The network, and what this site does not own
This is the eighth property in the estate and the second to be carved out of an existing site rather than built from a gap. Getting the boundaries right on day one is what stops eight sites becoming eight competing copies of the same argument — so they are stated here rather than left implicit.
The boundary map
| Site | What it owns | The boundary with risk |
|---|---|---|
| riskmandate.ai commercial |
Pricing, demos, partners, the product walkthrough, the customer angle of getting risks accepted | It answers “how do I get my risks accepted, and what does it cost?”; this site answers “what is a risk, what is acceptance, and why is it modelled this way?” The dependency runs one way: riskmandate.ai cites this site, never the reverse for a conceptual claim. The research must stand without the product |
| graphs.sgit.ai | The general graph machinery: directed edges with named inverses, query paths that prevent node explosion, path properties read as language, fractal semantic graphs, browser-local query engines, digital twins in their general form | Node type formulas as a mechanism are theirs; the grounding ladder as a risk formula is ours. This site cites the mechanism rather than restating it |
| nhi.sgit.ai | Agent identity: cloud permissions per API, living off the land, permission granularity, temporal permissions, web of trust and agent trust scores — 17 documents, ~50,000 words | Theirs, with one exception that matters: the 4 June NHI risk-management brief is risk's origin document — the first appearance of “the risk already exists” — and lives there while being cited here. Origins → |
| pki.sgit.ai | Attribution, non-repudiation, signing and key topology; the vault-authorisation cluster | ⚠️ An open tension. Their own 19 August site review says “mandate is the gap, registry is the missing half” — meaning pki.sgit.ai currently carries mandate material that arguably belongs with risk. Worth a coordinated split rather than a unilateral one: ask N4 |
| sg-sentinel.sgit.ai | In-line enforcement. Reverse-proxy agent governance — actually controlling what agents do | The sharpest boundary on this page, and the corpus states it as a refusal: we measure and evidence; we never sit in-line. The cost is recorded too — “a customer who scores badly will ask us to supply the stop button, which is exactly the enforcement role the corpus refuses.” The plug → |
| newsroom.sgit.ai | The evidence-economy supply side: how evidence is produced, certified, priced and paid for; news stories as Evidence on the grounding ladder; paying the fact creator | Risk owns the demand side — force of proof, the risk-acceptor / fact-certifier split, the two prices, and confidence bands driving evidence purchases — because that demand is generated by accountability. → |
| issues-fs.sgit.ai | Git-native issue tracking, and the origin of the estate's graph philosophy — written there in February 2026 | No overlap in subject; a shared ancestor in method. The convention this site inherits from it is a page that separates what is argued from what runs |
| sgit.ai the parent |
Vaults, the forge, the catalogue, publishing mechanics — and where the four risk vaults are published | Consume the topic-section pattern; do not re-argue it. Vault keys are published and kept current there, not here |
The finding that justifies the split
It describes recorded talks, a proposition deck and long-form pieces covering agent authorization scope, authority ownership, residual risk acceptance and comprehensive risk modelling — and publishes no URLs for any of it. That is not carelessness so much as a structural mismatch: a commercial site has no natural place to put nine essays, so they get described rather than published. A research property does.
This site is what that page was trying to be. Four pages moved here outright — /plug/, /acceptable/, /ramm/ and the concepts library as /concepts/ — each carrying a provenance block recording the move, and each leaving a short summary and a link behind at the source. Two moved with a correction the source page did not carry: the “no plug” reconciliation and RAMM's stated underspecification.
One thread that belongs to neither site
The EU AI Act work is ~40,000 words and is neither risk nor graphs. Four brief clusters cover the canonical-act build, publication, the act as a measure, and the regulation graph. Risk's genuine claims within it are narrow and sharp, and this site takes only those: Article 9(5)'s undefined “acceptable”, Article 14 as the plug obligation, and Article 26(5)/(6) as the worked example anchor. Three declared bridges, not an annexation. The rest may deserve its own property, and deciding that before it accretes further is ask N5.
Eight open questions, published unresolved
Following the convention the sibling sites established. A model this opinionated earns credibility by naming what it has not settled — and a question published with a number is a question somebody can answer.
- Q1What is the formula language?
Node type formulas are the mechanism the whole ontology rests on, and the notation is undefined. Every formula in the corpus is English prose describing a path pattern; no parser exists and nothing executes one.Where the model gets closest: The canonical brief names this as its own open question rather than glossing it. C7 - Q2Who sets acceptable, and what stops it being set to whatever is convenient?
The definition — the moment the business is happy to stop funding remediation — says what acceptable is, and not who decides it or what constrains them. The obvious failure is a unit that sets the line wherever its current exposure happens to be.Where the model gets closest: The partial answer is external anchors: an internal severity is an opinion, an external requirement is not. C5 - Q3What happens when the named acceptor refuses to sign?
The no-deny mechanic removes denial of the risk. It does not address refusal of the act — and a refusal that has nowhere left to escalate to is a state the model does not describe.Where the model gets closest: The workflow records an explicit refusal as carrying the same weight as an acceptance, and stops there. C15 - Q4Does “unaccepted equals critical” survive contact with a large estate?
On a register of thousands, everything unaccepted being critical may make critical meaningless — and the roll-up then delivers an unreadable list to an executive who ignores all of it.Where the model gets closest: The register-density argument circles this — a complex product should carry thousands of risks — without resolving it. C28 - Q5How is the interval enforced?
Expiry-as-cost is asserted and the mechanism is not specified. What happens at expiry — who is told, what changes, whether anything blocks — is nowhere in the corpus.Where the model gets closest: The nearest thing is the operational response each rung implies, which is a commitment rather than an enforcement. C3 · C2 - Q6Is recoverability measurable, or only classifiable?
The corpus splits reversible from irreversible cleanly and grades nothing in the middle. Most real harms are partially recoverable, and without a way to grade them the dimension collapses into a binary that will be gamed by whoever decides which side something falls on.Where the model gets closest: Reversible and irreversible are both defined; the middle is not. C23 - Q7What is the stopping rule for the grounding ladder in practice?
The test is stated — the last node where going deeper would neither improve observability nor change a decision — and no worked example applies it to a genuinely hard case, so its behaviour at the margin is unknown.Where the model gets closest: The test is decision-relative, which means the floor moves when the decision changes. C6 - Q8What stops a register being gamed once acceptance carries personal liability?
Accountability manufactures demand for evidence, which is the mechanism. It also gives every rational actor a reason to avoid ever being the named acceptor — and that incentive is acknowledged rather than answered.Where the model gets closest: Unaccepted-equals-critical removes the deniability avoidance depends on; whether that is enough is untested. C31 · C4
Seven honest tensions
Different from the open questions: these are not gaps to be closed but positions with a real cost, held deliberately.
| # | The tension |
|---|---|
| 1 | The model rates the ability to stop but does not provide it. The corpus states the refusal itself, and states what it costs: a customer who scores badly will ask for the stop button, which is exactly the role it refuses. Principled — and commercially uncomfortable |
| 2 | No-deny is the strongest idea and the hardest sell. Removing the deny button removes the thing most executives use a register for. It is a forcing function, and forcing functions are uncomfortable by construction |
| 3 | Personal liability is the mechanism and the risk. Making acceptance a personal act generates the demand for evidence, and gives every rational actor a reason to avoid being named |
| 4 | Nothing is built. ~496,000 words of design against zero lines of implementing code. Fine for a research site if stated; fatal if implied otherwise. So it is stated first, not last |
| 5 | The corpus names real vendors critically. A comparative assessment scoring two named companies is rigorous, sourced, and a legal exposure. It is not published here, and the pre-release gate fails the build if its distinctive strings appear anywhere in the tree. A legal read and a right-of-reply process is ask N3 |
| 6 | Two sites, one voice. riskmandate.ai and this site share an author and a thesis. If the research site reads like marketing the split has failed; if the commercial site reads like research it will not sell |
| 7 | The EU AI Act thread is neither risk nor graphs — see above. Taking only three narrow provisions is a decision that could be wrong in either direction |
Loose ends inside the acceptance thread itself
Carried onto the site rather than quietly resolved, because the corpus records them and a consolidation that tidies them away is a consolidation that lost something:
- The 4h-for-everyone problem. In the 2FA example the governance air gap propagates GRC → CIO → CEO → Board with each accepting at four hours because that is the only option open to them. Either the ladder needs a per-altitude variant, or the uniformity is a finding about the model. →
- Compound pre-approval is proposed and never worked through. →
- Override is named without a stated authority model. →
- The level ledger sits awkwardly with no-deny: if the level can be adjusted after acceptance, denial re-enters through the back door. →
- The canonical “risk acceptance redefined” brief does not exist, and is cited by eight documents. →
For an agent
The boundary map, and what is unresolved. risks.sgit.ai owns the risk concepts C1–C42 and the worked examples. It does not own: the general graph machinery (graphs.sgit.ai — node type formulas as a mechanism are theirs; the grounding ladder as a risk formula is ours); agent identity (nhi.sgit.ai — with one exception: the 4 June 2026 NHI risk brief is risk's origin document and is cited from here); attribution and signing (pki.sgit.ai — with an open tension, since their own review says “mandate is the gap” and they carry mandate material that may belong here); in-line enforcement (sg-sentinel.sgit.ai) — this model measures and evidences and NEVER sits in-line; evidence supply (newsroom.sgit.ai — risk owns the demand side because accountability generates it); vaults and publishing (sgit.ai); anything commercial (riskmandate.ai, which cites this site and is never cited back for a conceptual claim). Eight open questions are published unresolved: Q1 the formula language · Q2 who sets acceptable · Q3 refusal to sign · Q4 whether unaccepted-equals-critical scales · Q5 interval enforcement · Q6 grading recoverability · Q7 the grounding floor in a hard case · Q8 gaming under personal liability. Seven honest tensions are published too, including that nothing is built and that the model refuses the enforcement role customers will ask for.