## New homepage: the grant is not the mandate · live vault demos · RiskMandate

The A/B release: a new presentation of the same operating model. **v0.11.0** is the partner-designed
homepage, ported and reframed; **v0.10.0** — the acceptance-led presentation — stays selectable in
the switcher *and* reachable from the nav, so the two ways of explaining what we do can be compared
on the live site.

- **The homepage now leads with the gap.** A grant is what the credential technically permits; a
  mandate is what the holder is authorised and expected to do; **excess authority** — grant minus
  mandate — is blast radius read from the other end: held, unauthorised, and *unaccepted by
  construction*, so it defaults to critical and escalates without anybody escalating it. The
  caveat is stated on the page, plainly: **we define the mandate and map the gap; we do not enforce
  it** — a declared mandate is *instrumentation, not a control*, and you instrument before you
  enforce. (Per the v0.33.61 brief, which corrects the 17 July grant-equals-mandate claim; the
  concept-map review carries the correction too.)
- The design keeps the partner's structure — mandate card hero, no-and-go failure chain, four-stage
  lifecycle with the struck-through third door, layer map, bento, comparison, principles, FAQ —
  restyled from the neon palette to the site's ink/green and system fonts, with the enforcement
  copy reframed for never-in-the-request-path throughout (ENFORCE & OBSERVE → OBSERVE; REVOKE →
  EXPIRE: the acceptance runs out and lands back on the same desk).
- **New top-level page: Live demos.** Three published vaults embedded natively, the same technique
  sgit.ai uses: a sandboxed iframe of the SG/Vault host with the deliberately published read-only
  key in the URL fragment — which the browser never sends to a server. Click-to-load, so the page
  makes no external requests until asked. RiskGraph Explorer (seven views; no risk orphaned;
  nobody accepts on anybody else's behalf), Agentic Browser Isolation (a page per stakeholder
  altitude; acceptance-gated escalation; no deny door), and the RiskMandate field demo (eight
  questions to a register; uses an LLM without ever holding the API key).
- **The previous homepage is preserved twice**: selectable as v0.10.0 in the switcher, and linked
  from the nav as *You own the risk* — a manifest-level entry pointing at the existing v0.10.0
  output, duplicating nothing.
- **The brand is RiskMandate, one word,** across every page, the host, and the llms/agent
  artifacts; a smoke assertion guards it. Frozen versions keep their historical wording. Demo
  wiring stays on the interim address until hello@riskmandate.ai exists.
- Smoke grows to 18 groups, including guards that the homepage carries the gap thesis and never
  reacquires the enforcement language or the neon palette.