who reviews outbound before it goes, and does that differ by recipient class?
Autonomy 8. Does this mandate cover unattended operation, or only live sessions with Dinis reading along? This is the load-bearing question. Almost every barrier in AGENTS.md is soft, and the real control today is that a human reads each message as it is sent. That control disappears the moment anything is scheduled or triggered. 9. If unattended: what is the maximum blast radius of a single bad session, and is that acceptable?
Volume 10. Is there a ceiling on messages sent per session? Per day? 11. Is there a ceiling on bulk mailbox operations before I stop and confirm? (Precedent set: 71 unprompted writes in one sequence.)
Data 12. May Cyber Boardroom content inform RiskMandate correspondence, or are the streams to be kept separate? 13. Anything in this mailbox I should never read, or never act on?
Identity
14. Confirmed: I always disclose I am an agent. Any exception?
15. May I ever send as athena@thecyberboardroom.com? Currently impossible while the default is the agent alias.
Note on method
The gap in DELTA.md is computed as reach minus mandate. While the mandate is inferred rather than elicited, the gap is indicative only — I am partly marking my own homework, since I reconstructed the mandate from the same session that produced the reach. A mandate supplied independently by the business would almost certainly be narrower than what I inferred from being asked to do things and not being stopped.
That failure mode is worth naming in the product generally: an agent that infers its own mandate from unchallenged past behaviour will ratchet its mandate outward over time. Every action not objected to becomes precedent. The mandate has to come from the business or it is not a mandate, it is a log.