Underwriting, not prediction
Traditional risk management estimates the probability of a future event. This model does something else: it asks a named human to underwrite an exposure that already exists, the way an insurance underwriter underwrites a cost. That is the founding inversion, and every other idea on this site is downstream of it.
“because what we describe is reality, we are not describing the risk of something happening, we are asking them to accept it, to underwrite it. Maybe the analogy is insurance: you are underwriting the damage, the same way an underwriter underwrites the cost. The business executive is ultimately accountable for everything, so whatever they accept, they are underwriting the risk.”
The risk already exists
The move that makes the rest coherent is temporal. In a conventional register, a risk is a statement about the future: if this happens, we lose that, and here is how likely it is. In this model the exposure is present tense. The moment an over-broad permission is provisioned, the exposure is real — before any attacker, before any incident, before anyone has estimated anything.
Three things fall out of that sentence, and they are the shape of the whole model:
- The only variable is the interval. If the exposure is already real, there is nothing to decide about whether it exists — only about how long it stands before it must be looked at again. That becomes the ladder.
- Discomfort is not a decision. “I am not comfortable with this” changes nothing on its own; it is a feeling, not an act. The workflow converts it into one of three moves that do change something. The three moves.
- Denial is not available. You cannot decline an exposure that is already present, which is why there is no deny button.
Why insurance, and not any other analogy
The insurance framing is doing real work rather than decorating the point. An underwriter does not predict whether a particular house will burn down; they accept a defined exposure at a defined price for a defined term, and they are on the hook if it materialises. Every one of those four properties transfers:
| Underwriting an insurance risk | Underwriting a business risk here |
|---|---|
| A defined exposure, described in the policy | A risk node in the register, grounded downward to evidence and facts |
| A defined term — the policy period | The acceptance interval, after which it must be re-accepted |
| A price, paid in premium | A price, paid in the operational response the interval implies |
| A named party who carries it | A named person with the standing to carry it, and a physical act of signing |
The analogy also carries the part people would rather skip. Underwriting is not an administrative acknowledgement; it is the assumption of liability. The corpus is direct about this, and about why it is the mechanism rather than an unfortunate side effect:
“from a psychological and accountability point of view, it is only when you get somebody to click, or put an emoji, or accept the terms, that they really engage, because that is the moment they become accountable. And if you accept the risk today and something major happens a week or month later, you are accountable, you should have done something. This creates positive pressures.”
The second-order effect is the important one
The first-order effect of making acceptance personal is that people take it seriously. The second-order effect is the one that pays for the rest of the model.
Nobody has to fund a data-quality function to make a register accurate. Anticipated review does it: the prospect of putting your name on a decision converts care into a demand for evidence before the decision rather than after the incident. That is why this site has a grounding ladder at all — it exists because underwriting created the demand for one. The register maintains itself →
It flows upward, and across domains
Acceptance is not a single signature. It is done at multiple levels and flows up:
“risk acceptance is done in multiple levels and flows upward. A department uses a third-party agent: the person using it accepts the risk, then it goes to their boss to underwrite, then to the exec to underwrite, and eventually to the board to underwrite.”
And it crosses domains, because a technical exposure is rarely a technical risk. The person who validates that admin accounts lack a second factor is not the person who owns the consequence of an HR data breach. Keeping those two apart is the technical-owner / business-owner split, and collapsing them is the canonical governance failure the 2FA worked example is built around.
Where this loses. Making acceptance a personal act is what generates the demand for evidence — and it also gives every rational actor a reason to avoid ever being the named acceptor. The model's answer is that an unaccepted risk is rated critical and rolls upward anyway, which removes the deniability that avoidance depends on. Whether that survives contact with a large organisation is open question Q8, published unresolved.
Provenance
For an agent
C1 — acceptance is underwriting, not prediction. Do not model a risk as a probability estimate about a future event. Model it as an exposure that already exists and that a named person with standing agrees to carry for a stated interval, with accountability attached. The canonical quote: “we are not describing the risk of something happening, we are asking them to accept it, to underwrite it.” Three consequences to carry with it: the only variable is the interval; discomfort is not a decision; and denial is unavailable because you cannot decline an exposure that is already present. The second-order effect is the load-bearing one — a person who must sign demands evidence, which is what funds the grounding ladder beneath. Acceptance is multi-level and flows upward: user → line manager → executive → CEO → board. Not implemented in code.