Where we are, and what is next

Rendered from .claude/onboarding/03-state-and-next.md in the repository. The text below is that file. Source: https://riskmandate.ai/admin/agents/03-state-and-next/↗ · noindex · written by scripts/site/build-admin.mjs

Keep this file true. If you land something, move it; if you learn something, add it. Dates are the site's; check site/versions/index.json for the current version before trusting the number here.

State as at 2026-09-21, v1.28.0

• Site: 65 HTML files under site/ plus the admin console under site/admin/, one live site deployed from dev. Top-level menu: Behaviour policies · Who it's for · Insurance · Pricing · Try it · Articles · More (v1.28.0: seven entries, the cap; the Lab and the live demos are under More; the articles are unlisted beneath Articles).
• The ABP is the entry point. Homepage leads with it (v1.12.0); abp.html is the model page; agent-behaviour-policy.html is the library (menu label Agent Behaviour Policies): 15 vaults, grid and list, search over names, scopes, tools and the 23 ids, a by behaviour facet, a resizable preview panel with the label, the lethal trifecta and scenarios, #policy=<slug> deep links (v1.16.0, v1.17.0). Refused is now told not to everywhere.
• Vaults: 16 built, checked and pushed, all at the template status, all re-pushed to carry MAP-A-GRANT.md and data/scenarios.json. Renderer v5 in the new app vault vbhmlulo (the left-navigation reading app with the consequence layer, Your keys, the dual licence); fl3i7lu4 (v4) still serves the fifteen not re-pushed.

• Asked for, not built, on their own page agent-behaviour-policy-next.html (v1.17.0) with a vote and a suggestion form: Claude's Google Workspace connector, Slack, GitHub, Notion, Salesforce; and the three business functions: the CRM, the customer-service desk, finance data.
• Lab: seven entries, 16 PDF editions, the whole Lab as one file (v5).
• Can you insure a program? (v1.26.1, insure-a-program.html, in Insurance; the thread framing removed in v1.26.2 at the lead's ask): the answer, with RAND's How Is Artificial Intelligence Insured? (RR-A5130-1, 16 Sept 2026) as the context, sourced and dated: tech E&O since the 1980s, Y2K 1997–98, Munich Re's first AI policy 2018, Nexus Mutual's smart-contract cover 2019, the courts and Directive 2024/2853 on software as a product, the AI warranties and liability covers of 2023–26, the exclusions, the first insured agent deployment (AIUC / ElevenLabs, Feb 2026), and the AIUC blueprint's line that the deployment, not the model, is the unit of risk. The underwriting questions mapped to the parts of an ABP; the three steps as the strategy. Two sources refused a direct read (RAND's page, Justia) and the page says so.
• Articles (articles.html, top-level, between Pricing and More — six top-level entries, cap is seven): the article family (menu label Articles from v1.27.2; it was Writing). Three published. In this session, the agent holds the union of everything it has ever been allowed to do (20 Sept, article-union-of-every-session.html; retitled 21 Sept around the union, which is the transferable idea): how the permission union forms at the credential, the client and the deployment, each in the vendor's own words; six questions a deployer would ask with four of them silent on the help page; standing privilege named; the mandate written per purpose as the one lever left; a drawn diagram of the union accumulating across four conversations. Every article ends in a Where this connects card grid — other articles, the shape's behaviour policy, and the sibling sites (abp.sgit.ai, nhi.sgit.ai, store.sgit.ai), external cards marked in gold with an arrow. Somebody will ask what your agent can do (20 Sept, article-what-is-an-abp.html) is the introduction: the three answers people give and why each fails, the four objects and their verbs, the twenty-three primitives, the four barriers and the enforcer test, why nothing is scored, and one deployment worked end to end. An approval prompt is not a human in the loop (19 Sept, article-approval-prompts.html), on Claude's Gmail connector: the prompt's three buttons against the seven things the screen does not say, the consent that had already authorised the action underneath it, the barrier's seven holder answers from the vault, and where the accountability lands. The evidence is capture 13 in that vault's evidence/. Two on 24 Sept, from the lead's memos D14 and D15: The pilot worked. Then somebody asked what else it could do (article-pilots-do-not-stay-in-production.html), the surveys with the causes each names and a section saying no survey tests the mechanism; and A deleted meeting comes back. An edited one does not (article-calendar-edits-cannot-be-undone.html), Google's own recovery facts per action and the draft Calendar rows. A third on 24 Sept, from D20, is the first of a kind the lead wants more of, a reply to something strong seen on LinkedIn, with our world on top: Who owns what in AI. And how accountability holds on the way up (article-who-owns-what-in-ai.html). It quotes and credits a role-ownership infographic, reads its middle column as a routing table and the organisation chart as the escalation path, and walks one invented agent from nine ABP rows to the board; section 09 is the model to build from (nodes, edges with inverses, placement, clock, cease, stop check, board view). Its three figures (D21) are drawn by an inline script from the article's data, createElementNS and textContent only, nothing loaded: the blast radius can be played or changed, and its counts are the engine's. Its guide, One agent, and every desk it reaches (article-risk-propagation-visualiser.html, D24, 25 Sept), reads the figure with thirty-four captures in site/assets/articles/risk-propagation/, taken by scripts/site/capture-risk-propagation.mjs (Playwright, run by hand against a local server, not in CI); re-capture after any change to the figure, or the guide's pictures will disagree with it. Keep such replies stand-alone, factual about the source, and long enough to implement from. Five more are listed on the index as not written, each with a record already behind it.
• Try it (try-it.html, top-level, v1.28.0): the free step below the store's ladder and the first surface aimed at a stranger rather than a reader. Four steps, thirteen prompts, run in the person's own assistant against their own mailbox, hosted at abp.sgit.ai/gmail; what they end up with (grant, mandate, delta); what it honestly is not (a self report, said before they find out); the four layers; and where to say it broke. From the lead's memo of 21 September — direction__the-next-phase-is-users.md, the go-to-market direction: the measure is the number of people who run the prompts, and the queue that follows is T13 (a workflow per shape) and T14 (volume and instances on the consequence layer).
• Records: 14 items in the brief register (9 files, 5 informal); 23 releases since v1.0.0.
• Summit: Lisbon, 17–18 Sept. summit.html public; summit-booth.html private working page.
• The store is live (store.sgit.ai, 15 Sept): four levels, named by level here; the store owns every price (its boundary of 16 Sept). The homepage says view a policy / buy a policy; pricing.html is the four levels with the level-3 prompt workflow; every vault page links buy this policy to store.sgit.ai/p/<slug>/.
• After payment (v1.19.1, brief D9 the offer is built and the button is not): four unlisted pages paid-t1.html … paid-t4.html, one per level, for the payment link's success address — what arrives and when, what you do next (level 3: run MAP-A-GRANT.md, send the two files by email), how the key reaches you (out of band, never on a page), the definition of done, who to write to. pricing.html#after states the plus-one-thing rule and the definition of done per level; the homepage's behaviour-policy section carries the four levels. The £5 page is the download (v1.19.2): build-abp-pages.mjs stamps every template's zip path, size and sha256 into paid-t1.html between the /*__DIST__*/ markers from site/vaults/<slug>/dist/ (CI checks it); the page reads ?shape=<slug>, offers the file and hashes it in the browser; with no shape it lists all fifteen. Levels 2–4 are a person follows up within 24 hours (the lead's). The store still has to point each payment link at its page, level 1 with the shape. after-payment.html (v1.19.3, under More, linked from admin.html and Pricing) is the debrief for the store team: the four pages, the link contract (?order=, ?shape=), the five things the store has to do, what the site guarantees, what is open. Hand the store's agent https://riskmandate.ai/after-payment.md. The paid pages are public and indexable now, on purpose.
• Vault pages open on the vault (v1.19.0): two host frames (App Mode, vault browser) via the embed handshake, rm-abp-host in scripts/site/abp/abp-vaults.js. The site still deploys a copy of every vault under site/vaults/; removing that is T09.
• Agents' front door: CLAUDE.md + .claude/ (v1.18.0), rendered on the site by the console.
• The admin console (v1.23.0): site/admin/, written by build-admin.mjs from the repository — what needs the lead (the only filled rank), the board read off this file's queue, the memo queue read off the brief register, every docs/ document, task brief, work file and onboarding page as a console page with a twin, the vaults with measured rows and open questions, the records, the tooling. Structure adopted from store.sgit.ai/admin/ and the newsroom console. Public, noindex, not in pages.json (a link menu entry under More); admin.html redirects to it. Adding a brief under docs/ and rerunning the build is all it takes for it to have a page.

The queue, in order

From the graph brief (direction__abp-as-a-graph-and-stakeholder-views.md §4), then the research and vault queues. Each has a task brief in .claude/briefs/.

Decisions the lead owns (open)

• Behaviour or behavior on the mark (the site is British; the recommendation is behaviour).
• The Licence to Operate referent (organisation / instrument / licensee) is adopted on the site and in every vault; confirm it is a ruling.
• Publish the n8n write-up and its author, or not.
• Extend the measuring environment's gateway rule to MCP-tunnelled requests (the deployer's).
• The return address for the level-3 files (a mailbox today; a write-only vault link when it exists).
• Who the reviewing person is at level 3, and whether the Voice Debrief vaults publish the routing service's providers by name.
• Which agent branches merge next, and in what order (see .claude/work/).

Known rough edges

• The v5 app-vault mount is confirmed working on oc433z3m's live view (verified 16 Sept: the site's See it live frame renders the v5 reading app, "app via sub-vault link"). One trap for whoever re-pushes the other fifteen: when refreshing an sgit clone, do not exclude .vault/ — app.link.json and .vault/owner/ro-links.json must both point at the same app vault or the host mount fails with "No such file: app/index.html".

• docs/how-the-website-works.md is written at v1.0.0 with an addendum; the page counts and test counts in its body are historical.

• The older The problem pages (plug, acceptable, acceptance) carry an earlier voice and footer; acceptance.html has its own footer layout.

• llms-full.txt and .well-known/agent-content.json are partly hand-written and restamped by generate.mjs; they lag the newest pages.

• The Lab edition hash strips chrome as of the last commit before v1.17.0; an every-page change outside header, footer, menu script and version chip will still look like every page changed.