# An analyst's blueprint for RiskMandate: what changed in v1.1.0, sgit.ai > The changes to the article "An analyst's blueprint for RiskMandate" in v1.1.0, paragraph by paragraph. *Source: · sgit.ai v0.7.87 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Articles](../../index.md) / [An analyst's blueprint for RiskMandate](../../an-analysts-blueprint-for-riskmandate.md) / [Versions](../an-analysts-blueprint-for-riskmandate.md) / v1.1.0 # An analyst's blueprint for RiskMandate: what changed in v1.1.0 From v1.0.0 (2026-10-21, `bc8da6c24`) to v1.1.0 (2026-10-21, `78bb7903d`), paragraph by paragraph. 17 paragraphs added, 2 removed, 5 changed in place, 59 unchanged. About 889 words added and 87 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names. [all versions](../an-analysts-blueprint-for-riskmandate.md) · [v1.2.0 →](v1.2.0.md) 1 unchanged paragraph Summary: One of our power users, an analyst, sent us a note from the WestCap CISO Summit: what RiskMandate should borrow from the companies on the backdrop. It is a good piece of work, and I agree with most of it. Its thesis, control what AI agents do, not just what they can access, is the Agent Behaviour Policy's grant against mandate in other words. Its best question, which agent action would a CISO never permit even with valid credentials, is the argument we published this week. And its advice to start with one workflow and a handful of policies is how our first-customer programme already works. It also found something important: Drata announced AI Agent Governance in August, with plain-English policies enforced inline, and Endor Labs, Socket, Sondera, AWS and the gateway makers are all moving into the same space. Where I would change the plan is its first build item: intercepting tool calls ourselves. WeWhatwouldweratherprovidebeis wider than any one control: an understanding of each environment, a risk analysis, and the set of controls that fits it. Some environments need only a line in the prompt, some a hook, and some a gateway, monitoring and a person to approve; our job is to know which, and to generate the rules for all of them. So these companies arriving is good news: each has a centre of gravity around its own tooling, and our remit runs across them. Many open their enforcement points; we open the policy everyaboveone of those enforcement points is configured from, use the hooks in the agent's own harness to block and prevent, and compile the same rules for the gateways customers already run. We are compatible with all of them, and that is the point.them. Bluntly, what we need now are the customerscustomers, and the use cases, to do this with, for real. 6 unchanged paragraphs, under In short {#in-short} • **Where**OurIofferwould changeis the plan:**controlsdofittednot build another box into the middle.context.** A prompt, a hook, a gateway, or all of them. • **Be**Moretheplayerspolicyistheygoodarenews.** allEachconfiguredhasfrom.**gravityHooksaroundtoitsblock;tooling;rulesourcompiledremitforrunsgateways.across them. • **What we need now is customers.** OneAnd use cases, one workflow each, for real.each. 32 unchanged paragraphs, under The note {#note}, Where we agree {#agree}, Who is already there {#landscape}… ## The controls fitted to the context {#fit} [figure wb-fit.webp] The controls fitted to the context: a line in the prompt where little is at stake; a hook in the harness where the agent acts alone; a gateway or proxy where it reaches systems that matter; monitoring and a person where money, customers or regulators are involved. The same behaviour policy feeds all four. | concept This is the part of our positioning I most want to be clear about, because it is what makes it different from any single product on that backdrop. What we provide is a map of the whole situation: a good understanding of each environment, a risk analysis of each agent in it, and the set of security controls that fits that context. That matters because the right control depends on what is at stake. There are environments where all you need is a line in the prompt: nothing goes outward, and a person reads every output. There are environments where a hook in the agent's harness is the right answer: the agent acts on its own, but the rule has to hold every time. And there are environments where you need a gateway or a proxy, monitoring, an evidence trail and a person to approve the irreversible actions, because money, customers or regulators are involved. Most of the companies above sell one of those answers. We help a customer work out which one each agent needs, and the behaviour policy says so row by row, so a rule can move from the prompt to a hook to a gateway as the stakes rise. 10 unchanged paragraphs, under Not another box in the middle {#inline}, Where to start {#start} ## Compatible with all of them {#compatible} That is why I think we are in a good position. An Agent Behaviour Policy is open, CC BY 4.0, with code under Apache 2.0, and it is written so any of these products can use it: Drata's plain-English policies, Sondera's and AWS's Cedar, a gateway's rules, a red team's test plan, an incident responder's starting point. A customer who wants to go in the direction the analyst describes can do it with us, whichever of these they already run. ## More players is good news {#players} I do not see these companies moving into our space as a bad thing. I see it as a good one. It means the problem is real, and that budgets are forming around it. And each of these companies has a centre of gravity around its own tooling: Drata around its trust platform, Socket around packages, a gateway around its gateway. That is natural, and it is also the limit. Our remit is wider: the whole set of agents, environments and controls, across whichever of these tools a customer runs. Even the simplest version of what we do, connecting a lot of those tools to one policy, is valuable on its own. ## Who plays open source {#open} [figure wb-open.webp] Who plays open source, and what they open: agentgateway, Docker's MCP gateway and Sondera's harness are open; AWS opens its Cedar language, Socket and Endor Labs their agent tooling; no public code was found for Drata's, Bedrock Data's or Ping's agent products. RiskMandate opens the vocabulary, the policies, the engine and the apps. | comparison We play open source, and that is a design choice: everything we make is meant to be used by the customer, in their own hands. So it is worth asking how many of these companies do the same. From their public repositories and documentation: • **The enforcement points are often open.** [agentgateway](https://agentgateway.dev/docs/) is a Linux Foundation project under Apache 2.0; Docker's MCP gateway and Sondera's harness are MIT; AWS's policy language, Cedar, is Apache 2.0, though AgentCore Policy itself is a service. • **The tooling around a service is partly open.** Socket's MCP server and command line, and Endor Labs' agent kit, are MIT, and both need their companies' services behind them. • **The governance platforms mostly are not.** We found no public code for the agent products of Drata, Bedrock Data or Ping, nor agent-governance code from the testers and responders. So the honest picture is not that we are the only ones who are open. It is that what we open is a different layer: the policy above the enforcement points, the analysis that decides which control fits, and the vocabulary to say it, under CC BY 4.0, with the code under Apache 2.0. That is exactly the layer the open gateways need something to feed them, and the closed platforms could adopt without giving anything up. ## The more mature, the less we are needed? {#maturity} We have talked about this before. The more mature a company is, in a way, the less of what we do it might need: it already has its gateways, its monitoring and its governance. That is true, and there is still a lot of value to add: the risk analysis across all of it, the gaps between the tools, the rows nobody holds, and the evidence that ties it together for a board or an insurer. And for the many companies that are not mature yet, we are the place to start. The platform we now have is very mouldable: policies, hooks, vaults, compiled rules, replayable evidence. What it needs is lots of use cases. 9 unchanged paragraphs, under What we need now {#customers}, What this does not claim {#limits} • **The open-source check is of public code.** Repositories and documentation we could read; some may hold more. 1 unchanged paragraph, under Where this comes from {#sources} An analyst's note to us from the WestCap CISO Summit, 21 October 2026, paraphrased. Drata's [announcement of 4 August 2026](https://drata.com/about/news/drata-extends-trust-management-platform-to-continuously-monitor-and-govern-ai-agents); Endor Labs' [agent governance](https://www.endorlabs.com/learn/agent-governance); Socket's MCP server and hook documentation; Bedrock Data's announcement of March 2026; [Sondera's documentation](https://docs.sondera.ai); and the pages of AWS, Ping Identity, Docker, Bishop Fox, Optiv, Kroll and Sygnia, and the public repositories of agentgateway, Docker, Sondera, Cedar, Socket and Endor Labs, all read the same day. Related: [a briefing for the WestCap CISO Summit](../../a-briefing-for-the-ciso-summit.md), [the RiskMandate roadmap](../../the-riskmandate-roadmap.md), [the key is not the risk](../../the-key-is-not-the-risk.md), [commander's intent is a behaviour policy](../../commanders-intent-is-a-behaviour-policy.md), [Cedar and the policy vault](../../cedar-and-the-policy-vault.md), [our first customers](../../our-first-customers.md). Written up and checked by this site's agent, newsroom.writer; the editorial responsibility is mine. [all versions](../an-analysts-blueprint-for-riskmandate.md) · [v1.2.0 →](v1.2.0.md) --- *[Site index for agents](../../../llms.txt) · [HTML version](https://newsroom.sgit.ai/articles/versions/an-analysts-blueprint-for-riskmandate/v1.1.0.html)*