Home / Articles / A proposed roadmap for RiskMandate / Versions / v1.1.0
A proposed roadmap for RiskMandate: what changed in v1.1.0
From v1.0.0 (2026-10-20, b196a772e) to v1.1.0 (2026-10-20, 3a760bc1c), paragraph by paragraph.
0 paragraphs added, 0 removed, 8 changed in place, 29 unchanged. About 27 words added and 8 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
# The RiskMandate roadmap: policies, understand, contain, manage, accelerate, then insurance, and a foundationhome to governfor the Agent Behaviour Policy outside RiskMandate
Summary: This is a proposed roadmap for RiskMandate, and two decisions. The first is about governance. On 8 October RiskMandate's two founders decided to propose the Agent Behaviour Policy to OWASP as an open project, because a description of what an agent can do should not belong to the company that sells it. It was not the right fit for an OWASP hasproject, saidso no.the So wepolicy will setmove upto the Open Security Summit instead, as a foundationhosted for it instead:project: the point is the same, that the policy is governed outside the RiskMandate organisation, which today is mostly The Cyber Boardroom. The second is the roadmap: five stages of development, then insurance. Policies, then understand, then contain, then manage, then accelerate, and then insurance. We are in the first stage: creating the policies and the flows, with our first customers, whose programme is now running at customers.riskmandate.ai. The later stages we will start as they are needed, as we get more customers and users and the offering matures. This is the plan; the stages after the first are a first reading, to be refined with the people using it.
2 unchanged paragraphs, under In short {#in-short}
• OWASPThe haspolicy said no to the project. So the Agent Behaviour Policy getsneeds a foundationhome instead.outside RiskMandate. Governed by more people than us.
• TheIt foundationwill isbe abouthosted governance. The policy is governed outsideby the RiskMandateOpen organisation.Security Summit. OWASP was not the right fit.
5 unchanged paragraphs
A foundation,home nowoutside that OWASP has said noRiskMandate {#foundation}
1 unchanged paragraph
OWASPIt haswas said no tonot the right fit for an OWASP project. The reason for proposing it has not changed, so we are going to setgive upit aanother foundationhome: forthe it.Open Security Summit, as its first hosted project. What that means, fundamentally, is that we want the governance of the Agent Behaviour Policy to happen outside the RiskMandate organisation, which at the moment is predominantly The Cyber Boardroom. The vocabulary, the schema and the published policies are already open, under CC BY 4.0 and Apache 2.0, at abp.sgit.ai; the foundationnew home is where decisions about them will be made, by people who are not only us.
16 unchanged paragraphs, under Five stages, then insurance {#roadmap}, Where we are: the policies {#now}, The later stages, as they are needed {#later}…
• The foundationhosting is aproposed. decision,The notcharter anand entity.**the Itsteering doesgroup notcome exist yet.first.
• OWASP has not endorsed anything. ItThe saidproject nowas tonot thea project.fit for it.
5 unchanged paragraphs, under Where this comes from {#sources}