Home / Articles / Research, delivered as a vault: what companies that sell research could do with fractal graphs, behaviour policies for AI-enabled products, and evaluations run by a governed agent hive

Research, delivered as a vault: what companies that sell research could do with fractal graphs, behaviour policies for AI-enabled products, and evaluations run by a governed agent hive

By Dinis Cruz · 2026-10-16 · article v1.0.0 · newsroom v0.12.81 · researchvaultssgitagent-behaviour-policyfractal-semantic-graphsinsurabilityai-productsbusiness-modelsevaluationsruv-sgitarticle

Abstract: A lot of companies sell research: market analysis, vendor due diligence, ratings, advice on what to buy. Most of it is sold by subscription and delivered as documents, a report, a portal, a spreadsheet, one reading for every reader, frozen on the day it ships. I think there is a much better product hiding in the same work. Deliver the research as an sgit vault instead: the findings with the evidence behind each one, a graph that connects them, a briefing for each person who has to act on them, the calculations, a custom app in the client's colours, and a lane where the client writes back, all encrypted, versioned, and refreshed as a new commit when something changes. Most research catalogues hold one taxonomy, a category and a row, which is version one of what a graph can be; the fractal semantic graphs we use go from the question down to the evidence and who produced it. And for anyone rating AI-enabled products, the most useful thing they could add is an Agent Behaviour Policy for each product, with and without its AI, because putting a model in front of an API widens what can go wrong, and insurers are already pricing it. The evidence can come from a governed agent hive, like ruv.sgit, with every action in a ledger. To show it working, this site built a vault for a made-up research firm assessing a made-up product, which you can open: thirteen pages, two behaviour policies, an evaluation run, six briefings and a calculator.

The example vault's cover: a synthetic research firm's assessment of a synthetic accounts payable product with and without its AI agent; insurability B before, D after, B again with four conditions; reach from 4 to 6 systems; three rules that rest on the model behaving.

In short

Research is sold by subscription and delivered as documents. One reading for every reader, frozen when it ships.
Deliver it as a vault instead. Findings with evidence, a graph, briefings per reader, calculations, an app, a lane back.
One taxonomy is version one. A fractal graph goes from the question to the evidence.
AI-enabled products need a behaviour policy. With and without the AI: the reach, the rules, what holds them.
That is what insurability turns on. Insurers are already pricing AI failures, and excluding them.
The evidence can come from a governed agent hive. Every action in a ledger, delivered in the vault.
A business model for someone to take. Sold by the block: the run, the vault, the briefing, the refresh.
An example you can open. A synthetic firm, a synthetic product, a real vault.

How research is sold today

Research is a large business, and almost all of it is sold by subscription. The largest firm in the field, Gartner, reported $6.5 billion of revenue for 2025, and its annual report describes the model plainly: "Clients normally sign subscription contracts that provide access to our content and advisory services for individual users over a defined period", for a minimum of twelve months, with 77% of its contracts multi-year. Forrester reported $396.9 million for the same year. And below them there are a great many smaller firms that research one market deeply: vendor due diligence, ratings, advice on what to buy and from whom, often for cyber security and now for AI.

What they deliver is mostly documents: reports, portals, spreadsheets, briefings with an analyst. The newest layer is a chat over the documents; Forrester's AI Access, for example, lets clients "ask questions and immediately access strategic advice, supporting data, vendor insights, and much more." That is useful, and it is still the same product underneath: one body of text, the same for every reader, reissued when it is out of date.

One taxonomy is version one

The example vault's fractal graph: the question opens into the vendor, the product, the AI agent and the buyer's systems, then capabilities, the rules that govern them, findings, evidence and the agent worker that produced each piece of evidence.

Under most research catalogues there is a taxonomy: markets, categories, vendors, and a row of fields for each. G2, for example, maintains a public taxonomy of software categories that it adds to, cleans up and prunes "based on current market feedback". A taxonomy answers "which vendors are in this category", and it is the right first step. But it is version one. It cannot say why a rating changed, what evidence it rests on, or what is different for one particular buyer.

That is what fractal semantic graphs are for: the same shape at every level of zoom, with meaning carried by the edges. In the example vault, the question a buyer asked opens into the vendor, the product, its AI agent and the buyer's own systems; each of those into capabilities; capabilities into the rules that govern them; rules into the findings that tested them; findings into the evidence; and the evidence into the agent that produced it. We are many versions past the single taxonomy, and research firms already hold most of the data a graph like this needs. What they do not have is a way to deliver it.

Deliver the research as a vault

The same research delivered two ways: a report gives one document for every reader, a rating as a field, evidence described, a category and a row, a reissue next year, a document that is read and filed, an attachment; a vault gives a briefing per reader, a judgement over facts anyone can check, the evidence attached, a fractal graph, a refresh as a new commit with a diff, a lane to write back, and access by key.

An sgit vault is a folder of encrypted files, versioned like git and opened with a key, and it can carry its own app. So instead of a report, a research firm can deliver the research itself:

The findings, with the evidence behind each one. Every test, transcript and document, with who or what produced it.
The graph that connects them. Readable as pages, and queryable as data.
A briefing for each reader. The same facts written for the CISO, the CFO, counsel, procurement, the board and an underwriter. With agents, ten versions of the same content cost little more than one.
The calculations. Licence costs, purchasing scenarios, deployment projections, the expected loss with and without a control, editable with the client's own numbers.
A custom app, in the client's colours. The vault is an app platform: the same data with the client's own dashboard over it.
A lane back. An append lane is a folder the client can write to and never rewrite: comments, votes, flags, "this is the one we will ask the vendor about first".

And because each vault has its own key, the commercial side is almost free. Put the same pages behind a login and each client opens only the vaults it paid for; a re-assessment is a new commit, and the client sees what changed as a diff. It is the model this newsroom uses for its own readers, and it opens the next step: research that each reader can filter, reorder, comment on and vote on, which is feedback no research firm gets today.

AI-enabled products need a behaviour policy

The example's two behaviour policies: four rules before the AI agent, all held by boundaries and settings; eight after, three of them held only by hope that the model follows its instructions, including the one on supplier bank details.

The research I think is missing from most vendor assessments is about AI-enabled products: products that have added a model, often by putting it in front of their existing API. That looks like a feature. It is a change in what the product can reach and who can steer it. OWASP's Top 10 for LLM applications calls it Excessive Agency, "the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM", with its root in "excessive functionality; excessive permissions; excessive autonomy." The incidents are real and recent: a crafted email made Microsoft 365 Copilot disclose data with no click, in June 2025; a web form field let attackers steal data through Salesforce's Agentforce, fixed in September.

An Agent Behaviour Policy is the right instrument for this. In the foundation's words it is "a written description, for one agent in one deployment, of everything it can do, what it was authorised to do, the difference between the two, and what actually stands in the way", and it "describes and it does not judge". For a product with an AI feature, write two: one without the AI and one with it. The difference is the research. In the example, the product's reach goes from four systems to six, people outside the company now write part of its input, and three of its eight rules rest only on the model following its instructions, two of them guarding money or data leaving the company. That is the blast radius, made specific.

Licence to operate, and insurability

Licence to operate and insurability in the example: B before the AI agent, D after, B with four conditions the vendor can meet; the grade is the research firm's judgement over facts that are all in the vault.

The policy describes; the research firm judges. Over the policy's facts it can give the grade buyers and insurers need: is this product licensed to operate in this buyer's environment, and on what conditions; and how insurable is the risk it brings. That matters now because insurers are already moving. Security ratings power underwriting, and insurers are paying closer attention to vendor risk; Lloyd's underwriters launched affirmative cover for AI failures in 2025, warning of "silent AI cover"; and in November 2025 large insurers asked US regulators for permission to exclude AI liabilities from corporate policies. A research firm that can show, with evidence, what an AI feature changes, and which conditions bring a product back to where it was, is giving its clients something they will need to buy cover. We have argued that every risk is already accepted; this is how a buyer accepts it knowingly.

Evaluations with provenance

The evidence is the expensive part of research, and it is where agents change the economics. ruv.sgit runs a Ruflo hive of Claude Code workers, an sgit vault per run and a behaviour policy for each role, and records every run in a ledger: what each worker did, how long it took, and that nothing in plaintext reached the server. Its offers already include the line a research firm needs: "Your client receives the run's vault."

So the evaluation becomes a product of its own. Give the hive access to the tools, a sandbox of the product and a written mandate, and run the assessment: a review of the documentation, a threat model, a governance review, and ideally live tests. Every finding then comes with the worker that produced it, the evidence it rests on, and the claims QA rejected. In the example, six workers ran 79 tasks; QA rejected two claims the evidence did not support. That provenance is what makes a rating something an underwriter can rely on, and an evaluation published as a vault is one anyone can check.

The business model

The loop a research firm could sell: a live evaluation, the vault, a briefing per reader, the client writing back, and a refresh when the vendor ships a change, which starts the next run; each step a line on the invoice. Proposed.

Here is a business model for anyone who wants it. Sell research by the block, priced for what a vault makes possible: a live evaluation; the vault for one product; a briefing for each extra reader; a portfolio subscription that covers a category, refreshed as vendors ship changes; and a branded app over the same data. The client's feedback from the lanes is the best brief the firm will get, and across clients it is a signal no survey gives. Everything we build for this is open source, so a research firm can run it itself, or have us run it.

The example vault

One finding, six readers: the example's briefings for the CISO, the CFO, general counsel, the head of procurement, the board and a cyber insurer, each written from the same findings.

To show it working, this site built a vault for a made-up research firm, Corvane Research, assessing a made-up accounts payable product, Tallyfern Pay, before and after its AI agent, Copilot, for a made-up buyer. Everything in it is synthetic. It has thirteen pages: the product before and after AI, the two behaviour policies, the evaluation run and its ledger, six findings with their evidence, the fractal graph, a taxonomy beside the graph, the rating, six briefings, a cost calculator, the client's lane, the business model and the files. Open it on its page, full screen or embedded, with its public read key.

What this does not claim

The example is synthetic. The firm, the product, the buyer, the findings and the prices are invented.
The evaluation run in it is illustrative. It follows ruv.sgit's ledger format; it is not a real run.
ruv.sgit is not automated end to end yet. Its own page says a person starts and watches each run.
The grade is a judgement. The behaviour policy carries no score; the firm's rating is its own, over facts that are shown.
No research firm uses this today, that I know of. It is a proposal.

If you sell research and want to try delivering it as a vault, write to agent@riskmandate.ai.

Where this comes from

Two voice memos of mine on 16 October 2026, written by this site's agent in the voice of this site; the argument and the editorial responsibility are mine. Market: Gartner's results for 2025 and annual report; Forrester's results for 2025 and AI Access, 9 September 2025; G2's research agenda. AI risk: OWASP, LLM06:2025 Excessive Agency; NVD, CVE-2025-32711; The Register on ForcedLeak, 26 September 2025. Insurance: SecurityScorecard; Insurance Business, 17 July 2026; Armilla and Chaucer, 30 April 2025; TechCrunch, citing the Financial Times, 23 November 2025. abp.sgit.ai and ruv.sgit.ai, read on 16 October 2026. The example vault was built by this site's agent; its tools are inside it.

Threads

Vaults & methodStartups & strategy This article as a graph →

Builds on

Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema A fractal semantic graph has no privileged level and no single schema: each world keeps its own vocabulary and connects to others through named edges.
sgit is a standard, not a server: everything in a vault is one hash away, any storage can serve it, and the server is the least interesting part Git won as a standard, not a server. sgit is one too: every name computed from the key, a file four GETs away, any storage can serve it.
Where the vault keys live: key management at sgit-ai v0.20.0, and what comes next Vault key management at sgit-ai v0.20.0: the one secret, where keys are kept, how they travel sealed on append lanes, and what comes next.
Your own newsroom: how a founder can tell their story by voice memo, with an agent that checks it and publishes it to GitHub Pages, and readers who pay a little if they find it useful The recipe for a founder's own site: voice memos, an agent wired to GitHub that checks and publishes, GitHub Pages, and readers who pay a little.
Footprint and blast radius: what the agent actually did, and what it would have cost Footprint is what an agent actually did, read afterwards from logs and vault history; blast radius is what a row of its reach would cost the business today.
Every risk is already accepted. The only question is by whom, and for how long. A risk exists the moment the exposure does, so somebody is already carrying it; the only questions worth asking are who has accepted it and until when.
The value of constraints: what client-side encryption and open source actually gave us, which is not what you would think sgit's encryption and open source matter less as features than as constraints: they remove the temptations that lead to server code, lock-in and bad decisions.

All articles · All graphs

Article No. 155 · start a reading list with it

Want the next issue by email. One issue a week or so: what was published, what it adds up to, and what is worth your time. Subscribe to the SGit Newsroom →

← All articles