Home / Articles / A briefing for the WestCap CISO Summit: what RiskMandate and Agent Behaviour Policies are, said for each kind of person in the room, where we add value, and what to read next
A briefing for the WestCap CISO Summit: what RiskMandate and Agent Behaviour Policies are, said for each kind of person in the room, where we add value, and what to read next
By Dinis Cruz · 2026-10-20 · article v1.0.1, 2 versions · newsroom v0.12.155 · agentsagent-behaviour-policyriskmandatecisosecuritygovernancearticle
Abstract: My business partner is at the WestCap CISO Summit in New York this week, from 20 to 22 October, where security leaders, investors and founders meet. This page does two jobs. It is a briefing for him, and it is a place for the people he meets to come and see what we do. The summit's main day has panels on securing AI use and AI governance, on preparing for an AI attack, and on using AI to secure a company. Our work sits right across them. An Agent Behaviour Policy is a written description, for one agent in one deployment, of everything it can do, what it was authorised to do, the difference between the two, and what actually stands in the way. RiskMandate is where we sell one, from £10 for the pack to £1,500 for one a professional signs, with early users helped at no cost in exchange for telling us where it is wrong. The idea at the centre is one sentence: a control bounds a grant only if it is enforced by something the grant does not include. Below, that idea is said six ways, for CISOs, for AI governance and audit, for incident response and red teams, for AI-for-defence vendors, for investors and for founders, each with the articles and vaults to read first. Everything here is open, under CC BY 4.0.
In short
- The summit is about modern defence, and AI runs through it. Governance, AI attacks, AI for defence.
- An Agent Behaviour Policy writes down what an agent can do and may do. And what actually stands in the way.
- Only a rule kept out of the agent's reach is a control. That one sentence is the test.
- RiskMandate sells the policy for the agent you run. Four levels, £10 to £1,500, paid once.
- Early users get help at no cost. In exchange for telling us where it is wrong.
- The idea, said for six kinds of person. With the articles and vaults to read first.
- Everything is open. Policies, vocabulary and code, under CC BY 4.0 and Apache 2.0.
The summit
The WestCap CISO Summit runs from 20 to 22 October in New York, where, in the organisers' words, "security leaders, investors and founders meet to share the ideas shaping modern defense". Tuesday is for WestCap and its portfolio companies, on business-risk alignment, business process mapping and operational security. Wednesday is the main event, at Chelsea Piers, with five panels: rewiring the hacker pipeline; securing AI use and AI governance; preparing for an AI attack; using AI to secure your company; and industrialised abuse at mobile scale. Thursday is a startup Shark Tank, where six cybersecurity startups pitch.
Three of Wednesday's five panels are about AI, and the companies on them are a good map of the room: compliance and attestation (Drata, Schellman), data and AI security (Bedrock Data), supply chain security (Socket), risk consultancy and incident response (Control Risks, Kroll, Sygnia), offensive security (Bishop Fox), AI-native defence (Nebulock), application delivery and security (F5), and a model provider (OpenAI).
What we do, in three sentences
An Agent Behaviour Policy is, in the words of abp.sgit.ai, "a written description, for one agent in one deployment, of everything it can do, what it was authorised to do, the difference between the two, and what actually stands in the way". RiskMandate, at riskmandate.ai, writes that policy for the agent you actually run: "Give agents access. Not free rein." The test at the centre of it is one sentence: "A control bounds a grant only if it is enforced by something the grant does not include."
The words matter. The grant is everything the agent can do, measured. The mandate is what it was authorised to do, asked of the person who deployed it. The delta is the difference, derived, never written by hand. The barrier is what stands in the way of each capability: nothing, a sentence in the prompt, a setting the agent's own account can change, or a boundary kept by a system out of its reach. Only the last is a control. The site puts the point well: "Your agent can do three hundred and forty things is a shrug. Your agent can do three hundred and forty things and you authorised twelve is a finding."
Said for each kind of person
CISOs and security leaders
The question is the one they already have to answer: what can each agent reach, and what actually stops it? A policy answers it per agent, in one document the CEO, the CTO and the CISO can all stand behind. Start with what can your agent reach?, the explainer written for the person who has to decide. Then hope or enforcement, one agent built three ways, with its vault; every risk is already accepted, with the risk acceptance vault; and who are you protecting against?, six threat tiers, with its vault. Ten questions, one graph takes Phil Venables' ten questions for a CISO's management tool and answers them as a graph, with the Thistlewood twin.
AI governance, compliance and audit
For the people who attest: an agent's logs are a self-report, and a rule the agent can change is a setting, not a control. Your agent's logs are a self-report is our answer to an ISO 42001 lead auditor. Four frameworks, one agent maps the OECD principles, the NIST AI RMF, Japan's guidelines and the EU AI Act onto one agent's policy. Policy as code needs a policy first is about who can change the code that keeps a rule. And this week's trusted framework for agentic finance lines our work up with the four elements the FCA has named: agent identity, delegated authority, accountability and execution, with the Pellbridge agents, six bank agents replayed through one day with and without a policy.
Incident response and red teams
For the people who arrive afterwards: the incidents we have mapped are reach beyond mandate, and the policy is the map of where to look. Attacks rewritten as mandates takes a published list of 28 supply-chain incidents and rewrites each one that way. Footprint and blast radius separates what an agent touched from what it could have, and what each vendor's hooks can see, stop and change is the field guide to where an agent can be stopped. For skills and plugins, a skill behaviour policy.
AI for defence
For the companies building agents to defend: those agents have a grant too, and a lot of it. A policy beside the prompt proposes that every agent takes a behaviour policy as an input, next to its prompt, which the vendor accepts and enforces as far as it can. Are hooks the sweet spot? walks rules out of the prompt and into hooks, one by one, and three policies for an agent separates behaviour, decisions and workflows, with the Northstar twin.
Investors
For the people deciding where the money goes: liability needs a line, and the line is what each agent was told not to do, written down, and what keeps it. The policy draws the liability line makes the case, and ten questions about RiskMandate answers the questions an investor asks, from what stops a big platform absorbing it to who is liable.
Founders
For the people pitching on Thursday: can you sell it? is my advice to start selling what you have now, however rough, because selling is how you learn. And our first customers is what we are doing ourselves this month.
Where we add value
Most of the room sells something that acts at runtime: a gateway, an agent, a scanner, an audit. An Agent Behaviour Policy is what those are configured from. In abp.sgit.ai's words: "Not a guardrail. It is what guardrails are compiled from." So it sits alongside them, not against them: it tells a gateway which rules to keep, an auditor what to test, an incident responder where to look, and an insurer what contains the agent. It describes and does not judge, and, again from the site, "A policy cannot be dangerous. A deployment can."
It is also open. The vocabulary and the policies are CC BY 4.0, and the code is Apache 2.0, so anyone in the room can use it, including in their own products.
Next steps
- Read the explainer. What can your agent reach?, then one article from your section above.
- Pick one agent. The policy is per agent, per deployment; one is enough to start.
- Join early access. At riskmandate.ai, early users name an agent, and we build its policy and correct it with them, at no cost, "in exchange for telling us where it is wrong".
- Or buy a level. The pricing page has four, from £10 for the pack to £1,500 for one a professional signs, per agent, per deployment, paid once.
- Talk to us. Through the contact page, or to my business partner, in New York this week.
What this does not claim
- We are not part of the summit's programme. This is a briefing, not a session.
- No speaker is quoted. The panels and companies are from the public agenda.
- The fit is our reading. Each company's own site says what it does.
- Two of the four levels had not been sold by mid-September. The pricing page says so.
- The vaults are illustrative. Their banks, retailers and numbers are invented.
Where this comes from
The summit's page, read on 20 October 2026. riskmandate.ai and its pricing and early access pages, and abp.sgit.ai, read the same day. The articles and vaults linked in each section. Written up and checked by this site's agent, newsroom.writer; the editorial responsibility is mine.
Threads
Builds on
- What can your agent reach? RiskMandate and the Agent Behaviour Policy, explained for the person who has to decide RiskMandate and the Agent Behaviour Policy in plain words: what it does, why it is not real time, which agents it covers, and how it gets into the room.
- Hope or enforcement: one customer service agent, three designs, and who keeps each promise One customer service agent built three ways, each with an Agent Behaviour Policy: how much of each policy is hope, and what one run can reach.
- Every risk is already accepted. The only question is by whom, and for how long. A risk exists the moment the exposure does, so somebody is already carrying it; the only questions worth asking are who has accepted it and until when.
- Who are you protecting against? Draw the security line where the attacker is, not above it Before deciding how secure to be, name the attacker: a six-tier ladder, an air-gapped Mac mini read against it, and eight startups drawing their line.
- Ten questions, one graph: Phil Venables' acid test for a CISO's management tool, answered as a graph of the company, with risk acceptance, vaults and a twin you can open Phil Venables' ten questions for a CISO's tool are graph questions. Risk acceptance is half the answer; a twin in a vault answers all ten.
- Your agent's logs are a self-report: an answer to a GRC adviser's post on The AI Conference, with this site's own agent as the worked example, including the two commits its own counter got wrong An answer to a GRC adviser's post: why an agent's logs are a self-report, and this site's agent measured, including two commits its own counter got wrong.
- Four frameworks, one agent: iason's comparison of the OECD classification, the NIST AI RMF, Japan's guidelines and the EU AI Act, read against what runs here, with the evidence and the graphs iason's comparison of four AI risk frameworks, mapped to the behaviour policy, the footprint and the graphs that run here, with the status of each row.
- Policy as code needs a policy first: what an agent behaviour policy adds, and how to reverse engineer one from the code, the spreadsheet or the paper you already have Policy as code answers one question. An agent behaviour policy holds the rest, and can be generated into code or reverse engineered from it.
- A trusted framework for agentic finance: a reply to the FCA's Jessica Rusu, how our open behaviour policies line up with it, and a payments agent's policy with identity, delegated authority, accountability and execution filled in The FCA plans a framework for agentic finance. Our open behaviour policies cover its four elements; a vault shows six bank agents at play.
- Attacks rewritten as mandates: 28 supply-chain incidents, the column each one was missing, and why the next maintainer is an agent 28 supply-chain attacks read as reach beyond mandate: what a hardened registry stops, what only a written mandate can, and why agents change it.
- Footprint and blast radius: what the agent actually did, and what it would have cost Footprint is what an agent actually did, read afterwards from logs and vault history; blast radius is what a row of its reach would cost the business today.
- Agent hooks in October 2026: a technical debrief on what each platform lets you see, stop and change, where hooks run, and where they fail A debrief on agent hooks across ten platforms: what each can see, stop and change, where they run, and the failure modes every vendor admits.
- A skill behaviour policy: what a skill says it does, what it can do, what it is given, and the control that closes the gap, measured on 899 skills A skill behaviour policy compares what a skill says, what it can do and what it is given, then generates the control; measured on 899 skills.
- A policy beside the prompt: a proposal that every agent takes a behaviour policy as an input, with enforcement and liability attached, and why aviation and payments say the vendors should want it A proposal: every agent takes a behaviour policy beside its prompt, which the vendor accepts and answers for, as aviation and payments learned to.
- Are hooks the sweet spot? Moving an agent's rules from hope into hooks, rule by rule, until enforcement moves off the machine One agent's eleven rules, moved from the prompt into hooks and tested: four fully, two mostly, three partly, two not at all, and a gap in the leak scan.
- Three policies for an agent: behaviour says what it may do, decision says who chooses, workflow says in what order Behaviour says what an agent may do, decision who chooses at a branch point, workflow in what order. Zoom into one ABP cell and it becomes both.
- The policy draws the liability line: an answer to Ralf Thomas on agent accountability, and why every agent in a loop should take a behaviour policy beside its prompt An answer to Ralf Thomas: the shell game works because nothing is written down, and a behaviour policy's explicit prohibitions move the liability line.
- Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not Ten hard questions from a conference, answered in a two-hour interview: what RiskMandate does, what it deliberately is not, and how mature each part is.
- Can you sell it? Start selling what you have, however rough it is, because the point is not to sell, it is to learn Start selling what you have, however rough. The point is not the sale but what you learn trying, and a payment is the best signal there is.
- Our first customers: an early access programme for Agent Behaviour Policies, with credit to spend, a start-here site, daily follow-up, and a list for the next batch Agent Behaviour Policies move to execution: a first batch of customers with credit, a start-here site, daily follow-up, and a list for the next batch.
Article No. 225 · start a reading list with it
Reviews
No reviews yet.