Five people who do not exist, reading this site

Synthetic users↗, a new page under Admin, and the read-only vault behind it. Five invented readers were walked through riskmandate.ai at v1.20.1 one screenshot at a time, asked what they made of each screen, and interviewed at the end. Every one of them started knowing nothing about RiskMandate, Agent Behaviour Policies, or what is for sale.

Thirty screenshots, eleven questions the site did not answer, twelve places somebody got lost, twelve findings — two of them costing a sale.

The method is the point, and it is why the findings are worth anything. The agent is handed a screenshot, not the DOM. An agent that reads the DOM finds the buy button every time and therefore finds no confusion, which is the only thing worth running this for. Seven steps per loop — observe, say what you see, think, record a question, record confusion, act, repeat — then seven interview questions however the run ended. The protocol is published inside the vault, so a second run next month is comparable rather than merely later.

Everybody in it is invented and the vault says so before you can scroll past it. The personas are fictional and every word attributed to them was written by a language model reading screenshots. It is not user research. What is evidence is the part a machine produced: the screenshots, the URLs, the step order, the scroll positions, the viewport sizes, the word counts and the page errors.

What it found

The product was not named where it was sold. Above the fold, the home page used policy six times, insure three times and underwriters once, showed a price of £5, and never once said Agent Behaviour Policy — which first appeared at character 5,387 of 9,270, 58% down the page. Two of the five read "Buy one, from £5" as buying an insurance policy for five pounds. The insurance broker held that reading for four screens; the founder resolved it by accident, from the caption of the third button.

The page led with the rung that does not exist. The audience cards began at 2,823px on a desktop and 4,947px on a phone — the fourth and sixth screenful.

Both blocked sales were blocked by something that is not a price. No page states how long any level takes, and the payment rails are not built.

What worked, named unprompted by more than one reader: the vendor quotes with their sources and dates, the admissions this site keeps making against itself, and the four-number card.

And a bug, before it found anything else

The first pass recorded a page error on every step of every journey. Two pages were shipping broken JavaScript, one of them since it launched. That is fixed in v1.20.2↗; it is recorded here because nothing else caught it — twenty-six tests and six CI checks all passed, since not one of them parsed a line of the JavaScript the pages carry.

The vault is published read-only. Nothing in it is a secret: no real person, no customer data, no credential.