The ten scenarios
The one piece of this corpus that reached an audience. Ten short scenarios, each written as hook → reveal → punchline, and the punchline is always the same three words. They exist to make one point to someone with no risk vocabulary at all: you already accept risks constantly, you have just never been asked to say for how long.
The ten
| # | The thing | What the reveal is |
|---|---|---|
| 1 | Every email you own | Not the inbox — every account whose password can be reset through it |
| 2 | Your calendar | Who you meet, when, and what you are about to do next |
| 3 | Your private messages | The conversations you would not put in email, and the tone you use in them |
| 4 | The company card | A spend limit is not a control if the detection is slower than the spend |
| 5 | The OAuth token | What it was scoped to, versus what is reachable from it |
| 6 | All your repositories | Source, history, secrets committed and reverted, and the deploy path |
| 7 | The production database | Read is bad. Write is worse, and write is the one you cannot undo |
| 8 | Your unlocked laptop | Every stored credential and every live session, at once |
| 9 | A database of customers' passwords | Not your risk to carry — theirs, carried by you |
| 10 | One customer reaching another | The multi-tenant failure, which is the one that ends a company |
The shape, and why it works
A concrete thing the reader owns, named in their own words. Not “an over-permissioned identity” — your inbox.
What that thing actually reaches. This is authorization closure delivered as a surprise rather than as a definition, and the surprise is doing the teaching.
“How long?” Always. Never “would you accept this?” — which invites a no that the model does not offer.
Slide four is the ladder
The presentation's fourth slide shows the interval choices, and they are the ladder exactly as it appears everywhere else on this site: an hour, four hours, a day, a week, a month, six months. No explanation of what each one means — the reader works that out by trying to choose one, which is a better way to learn it than a table. The ladder, with the operational response per rung →
Why a research site publishes marketing content
Because it is a research artefact regardless of what it was written for. Ten scenarios that reliably move a lay reader from “risk is a compliance topic” to “I am carrying something and I did not choose the term” is a finding about how this model communicates — and it is the only such finding the corpus has, because it is the only part of it that was tested on an audience.
It is also the honest half of what shipped. The engine is not built and the scenarios are; a research site that lists its outputs should list the one that exists before the ones that do not.
Where the boundary falls. The interactive scenario product — the gamified survey, the capture flow, the presentation as a sales artefact — stays on riskmandate.ai. What is published here is the source research artefact: the ten scenarios, their shape, and why the punchline is a duration rather than a question. Same material, two framings, and the dependency runs one way. The boundary map →
Provenance
For an agent
The ten scenarios. Ten short scenarios, each hook → reveal → punchline, and the punchline is always “how long?” The ten things: every email you own · your calendar · your private messages · the company card · the OAuth token · all your repositories · the production database · your unlocked laptop · a database of customers' passwords · one customer reaching another. The rhetorical move is the point: they never ask whether you accept — asking “how long” means the reader has already accepted by the time they answer, and the only thing they chose was the interval. That delivers the whole model with no vocabulary. Slide four shows the interval choices, which are the ladder exactly: an hour, four hours, a day, a week, a month, six months. Written 2 July 2026; this is the corpus's only audience-tested artefact and one of the few things in it that actually shipped. The interactive scenario product stays on riskmandate.ai; the research artefact is published here.