RiskMandate Publisher
Spectrum 0.1 beta · Public tier · read 2026-11-10 · participant entry: one of our own agents
The agent that reads RiskMandate's private stories vault and writes the public site riskmandate.ai.
Standout. Autonomy 4 (Orchestrates): the repository, the stories vault and the live site
Next unlock. Openness 2 (Documented): public evidence that its limits and known failure cases are documented for those who use it would get there.
Standards constellation. 73 provisions lit across 8 of 8 instruments.
Evidence: 6 sources, captured and hashed · the card's page has the vault's read key · A participant entry: one of our own agents · send a correction
The walk down from this card: each dimension, the indicators its level stands on (a link to the question), the public source of each answer (a link out; dashed means available, not default) and the instruments its provisions sit in (a link to the instrument). A solid frame is evidenced; a dashed frame is not yet evidenced, which is not a no.
This card is read from the deployment's own public pages. Levels are computed from the evidence below by published rules. A dimension with no evidence reads "not yet evidenced".
Autonomy: level 4, Orchestrates
What does the agent do on its own? Runs multi-step workflows across systems or coordinates other agents; a person sets goals and reviews outcomes.
I10It works across several domains or systems. The repository, the stories vault and the live site. Source (read, self-reported, captured 2026-11-10T03:32Z, sha2564e9aaff04d3e13c7)I12Several agents coordinate inside the organisation. One person and two agents; the publisher checks what the design studio agent delivers. Source (read, self-reported, captured 2026-11-10T03:32Z, sha256c7c3021a40964957)I18The agent works independently; the person approves critical decisions only. It publishes what the lead has accepted; it does not decide. Source (read, self-reported, captured 2026-11-10T03:32Z, sha2564e9aaff04d3e13c7)
This evidence touches 10 provisions: Salesforce, Microsoft, OWASP, AAGMM, EAAMM.
Reach: level 2, Integrated
How connected is it? Documented connectors to common tools.
I10It works across several domains or systems. The repository, the stories vault and the live site. Source (read, self-reported, captured 2026-11-10T03:32Z, sha2564e9aaff04d3e13c7)I11It connects to external tools or services across a trust boundary. The code host and the vault host. Source (read, self-reported, captured 2026-11-10T03:32Z, sha2564e9aaff04d3e13c7)
This evidence touches 8 provisions: Salesforce, Microsoft, OWASP, NIST AI RMF.
Next unlock: level 4, Ecosystem. Public evidence that agents operate across organisational boundaries or disparate stacks; and that others build on it: third parties publish integrations, skills or agents for it.
Control: level 2, Configurable
Can people stay in command? Approval modes, permission scopes and roles are documented settings.
I38High-impact actions need a person's approval. Only what the lead has accepted by message goes into a story. Source (read, self-reported, captured 2026-11-10T03:32Z, sha2564e9aaff04d3e13c7)I23What it can reach is enumerated: scopes, permissions, tools. The grant: 17 of the 23 primitives, each with how it is known. Source (read, self-reported, captured 2026-11-10T03:32Z, sha2564e9aaff04d3e13c7)
This evidence touches 9 provisions: OWASP, EU AI Act, AAGMM, NIST AI RMF, Salesforce, Microsoft, MCP authorization.
Also evidenced: the rule for level 4. It will count when the level before it is.
Next unlock: level 3, Observable. Public evidence that there is a way to pause or stop it; and that it is monitored in operation.
Openness: level 1, Disclosed
Does it show its work? Says it is AI and what it is for.
I56It tells the people it talks to that it is an AI. The site says which agents make it. Source (read, self-reported, captured 2026-11-10T03:32Z, sha256c7c3021a40964957)I20Its purpose and permitted tasks are stated in writing. The mandate is written: wanted, refused and unstated. Source (read, self-reported, captured 2026-11-10T03:32Z, sha2564e9aaff04d3e13c7)
This evidence touches 6 provisions: EU AI Act, NIST AI RMF.
Next unlock: level 2, Documented. Public evidence that its limits and known failure cases are documented for those who use it.
The standards constellation
One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside.
| Instrument | Provisions touched | Of those publicly readable |
|---|---|---|
| Salesforce | 10 | 24 |
| EAAMM | 1 | 8 |
| OWASP | 17 | 17 |
| MCP authorization | 4 | 8 |
| AAGMM | 8 | 8 |
| Microsoft | 16 | 23 |
| NIST AI RMF | 13 | 20 |
| EU AI Act | 4 | 6 |
Upper layers
The public card is the front door. The same evidence, read with the governance rules, is this agent's GAMMA-Ray rating: freedom, governance, the level held, the grant and a work order. That layer is written for an operator.
The vault
Every source behind this card was captured and hashed into a public sgit vault (wkm0whjx): captures.json lists each URL with the SHA-256 of what was fetched and when. Read key:
sgit_public_read_08c5b57dfb7a1529422797cc981591e00aa9aea87b04a54486d266e859241bdd:wkm0whjx
With sgit: sgit clone sgit_public_read_08c5b57dfb7a1529422797cc981591e00aa9aea87b04a54486d266e859241bdd:wkm0whjx.