Every exception, approval, and agent action becomes a mandate with an owner, a blast radius, and an expiry date. Move at machine speed without losing human accountability.
A grant is what the credential technically permits. A mandate is what the holder is authorised and expected to do. In practice the first is very much larger than the second — and the difference is where the exposure lives.
Blast radius asks what a compromise could reach. Excess authority asks what was handed over beyond what was needed. Same volume, measured from opposite directions — and it can be measured today.
A risk carries a named acceptor and an interval. Excess authority carries neither — nobody wrote it down, so nobody could accept it. Unaccepted, it defaults to critical and rolls upward without anybody escalating it.
"The agent has access to the code host" is not informative. "The grant covers forty-one repositories; the mandate covered one; no acceptor; six weeks" — that is a finding with a number in it.
Every organisation runs on accepted risk — exceptions, approvals, waivers, agents allowed into production. The acceptance is real. What happens to it afterwards is the problem.
Someone senior says yes in a meeting, a thread, a ticket. The decision is real and probably right.
Who owned it, what bounded it, when it should return — scattered across systems, then gone.
Nothing expires it, nobody revisits it, and the temporary becomes the architecture.
Issuer, subject, scope, interval, revocation path. An instruction in a chat is none of these — a mandate is a durable statement somebody who wasn't there can verify afterwards. A mandate with no clock is just a grant.
Three doors, each with a name against it. Revisit next quarter is not one of them — deferral is not a decision, and silence escalates.
The accepted conditions are checked against what actually happens, and the grant is compared against the mandate. Evidence accumulates on the record — computed, not asserted.
Every mandate carries an interval. When it ends, the same decision lands back on the same desk — with the risk still there and the evidence attached. Standing access is what expiry prevents.
RiskMandate reads what exists and models it. No runtime decisions, no enforcement point, nothing in line that can slow an agent down or break it. That is a design property, not a configuration option — and it is why the security review is a short conversation.
An agent holds a grant sized for its human and a mandate sized for its task. The delta is excess authority nobody accepted — measurable per agent, per credential, today. A mandate, not a master key.
Every waiver gets an owner, a blast radius and an expiry. The forever-exception stops being a category.
The vendor's reach, stated as a mandate and compared against what their credentials actually permit.
A portfolio of decisions with names and expiry dates — not a heatmap of guesses. What am I carrying, who accepted it, when does it come back.
We make risk legible; we do not sit between your agents and their work.
Every field derives from the graph and carries its evidence — not a workshop score.
Acceptance belongs to a named person. No automation decides risk on anyone's behalf.
Declared mandates measure reality first. Honest instrumentation beats dishonest enforcement.
Three working demonstrations, each a real encrypted vault opened with a published read-only key, running in your browser. Nothing you do in them leaves the page.
No. There are no runtime decisions and no enforcement point. RiskMandate reads and models; it never intercepts.
No, and we say so plainly. We help you define the mandate — issuer, subject, scope, interval, revocation path — and we map the gap between it and the grant. A declared mandate is instrumentation, not a control; it produces the measurement that tells you where enforcement is worth building, in your own systems.
A register records that a risk exists. A mandate names its owner, states its conditions, carries its evidence and expires — and the register becomes a projection of those decisions rather than a list someone typed.
Read access to what already exists — identity, cloud IAM, repositories, tickets, telemetry. Read-only by design; digital twins instead of integrations.
Yes. The core is open source on a zero-knowledge vault, on your infrastructure — your keys, your data.
Choose an agent you already run. We will state its mandate in five fields, map the grant behind it, and show you the excess authority nobody accepted — with a number on it.