RiskMandate — the reviewed level: two sessions, and a professional signs it

What the £1,500 reviewed level of an Agent Behaviour Policy is, in order: two half-hour sessions with your team, a behaviour policy built from the interview, a named professional's correction, and a sign-off file committed with their name and the date.

Source: https://riskmandate.ai/abp-reviewed.html↗

Two sessions, and a professional signs it.

An hour of somebody's time, split in two, with an Agent Behaviour Policy built from what they hear rather than from a form — and a sign-off file committed to your vault carrying their name and the date. This page is what happens, in order, with what we ask of you beside each step.

The same document as every other level, with a person in the room.

Every level sells one Agent Behaviour Policy for one agent in one deployment: everything it can reach, what you authorised, the gap between them, and what actually stands in the way of each thing. What the top level adds is the part that cannot be automated — somebody asking your team what is really running, correcting the mandate in the room, and putting their name to the result. What an ABP is↗ · the sixteen published examples↗.

Eight steps, and who does each one.

Written so that you can tell, at any point, whose move it is. The clock on delivery starts at your reply rather than at your payment, because the first thing that has to happen is a conversation about which agent this is for.

Read one before you buy anything

Sixteen behaviour policies are published in full with their read keys. Open the one closest to your setup and decide whether the document is worth an hour of your team's time. If it is not, nothing else on this page matters.

You buy the level, and pick who reviews it

The purchase happens at the store, which holds the cart, the order reference and the money. £300 is taken on the order and £1,200 is invoiced when the work is in your hands. The reviewer is your choice from the published list, not ours.

A person replies within a day

Not an automated mail: a reply from the reviewer or from us, naming who will run it, proposing two half-hour slots, and asking one question — which agent, in which deployment. If the reviewer you chose cannot take it, you are told before anything else happens.

Session one: what is actually running

Half an hour. Not a questionnaire and not a form: the reviewer asks what the agent is connected to, who set it up, what has changed since, and what you believed you had authorised. The answer “nobody decided that” is a useful answer here and is written down as one.

The vault is built from the interview

The reach is assembled for your shape, each row labelled by how it is known — measured, documented or derived. The mandate is written from what your team said, in their words. The gap is computed from the two and never typed by hand. Each capability gets its barrier, with the open questions recorded as open.

The reviewer corrects it, and the correction is the product

A draft nobody argued with is worth nothing. The reviewer goes through the mandate line by line against what they heard, changes what is wrong, and commits a note of what changed and why beside it — so the correction is checkable rather than trusted.

Session two: the walk-through

Half an hour. What came back, what the agent can do that nobody asked for, and which of those have nothing real standing in the way. Corrections raised in the room are captured live, and the record of what was asked and answered is committed to the vault.

Sign-off, with a name and a date

A file committed to your vault carrying the professional's name and the day they signed. The vault is yours, with your keys and its whole history, and a licence-to-operate template ships inside it unissued — issuing it is your decision to make, not ours to make for you.

An hour, two people, and no access to anything.

What you bring

• An hour, across two half-hour sessions, usually a few days apart.
• Two people: whoever built or runs the agent, and whoever answers for what it touches. One of each is enough; more is fine.
• A list of what it connects to — repositories, mailboxes, drives, ticketing, cloud accounts — at the level of names, not credentials.
• The willingness to say what was actually authorised, including where the honest answer is that nobody decided.

What we never ask for

• Credentials, tokens or keys. Not one, at any level.
• Access to your systems. We do not connect to anything of yours, and nothing we deliver sits in your request path.
• A scan, a test or a probe. We describe a deployment from what you tell us and what the vendors publish. We never test somebody else's system.
• Your data. What the agent processes is none of our business; what it can reach is the whole of it.

What is committed, and where each figure comes from.

The store holds the cart and the price; this site holds the material. Figures above were read from the store's own pages on the date beside them, so a price that moves there is detectable here rather than silently wrong. The boundary between the two sites↗ is published.

Four things this is not, said before you ask.

• Not a score. A behaviour policy describes and carries no rating, level or verdict. The document says what the agent can reach and what stands in the way; whether that is acceptable is your decision and it belongs to you.
• Not a compliance assessment, and not a certificate. Neither word appears on the deliverable, and no standards body has assessed anything here.
• Not a penetration test. Nothing is probed, nothing is exploited, and nothing of yours is touched.
• Not insurance. We are not an insurer and we place no cover. Where this is going↗ is a separate argument on a separate page.

The sign-off carries a name, so the name is published first.

Choosing the reviewer is part of buying this level. Each one has a page: what they have done, where every line of it was read from, what languages they can hold the sessions in, and what they want you to know about their own interests before you weigh what they say. Nobody is scored, ranked or starred.

Start with the agent you cannot describe.

Not the estate. One agent, already running, written down with a person's name on the result — and an hour of your team's time to do it.