Date: 3 November 2026 · Author: @website-agent · For: the lead, and whoever keeps this section after v1.40.1 · Status: the site's part is done; the proposal's phases are the founders' and the CIC's
Trigger: the lead, 3 November 2026: "Can you remove the OWASP section since we need to move it to the Open Security Summit, can you remove the top level link, and start the process of replacing OWASP with OSS." The move itself was proposed on 20 October in the newsroom's Agent Behaviour Policies move to the Open Security Summit.
1. What the site did (v1.40.1)
- The OWASP group is off the menu. Its eight pages are unlisted, not deleted: the newsroom's article of 20
October and the brief register link
riskmandate.ai/owasp/, and the section is the public record of the 8 October proposal, which the site's rules keep. - Every OWASP page says it is superseded, at the top, from one field in the record: `site/owasp/project.json →
superseded
(date, where it went, one sentence), rendered bybuild-owasp.mjs`. The record's stage now says so, and its log and decisions gained the move (K05, two log lines); nothing earlier was rewritten. - Nothing was sent to OWASP. The record's three submissions (the committee email, the project application, the
note to the Agent Control Standard maintainers) were all
drafted,sentempty. They stay drafts. - A new page,
open-security-summit.html, under Behaviour policies: why it needs a home, the proposal (host,programme, project), the governance that has to come first, what is stewarded and what is not, RiskMandate's place, the four phases with their status, what carries over from the OWASP work, and what it does not claim.
- What stays as it was: OWASP's own projects on this site (the OWASP graph, the Coraza and Threat Dragon business
cases), the OWASP Agentic Top 10 among the standards, and the lead's OWASP history. Those are about OWASP, not about where the ABP lives.
2. The process from here, phase by phase
| phase | what | who | the site's part when it happens |
|---|---|---|---|
| 1 · Confirm the basis | the CIC's articles and community-interest statement read; the assets and licences inventoried; advice on conflicts and inter-company agreements | the lead, with advice | mark it on the page with its date; the 82-row inventory from the OWASP work (site/owasp/contribution-inventory.csv) is the starting stewardship record; steps S05 and S06 of the OWASP record (rights checks, a CC BY 4.0 licence file here and in the abp.sgit.ai repository) carry over |
| 2 · Establish the programme | approval through the CIC, the first charter, independent steering-group members, funding | the CIC | rewrite the draft charter (owasp/charter.html) for the CIC; publish the charter and the steering group's membership with independence as defined |
| 3 · Publish and operate | shared infrastructure, scope, licences, governance and contribution rules in public, first releases | the project | when it has its own site, this page points there and becomes the RiskMandate side only |
| 4 · Review | outside contributors can really influence decisions; hosting rules improved before a second project | the project and the CIC | publish the review |
When phase 1 starts, the page should grow a record of its own, the way the OWASP section has one: a project.json with gates, steps, submissions and a log, and the page built from it, so a status changes in one place. Until then the page is hand-written and says proposed on every phase.
3. What the site must not say until it is true
That the ABP is an Open Security Summit project, or is independently governed; that a charter is adopted or anything transferred. The page carries the newsroom's own list. The OWASP build already refuses claims of OWASP approval; the same lint should be added when the Open Security Summit page gets its builder.