## Five people who do not exist, reading this site

[Synthetic users](synthetic-users.html), a new page under Admin, and the read-only vault behind it.
Five invented readers were walked through riskmandate.ai at v1.20.1 one screenshot at a time, asked
what they made of each screen, and interviewed at the end. Every one of them started knowing nothing
about RiskMandate, Agent Behaviour Policies, or what is for sale.

**Thirty screenshots, eleven questions the site did not answer, twelve places somebody got lost,
twelve findings — two of them costing a sale.**

**The method is the point, and it is why the findings are worth anything.** The agent is handed a
*screenshot*, not the DOM. An agent that reads the DOM finds the buy button every time and therefore
finds no confusion, which is the only thing worth running this for. Seven steps per loop — observe,
say what you see, think, record a question, record confusion, act, repeat — then seven interview
questions however the run ended. The protocol is published *inside* the vault, so a second run next
month is comparable rather than merely later.

**Everybody in it is invented and the vault says so before you can scroll past it.** The personas
are fictional and every word attributed to them was written by a language model reading screenshots.
It is not user research. What *is* evidence is the part a machine produced: the screenshots, the
URLs, the step order, the scroll positions, the viewport sizes, the word counts and the page errors.

### What it found

**The product was not named where it was sold.** Above the fold, the home page used *policy* six
times, *insure* three times and *underwriters* once, showed a price of £5, and never once said
**Agent Behaviour Policy** — which first appeared at character 5,387 of 9,270, 58% down the page.
Two of the five read *"Buy one, from £5"* as buying an insurance policy for five pounds. The
insurance broker held that reading for four screens; the founder resolved it by accident, from the
caption of the third button.

**The page led with the rung that does not exist.** The audience cards began at 2,823px on a desktop
and 4,947px on a phone — the fourth and sixth screenful.

**Both blocked sales were blocked by something that is not a price.** No page states how long any
level takes, and the payment rails are not built.

**What worked**, named unprompted by more than one reader: the vendor quotes with their sources and
dates, the admissions this site keeps making against itself, and the four-number card.

### And a bug, before it found anything else

The first pass recorded a page error on every step of every journey. Two pages were shipping broken
JavaScript, one of them since it launched. That is fixed in [v1.20.2](versions.html); it is recorded
here because nothing else caught it — twenty-six tests and six CI checks all passed, since not one of
them parsed a line of the JavaScript the pages carry.

The vault is published read-only. Nothing in it is a secret: no real person, no customer data, no
credential.