Risk Mandate — agents act, and someone has to own the risk

Risk Mandate begins where security stops — acceptance, funding, and ownership. No risk can be denied, only accepted for an interval and underwritten to the board.

Source: https://riskmandate.ai/acceptance.html↗

Agents act.You ownthe risk.

Security stops at the vulnerability. Risk Mandate begins where security stops — surfacing each risk so clearly, and routing it so precisely to the person who owns it, that the business funds the fix.

Security stops at the vulnerability. We begin where security stops.

Security tools are very good at finding issues. Then the trail goes cold — because the questions that decide the outcome live in a different world entirely: budgets, ownership, accountability, escalation.

That gap is where the real damage lives. Risk Mandate is the layer for what comes after the finding: acceptance, funding, and ownership.

There is no deny button.

For a deployed system, the agent already has access. You cannot deny a risk that has already materialised — pretending you can is how risk registers quietly drift into fiction. So we removed the deny button.

Accept or deny isn't the decision. How long, who owns it, what's funded.

The interval is the mandate and the priority: sign off for an hour and it's fixed within the hour. In the product it looks like a queue you work — trifecta status, exposure clock, a time-bound decision on every item.

A mandate is the right to act.

Every agent acts on delegated authority — what it may do, who granted it, and for how long. That delegation is a mandate. Agents now read untrusted content, reach the internet, and take actions on their own — the lethal trifecta — while the governance tooling that exists was built for software that does not act.

Governing the right to act — capturing the moment of authorisation, computing the blast radius, binding it to an owner — is the work of the next decade of security.

You hold the keys, not us.

The register is not a spreadsheet. It is a semantic graph — facts only, so everything in it is real — where every change cascades to the top and the picture is never silently stale.

All of it stands on SG/Vault: sovereignty, no lock-in, and a foundation that is agentic-native rather than agentic-retrofitted.

Maturity you compute, not claim.

Every acceptance you make here is a durable graph decision — owned, evidenced, time-boxed, appetite-bound. That's not just good hygiene: it's measurable. RAMM turns the five maturity levels into queries your acceptance graph either satisfies or doesn't, so using Risk Mandate is how you climb them.

Each level is a Node Type Formula — a path-pattern over the acceptance graph, tested by query, not asserted in a questionnaire.

Split by value. Free, consumption, custom.

Every tier runs the same product on the same zero-knowledge foundation. What changes per tier is how it's operated — its maintainability, scalability, and security posture — not which features are gated.

• MAINTAINOpen source, files and folders, no database to operate — no lock-in.
• SCALEAdopt incrementally: as much or as little as fits your stack, at your pace.
• SECUREZero-knowledge vault on your own infrastructure — your keys, your data.
• MAINTAINManaged runtime — versioned, provenance on every change, agent-operable.
• SCALEGrows with usage; pre-approval against risk profiles keeps acceptance scaling without nagging.
• SECURESame zero-knowledge foundation — plaintext never leaves your endpoints.
• MAINTAINSLAs, support, and guided upgrades across the version chain.
• SCALEThe underwriting chain org-wide — acceptance propagated level by level to a board view.
• SECURESovereign deployment: your region, your keys; NIST / ISO / EU AI Act alignment.

Value grows up the ladder; the security model does not change. Sovereignty is the floor, not the premium.

Lower the probability of catastrophic outcomes.

Map your autonomous risk. Accept what exists. Fund what matters. Prove you're getting safer.

Autonomous risk management for systems that act.

PRODUCT

RESOURCES