# RiskMandate — about: the company, the two founders, and the investor deck RiskMandate is run by two founders: Nimay Parekh, co-founder and chief executive, and Dinis Cruz, co-founder. The two people as the investor deck states them, what the company sells and where it is going, and the deck itself, eighteen slides as presented in October 2026, read slide by slide with a note on where each number comes from. Source: https://riskmandate.ai/about.html --- # Two founders, one company, and a document about one agent. RiskMandate is run by its two founders: Nimay Parekh, co-founder and chief executive, and Dinis Cruz, co-founder. What it sells is the Agent Behaviour Policy, for one agent in one deployment: everything it can reach, what it was authorised to do, the gap, and what stands in the way. Where it is going is insurability, one step at a time. This page is the company, the two people, and the investor deck as it was presented in October 2026. **The deck:** eighteen slides, [riskmandate-investor-deck-v3.pdf](assets/deck/riskmandate-investor-deck-v3.pdf), CC BY 4.0, read slide by slide in section 03. **The people behind the agents that make this site**, with a behaviour policy each, are on [the team page](team/). **This page as markdown:** [about.md](about.md) ## One question, one document, and the document is the product. The question RiskMandate answers is narrow: _what can this agent we just connected actually do, and who said it could?_ The product is the Agent Behaviour Policy, written in the open as [sixteen template policies](agent-behaviour-policy.html) for the shapes people run, and sold at [four levels](pricing.html), from a pack to a reviewed policy with a named person’s signature. The site, the templates and the tooling are open source; riskmandate.ai is one of the [sgit.ai](https://sgit.ai/) network of sites, and every vault it publishes is encrypted with its read key printed on purpose. ### The Agent Behaviour Policy available now For one agent in one deployment: the grant measured on the thing itself, the mandate in the deployer’s words, the gap derived, a barrier on every row. Never a score. ### The Licence to Operate template The business is the authority, the policy is the instrument, the agent is the licensee. [The demo](licence-to-operate.html) shows a licence written against a behaviour policy, with a term and a condition. ### The Insurability Index in design A dated record of the deployment, with the residual risk explicitly owned, in a form an insurer can read. The Index is where the deployment gets a number; the behaviour policy never does. The company, for the record: RiskMandate’s early trading runs through [The Cyber Boardroom](https://www.thecyberboardroom.com/), a company incorporated in the UK and the lead’s earlier venture; a company for RiskMandate alone, between the two founders, is being set up. The line is said in full only on [the early-adopters page](early-adopters.html), where it matters, because the people that page thanks were The Cyber Boardroom’s early users. ## Two people, and where each of them comes from. Enterprise risk and insurance distribution on one side; security engineering and the governance of agents on the other. The two lines below are the ones on the investor deck, as given on 2 October 2026; nothing is added to them here. ### Nimay Parekh Built cyber-insurance and supply-chain risk products at SecurityScorecard. Senior partnerships and product leadership across enterprise software; INSEAD MBA; White House innovation fellowship experience. ### Dinis Cruz Long-time application-security and OWASP leader. Former CISO, Holland & Barrett. Chief Scientist, Glasswall. Founder, The Cyber Boardroom. Deep focus on GenAI, security and operational risk. Runs the reviewed level: [the record behind Dinis](reviewer-dinis-cruz.html), with every line sourced. The deck’s own line for the pair: _enterprise risk + insurance distribution + security engineering + AI-native governance_. On this site the lead of the publication workflow is Dinis, as [the team page](team/) says; the agents that make the site hold a behaviour policy each, and a person is not profiled. ## Eighteen slides, as presented in October 2026. The deck says in eighteen slides what this site says in sixty pages: agents are becoming economic actors and the liability stack is not ready; the people who can say yes are not bookable and their judgement is not portable; the answer is continuous evidence plus expert judgement in one record an insurer can read. It is published here as the file the founders present from, under the same CC BY 4.0 licence as every page on this site, so that anybody we talk to can read it before and after the conversation rather than from memory. _**01** Make every AI agent insurable._ _**02 · The problem** AI agents are becoming economic actors. The liability stack is not ready._ _**03 · Why now** Three clocks started at once._ _**04 · The missing piece** The people who can say yes are not bookable, and their judgement is not portable._ _**05 · The insight** Combine continuous evidence with expert judgement into one insurer-readable record._ _**06 · The solution** Describe it. Correct it with a named person. Hand it to the insurer._ _**07 · How it works** From model-drafted evidence to human-owned accountability._ _**08 · What the insurer reads** One agent. One deployment. Four questions._ _**09 · The reviewer network** Book the people who can make the judgement credible._ _**10 · Product** A wedge today. A new underwriting primitive tomorrow._ _**11 · Market** We sit at the intersection of three fast-forming budgets._ _**12 · Business model** Three revenue lines that compound with agent count._ _**13 · Competition** Everyone owns one piece of the loop. We connect the loop._ _**14 · Go-to-market** Land with open evidence. Expand through the people who already hold trust._ _**15 · Traction** Live product, open standard, real artefacts, before institutional capital._ _**16 · Team** Cyber risk scoring meets security engineering and GenAI._ _**17 · The vision** Every consequential agent should have a licence to operate._ _**18** The trust layer for the agentic economy._ - **The counts on slide 8** (reach, mandate, gap, barriers) are read from the published behaviour policy for [Claude Code on the web](abp-vault-claude-code-web.html), and the sixteen templates on slide 15 are [the library](agent-behaviour-policy.html). Both match the site on the day this page was made, 2 October 2026; if the vault is re-measured, the site moves and the deck does not. - **The market figures** on slides 3 and 11 carry their sources on the slide itself, by name and year. They are not restated on this page, and the site makes no claim of its own about them. - **The prices** on slide 12 are marked on the slide as proposed launch economics for investor discussion. The prices the store charges today are on [the four levels](pricing.html), with the date they were read. - **The footer.** As presented, every slide’s footer said _Confidential_. The lead chose to publish the deck on 2 October 2026 and asked for the word to go, so the published file says _CC BY 4.0_ there instead, set in the deck’s own letterforms; nothing else on any slide was touched. The deck’s own page numbers run 01 to 17 and then 19, which is the file as presented. - **A second deck**, fourteen slides rendered from this site’s own numbers, with a check that fails the build when they drift, is on [the brand page](brand.html). That one is for a conference profile; this one is for a conversation about investment. ## If you are an investor, a reviewer, or someone we owe a thank you. ### Talk to us The contact page reaches both founders. Say which slide you want to argue with. ### Who runs your review The reviewed level is somebody’s time. One name today, and the list is built for more. ### A thank you For the early users of The Cyber Boardroom and the early adopters of RiskMandate: a behaviour policy corrected with you. ### Our own agents’ policies The agents that make this site, each with an Agent Behaviour Policy in the same grammar as the catalogue. What this page does not do: it does not list a company registration, an address or a cap table; it does not carry photographs; and it does not say what either founder’s agents can do, because a person is not profiled and an agent gets a behaviour policy instead.