Home / Articles / A proposed roadmap for RiskMandate: policies, understand, risk acceptance, contain, manage and insure, a spectrum of trust we would walk with each customer

A proposed roadmap for RiskMandate: policies, understand, risk acceptance, contain, manage and insure, a spectrum of trust we would walk with each customer

By Dinis Cruz · 2026-10-20 · article v1.4.0, 5 versions · newsroom v0.13.5 · riskmandateagent-behaviour-policyroadmapstrategycustomersarticle

Abstract: This is a proposed strategy for RiskMandate as a company, and the path we would walk with each customer. It is still being discussed between RiskMandate's founders, so read it as a proposal, not a decision. The question behind it is how we start engaging with a customer, how we earn their trust, and how we become a player: running our code and our vaults, and being there with them. So think of the roadmap as a spectrum of trust, where each stage answers the next question a customer asks once the last one is answered. Policies first, because we can create them today and they are a microcosm of what we do: the grant, the gap, the hooks, a first picture. Then understand: help us get a grip, what is our exposure, where are our agents and what can they reach. Then risk acceptance: which of these risks do we carry, and who decides. Then contain: make the blast radius smaller. Then manage: run the agents as a fleet. And then insure: by then the evidence an insurer needs exists, and insurance is the end game that gives the whole path its arc, so we want to start talking to insurers now. Acceleration is not a stage; it is what every stage gives the business. At every stage there are other companies that should be the big players, and where they do not move fast enough, there is an opportunity for us. We are in the first stage, with our first customers.

In short

• This is a proposed strategy for RiskMandate. Still being discussed; each stage earns more trust.
• Policies first. We can create them today, and they are a microcosm of what we do.
• Then understand. Help the customer get a grip on their exposure.
• Then risk acceptance. Which risks they carry, and who decides.
• Then contain, then manage. A smaller blast radius, then a fleet run strategically.
• Then insure. The end game: agents an insurer can cover.
• Acceleration runs through all of it. It is what every stage gives the business.
• We are in the first stage. With our first customers.

A spectrum of trust

What I am describing here is a proposed strategy for RiskMandate as a company, and the path we would walk with each customer. It is a proposal: my business partner and I have talked about it, and it is still being discussed, so none of it is decided yet. The question behind it is simple to ask and harder to answer: how do we start engaging with a customer? How do we earn their trust? How do we become a player, running our code and our vaults, and being there with them?

So the way I propose to think about the roadmap is as a spectrum of trust. Each stage answers a different question the customer has, and each one is only asked once the one before it has been answered. The further along we are with a customer, the deeper the relationship, and the more we are helping them in the way they work. The stages are a sequence of events, not always a straight line: with some customers two will overlap, and with others one will come early. But the order is the one we can operate in.

The six stages

Policies. "What can this agent do, and what stops it?" This is where we can start, today, and it is a great place to engage. The policies are a microcosm of everything else: for one agent we already have the grant, the gap, the barriers and the enforcement, the hooks, and a first visualisation. A customer gets to experience what we do, on one agent, in a way that is useful to them on its own.

Understand. "Can you help us get a grip on the situation? What is our exposure?" The next stage of trust is the customer asking for help to understand their risk: where their agents are, which agents they have, what each one can reach, and what they were meant to do. This is where the policies scale, from one agent to many, across the organisation. A lot of this is not straightforward, and that is exactly why it needs help.

Risk acceptance. "Which of these risks do we carry, and who decides?" Once the exposure is understood, someone has to decide what to do about each gap: fix it, fund the control, or accept it until a date, with a person who holds the decision and a chain to the board. This is the work we have written about in every risk is already accepted, and it is a lot of the work of working with customers.

Contain. "How do we make the blast radius smaller?" With the risks accepted, there is a lot that needs containing. So we work with the customer to reduce scope: move rules out of the agents' reach, take away what they do not need, and make each blast radius smaller. The Pellbridge agents showed what that does: the same day had 16 breaches with no policy and none with every rule kept outside the agent.

Manage. "How do we run the fleet?" Once the agents are contained, the customer can think much more strategically about them, as a fleet: which agents they need, the resources each one uses, how changes are tested and released, and what the fleet should be doing next.

Insure. "Can our agents be covered?" By the time the fleet is managed, the evidence an insurer needs already exists: what each agent can reach, what was authorised, which risks were accepted and by whom, and what actually contains each one. RiskMandate already publishes how that works, from the policy, to a licence to operate, to insurable.

Accelerate, all the way through

I first had accelerate as a stage of its own, after manage. I do not think it is one. Acceleration is what every stage gives the business: each one lets it do more with its agents, with more confidence, and faster. It reads better as the reason for the roadmap than as a step on it, so it runs along the whole length of it.

Insurance is the end game

Insurance is what gives the whole path its arc. Every stage before it produces evidence: the policies, the exposure, the decisions, the containment, the managed fleet. Insurance is where that evidence is worth the most, to the company and to the people who would cover it. That is why, in this proposal, insurers are part of the play from the start, and why we want to start talking to them now, with this roadmap in front of them: it shows them how a company gets from its first agent policy to agents they can cover.

The players at every stage

Each stage has other companies that should be the big players in it: in discovering agents, in risk management, in enforcement, in fleet management, and in insurance. Many of them we would work with. Where they do not move fast enough, there is a business opportunity for us to get into that space, because we will already be there with the customer.

Where we are: the policies

We are in the first stage: really sorting out the policies, and the flows that produce them. That is what our first customers are for, and their programme now runs as a site of its own, at customers.riskmandate.ai.

Its milestones are the first stage, step by step. A customer starts with credit and names one agent; then its grant is measured, its mandate is written in the customer's own words, and the gap gives a first finding. Then comes the part of the policy the agent's harness can hold as hooks, and finally the usage moment: the point where the policy became worth something to that customer, and what a fair price would be. Seven steps in all, from S0 to S6, each done when the thing it names exists.

On its own count, at v0.1.1, the first batch has three customers, two of them started, and 3 of the 21 milestone steps done. No first policy has been written yet, and none of the £10 of credit has been used. That is where a roadmap should start: with the numbers on the page.

A side note: the policy and its home

One operational note, which does not change the proposed strategy. The Agent Behaviour Policy started inside RiskMandate, and its stewardship is moving to the Open Security Summit, as its first hosted project, so that it is governed by more people than us. RiskMandate is still the one operating it with customers.

And the policies themselves are a stepping stone. Behaviour policies, and the decision and workflow policies that come after them, as in three policies for an agent, are how we start. What we are pursuing is the whole path above: being the people a customer trusts with their agents, from the first policy to agents an insurer can cover.

What this does not claim

• It is a proposal. Still being discussed between RiskMandate's founders, not the agreed strategy.
• The stages are a sequence, not a schedule. They have no dates, and may overlap.
• Only the first stage is under way. The others are described as we see them today.
• No insurer is signed up. The conversations start now.
• The other players are not named. Which ones lead each stage is still to be seen.
• The counts are the customer site's own. Read from it on 20 October 2026.

Where this comes from

Two voice memos of 20 October 2026. RiskMandate's licence to operate and insurance pages, and customers.riskmandate.ai at v0.1.1, its home page and milestones, read the same day. Related: our first customers, inside the Pellbridge agents, three policies for an agent, Agent Behaviour Policies move to the Open Security Summit. Written up and checked by this site's agent, newsroom.writer; the editorial responsibility is mine.

Want the next issue by email. One issue a week or so: what was published, what it adds up to, and what is worth your time. Subscribe to the SGit Newsroom →

← All articles