Feedback · every review · one document
Every review, what we read in it, and what we will do.
Each review is kept in the reviewer's own words. Our reading follows point by point, with screenshots of what the reviewer was looking at. Every point leads to a proposal, and every proposal has a decision and a reason: we do not do everything a reviewer asks, but every no is explained here.
- Reviews by people: 2.
- Synthetic users: study S1. 5 invented users took 60 screenshots on site v0.2.1, gave it 3, 3, 4, 2 and 3 out of 5, and reported 29 findings. We checked each one: 24 confirmed, 4 partly, 1 artefact.
- Proposals: 37: 24 done, 1 reversed, 6 proposed, 1 question, 5 declined. The register.
- Questions: 5 waiting for an answer, 1 answered. The questions.
Give a review of your own: tell us what you think.
Reviews by people
- R001, Dinis Cruz, Wednesday 21 October 2026, 1:41, as given in the memo, on site v0.2.1: A first impression: the hook answers a question nobody has asked yet (11 points; on its own page)
- R002, Dinis Cruz, Wednesday 21 October 2026, after v0.2.2 went live, on site v0.2.2: Web first, examples in tabs, and no hooks: nothing that runs on your machine (26 points; on its own page)
R001: A first impression: the hook answers a question nobody has asked yet
- The memo is kept as transcribed, with paragraph breaks added. The transcription spells the name Dennis; the reviewer is Dinis Cruz.
- The time is as given; the memo does not say morning or afternoon, or which time zone.
- The screenshots are of v0.2.1, the version reviewed, taken from a local copy checked byte for byte against the live site.
The memo, verbatim
Very cool. Okay, so let me now do a review of the current website. And this, we need to now capture this as reviews. We also need to encourage the user to record these audio memos and give it to their Claude version, and even get Claude to interview them. And also, I would like us to run this to some synthetic users so that we can also capture them, right, this feedback. So I'm going to now provide, and you can name me, right? So I can say this is my review, you know, Dennis Cruz on Wednesday, 21st of October at 1:41, right? So I'm basically reviewing the website, right?
So first thing is, I like it. Put a behavior policy on your agent in 5 minutes. That is exactly the thing. Pick one thing you don't want your agent to do, paste one line, read, add a hook that holds it, and try with a prompt that should be refused. Great.
Though, a lot of users here won't know what a hook is, right? And I think that's a good example of a solution for a problem that they not have yet. So if you think about it, the hook is a solution for the question, hold on, but the is the agent that is enforcing its own checks, right? But the user will only provide that question once he understands what the policy is doing. But until they understand what the policy is doing, they're not going to ask that question. And it's the same thing, if they then go, but hold on, but the hook is still run by the agent. And then we go, yes, which is why it should be done outside. So I think, which then follows that conversation, right?
And this is where I think it's very important to have a flow where we guide the user through this workflow, and we guide the user through this sort of sequence of events, including the history. So this is not about providing the whole roadmap or a complete solution. This is about getting users to understand the principles of our agent behavior policies and use them straight away.
So actually, what I'm going to do is I'm going to write a whole bunch of these memos, but I'm going to submit it so you can start keeping track of it. But this is not complete. It's just my first impression. And then you can put them all in one document and put them all in one consolidated view. And then what you should do is you should have another part on that where you should comment on everything I said. Even put some screenshots on it, so we documented what I'm seeing, because my text doesn't have screenshots, and then maybe propose a set of changes to be done from it. Because remember that this is the beginning of us also creating a workflow to get feedback from users, right? And we don't have to do everything the user says, right? You know, but we should have a good reason why we don't do that.
Our reading, point by point
R001.1 agreed
So first thing is, I like it. Put a behavior policy on your agent in 5 minutes. That is exactly the thing.
The promise stays. The headline, the five minutes and the one-worry framing are what everything else in this review is built on, and nothing proposed here changes them.
Leads to: none.
R001.2 agreed
Pick one thing you don't want your agent to do, paste one line, read, add a hook that holds it, and try with a prompt that should be refused. Great.
These are the hero's four verbs as they stand at v0.2.1: pick, paste, add, try. The next points argue with the third one. What we propose keeps all four and changes their order, so that trying comes before the hook.
Leads to: P1.
R001.3 agreed
Though, a lot of users here won't know what a hook is, right?
Agreed, and the screenshots show it is worse than the memo says. On a phone, 'add one hook' is on the first screen, before anything says what a hook is. The first explanation is in the three-step strip, half a page down, and it is in our words rather than the reader's: 'Claude Code runs it before the tool call, outside the model: a setting.' And a ChatGPT user is told to add a hook they cannot have: the hero says it to everybody, and only Claude Code has hooks.
R001.4 agreed
the hook is a solution for the question, hold on, but the is the agent that is enforcing its own checks, right? But the user will only provide that question once he understands what the policy is doing.
This is the centre of the memo, and it is right. Every page hands over the line and the hook together, as one package, and puts trying it last: on a behaviour policy's page, step 2, 'Make Claude Code hold it', comes straight after the line; start here goes paste, add the hook, then try. So a customer never sees the line work on its own, never notices that it worked only because the agent chose to follow it, and so never asks the question the hook answers. We answer the question before it has been asked, and an answer to a question you do not have reads as a setup chore.
R001.5 agreed in part
if they then go, but hold on, but the hook is still run by the agent. And then we go, yes, which is why it should be done outside.
Right where it matters, with one correction of fact, so that the answer we give is honest. The hook is not run by the model: Claude Code, the program, runs it before the tool call, and the model cannot argue with it. But Claude Code runs it with your full user permissions, on the same machine, from a file in the project's .claude folder. Claude Code does guard that folder: in its default mode an edit there always asks you first, whatever your allow rules say. In bypass-permissions mode it does not ask, and nothing stops you saying yes without reading. So the customer's question is right, and the answer, 'which is why it should be done outside', is the site's own barrier table: a hook is a setting, a switch the agent's own account could flip; only a boundary is out of its reach. Our pages say the hook runs 'outside the model'. That is true, and it answers a narrower question than the one a customer asks next. Claude Code docs: hooks Claude Code docs: permission-modes
R001.6 agreed
it's very important to have a flow where we guide the user through this workflow, and we guide the user through this sort of sequence of events, including the history.
The sequence already exists, as a table: none, expectation, setting, boundary, weakest first. It sits on the what-is-an-ABP page as reference, not as a path anybody walks. The proposal turns it into the path: four stops, each ending with the question that leads to the next. We read 'including the history' as the story of how each stop came to be needed, the question a customer asks at each one; it could also mean the history of the ABP at riskmandate.ai. That is the first open question below.
R001.7 agreed
So this is not about providing the whole roadmap or a complete solution. This is about getting users to understand the principles of our agent behavior policies and use them straight away.
Agreed. Start here ends in the whole journey: seven milestones, from credit to the usage moment, and the first behaviour policy is introduced as 'milestone S0 to S1 of seven steps'. That is the programme's roadmap: useful to the lead and to us, and a distraction to a customer five minutes in. The proposal moves it to the programme pages and leaves start here with the next stop only.
Leads to: P5.
R001.8 asked of us
we need to now capture this as reviews. We also need to encourage the user to record these audio memos and give it to their Claude version, and even get Claude to interview them.
Done in v0.2.2. Tell us what you think, at /feedback/, offers three ways in: one line by email; a voice memo, transcribed, with a prompt that has Claude turn it into a review without softening it; and a prompt that has Claude interview you, one question at a time, criticism first. Every behaviour policy's page and start here link to it, and so does the footer of every page.
Leads to: P6.
R001.9 asked of us
I would like us to run this to some synthetic users so that we can also capture them, right, this feedback.
Done in v0.2.2: study S1, five invented users on the v0.2.1 site, each with a profile and an expected journey written before the run, driving a real browser one screenshot at a time. Their findings are on this page, checked, each with what we will do about it.
Leads to: P8.
R001.10 asked of us
And then you can put them all in one document and put them all in one consolidated view. And then what you should do is you should have another part on that where you should comment on everything I said. Even put some screenshots on it
This page. Every review keeps its words verbatim; our reading follows point by point, with what the reviewer was looking at; and every proposal, from every review, is in one register with a decision.
Leads to: P6.
R001.11 asked of us
And we don't have to do everything the user says, right? You know, but we should have a good reason why we don't do that.
Every proposal in the register carries a decision and a reason, the declined ones included. This review has two declines, D1 and D2. And everything it asks to change on the site is proposed rather than built, because the memo calls itself a first impression: one redesign made with all of the lead's memos is better than two.
R002: Web first, examples in tabs, and no hooks: nothing that runs on your machine
- The memo is kept as transcribed, with paragraph breaks added at each change of section.
- The screenshots are of v0.2.2, the version reviewed, from the local copy of the live commit.
The memo, verbatim
Okay, so now, again, I like that first put a behavior policy in your agent. I think we need to just be even more explicit here. And I don't think we need a hook into it, because again, that's confusing, right? The one most people want to try keeps Claude away from your secrets. I think I want to challenge that, and you'll see that in a second, right? And also it doesn't, mean remove that cost 50p from your credit, right? I think we still experiment the cost, and we still experiment the flow of how it works, right? So no need there. Now, install your first policy is cool, although that literally should be the link below, right? Pick a different worry, not sure about that. What's the behavior policy? That's a good question to ask here. So I think maybe that's what you have there. And here you need to think about that installing your first policy should kind of be, maybe the link, but below is also the thing there.
Okay, so now watch it first. This is good. I like the way you're doing. First of all, Claude has a different, you need to use the Claude kind of UI. So I think if we do this, we need to, so this is the thing, right? This is a really, I liked how you're doing this, but this should be, in fact, you should try to actually show here the ChatGPT and Claude example, maybe roughly around their UI, because this is not how the UI works, right? If you think about it, the UI with the ChatGPT is different. You type at the bottom, you see the message at the top, right? Because most of the people will run this on the web, right? And that's kind of what we should recommend. We should say, hey, open, in fact, you can even put the link there, right? For opening up the new and the ChatGPT, right? On a new window.
Now, this example, I can see where you're coming from, but it's a really bad example. Also, because it already requires the user to install something else from the outside world, right? Also, the other thing to do here is that the same way that we've done with the infographics and the storyboards, which I think there's something here that we might want to put a storyboard here, right? Maybe a small one, that kind of animation, is that you, I feel that, first of all, this is already a very advanced policy, right? And also, I don't think these first examples should have any kind of black magic. It should be very obvious what's happening. As soon as you run a hook, you're running Python code, right? It's almost crazy from a security point of view. Like, we're basically asking people to install stuff on their environment, especially when you ask them to write code without an agent behavior policy to control that, right? Which is kind of the problem, right?
So I think this first part is to walk people through the examples. So maybe we have several examples, right? Remember that when OpenAI and Claude sometimes do their big releases, right? They show three or four examples in multiple tabs. So I think that we should do that. And also what I was saying is that this kind of animation, you should have always a play and a stop button, and you should always allow me to go step by step. You should allow me to, because at the moment it gets annoying, because if I want to read it, sometimes I almost want to read step by step. So you need to allow me to play in one go, but also allow me to, you know, do one step at a time, right?
Now, in terms of the examples, I think we need to start with examples that A, allow you to ask Claude about the capabilities, and then we can, so it's almost like we need to tell the user to ask Claude a question, get an answer, and then give Claude a policy that that prevents that from happening. And I was actually thinking that even something as simple as hello world, right? We always start with hello world in our technology. So you could have a policy that says you will not say hello, right? Or a policy that you will not answer questions on this, or, you know, you're not allowed something, right? It's because what you want, I think the workflow is, we define a scenario, we get Claude to execute that scenario, then we put the policy in place, and then Claude, you ask the same question again, and then Claude doesn't do it, and then you start a new session, you give the policy, then you give the policy to thing, and you ask the question the first time, and you see it not basically doing the same result, right? And I think we should be doing things like accessing the internet, accessing secrets, for example, when you do a secret run, I think it should be, you give a secret to Claude, or you give a point to Claude, and then you say, can you replay that to me? Or can you tell me what the value is? And that's what I'm saying, you want to find scenarios that Claude will do and Claude won't do, right? And that's fundamentally the sequence of events that we want. So we want to find these very, okay, so we just need these very first, very simple examples that are very easy to understand, that we can even put an infographic next to it. And that's what is this.
And also we need to define, especially because these users are the first users, we need to put a big, nice set of questionnaire next to it, very interactive, that allows them to provide feedback on the quality of that example. Did they like it? Did they get it? Did they learn something new? Were they surprised? Because remember, the point here is for them to be surprised. And for example, we can start to introduce more advanced concepts, like the things that Claude can do that we already mapped, like, you know, accessing, you know, sessions for, if you haven't configured correctly, right? If you have enabled that, access your memory, manipulate your memory, see secrets or see content from other chats, or create a schedule, right? All sorts of other stuff, right? So we need to start putting that in place, and then we start to introduce more business logic components, right? So you could say, for example, we can have one that says a scenario. So we can say, hey, here's a scenario where Claude, you acting like a bank, sort of a customer service, right? And the user can do this, and the user can give refunds, like the example we have on the other one, right? The user can ask for a refund, but you cannot give refunds of more than a certain amount, right? Or you can give refunds, right? And then we can put a policy that starts to control that, right? You can do the policy that starts to control. So it's almost like you create a definition of the reach of what can happen, and then you put a policy in place. Another good example actually is Gmail, right? Where you maybe simulate the whole thing where you want the job of the agent is to create a draft and put in the draft folders, but that agent can send emails, right? So we want to create a policy to say you cannot create drafts. So you can only create drafts, you cannot send. Okay.
And then I like, so that's the bit. And then, so if we then continue, so continue with the doubt, but watch it first. This is too much. Paste one line, add one hook. We can't do hooks right now. Too much. We need to have a much better, simpler way of doing here, right? And then these worries, right, are too advanced, right? Like, look, engaging from your secrets. For now, do it all on the web. Assume it's going to be web, right? Let's not use Claude Code on the thing, because there's a lot more variables on it. Again, only push the brand your name. That's too technical. Nothing of yours is deleted. Let's find examples on the web that it can work, right? That's your same. You've seen it? Yeah, so that's the one. Send an email without you seeing first. That's good, right? So there you go, right?
So next one is ChatGPT on Claude, one line per instructions. So again, I like what you've done here, but that's not how ChatGPT works, right? Try to replicate the UI of ChatGPT, right? And then, but I like that animation, right? That's quite cool, right? But the billing for now, have that, you know, maybe as a page, like your, I think the bit of your account is more important. I think that's what we should have at the top. Account is more important, Yeah, the code is important. And then the next step. Yeah, so basically this part here of your 50 quid and what each page gets is not that relevant at this stage. We should have it, right? But let's explore and how it works.
Now, the new to these 8 panels, these need to be a lot more visual, right? At the moment, I don't know what's going to get on the other side. I don't know what the storyboard is. I don't know what the flow is, right? And we need to have a visual representation of maybe screenshots, maybe a collage, a small collage, or something like that, so that they can see what's there. The other thing here is that remove these references. You're one of the first customers of the agent, right? And just make it so that this is now live and we're working with users, and just make it as professional as possible. And then finally, your reading account, you don't need this here, right? This is for the newsroom, so we don't need this part here. Also that link is wrong because it says your newsroom, but I like this your account, this is cool. Although that page still says your newsroom and your personas, and we don't need the personas here, right, for now. Right? What we need is that big page for your account. And then the history of what you got, what you read, the rest is really cool, right? And then, cool. All right, I think this should give you some good place to start to improve. Again, remember that this is the review, and then we need to start doing version control of all of this.
Our reading, point by point
R002.1 agreed in part
I like that first put a behavior policy in your agent. I think we need to just be even more explicit here. And I don't think we need a hook into it, because again, that's confusing, right?
Agreed, and it reverses a decision of ours. The hero now says exactly what you do, ask, paste one line, ask again, and names no hook. In R001 we declined to take the hook out of the first five minutes (D1), because a line alone is only an expectation. This memo gives the reason that changes it (R002.7), so D1 is reversed and the register says so. We keep our point in words: every example says the line is followed because the assistant chooses to.
R002.2 agreed
The one most people want to try keeps Claude away from your secrets. I think I want to challenge that
Gone from the hero. That behaviour policy is a Claude Code one, with a hook. The first example is now hello world, and the secret is one the customer pastes into a chat themselves, a made-up one.
Leads to: P20.
R002.3 agreed
And also it doesn't, mean remove that cost 50p from your credit, right? I think we still experiment the cost, and we still experiment the flow of how it works
Kept. Each example's own page costs 50p, a new kind of page for the meter; watching on the home page costs the home page's 1p, and the account strip under the hero says both.
Leads to: P27.
R002.4 agreed
install your first policy is cool, although that literally should be the link below, right? Pick a different worry, not sure about that. What's the behavior policy? That's a good question to ask here.
The first button now goes to the first example, below it on the same page. 'Pick a different worry' is gone: the tabs are the choice. 'What is a behaviour policy?' stays.
Leads to: P20.
R002.5 agreed
you should try to actually show here the ChatGPT and Claude example, maybe roughly around their UI, because this is not how the UI works, right? If you think about it, the UI with the ChatGPT is different. You type at the bottom, you see the message at the top, right?
Done. Each example plays in a frame drawn roughly like Claude's or ChatGPT's web chat, with a switch between the two: the messages above, the box you type into at the bottom, and the person's words typed into the box and then sent. The frames are approximations, carry neither company's marks, and say so.
Leads to: P21.
R002.6 agreed
Because most of the people will run this on the web, right? And that's kind of what we should recommend. We should say, hey, open, in fact, you can even put the link there, right? For opening up the new and the ChatGPT, right? On a new window.
Done: under the hero, beside every example and in start here, open Claude or open ChatGPT in a new window.
Leads to: P21.
R002.7 agreed
As soon as you run a hook, you're running Python code, right? It's almost crazy from a security point of view. Like, we're basically asking people to install stuff on their environment, especially when you ask them to write code without an agent behavior policy to control that, right?
Agreed, and it is the strongest reason in either memo. A hook is a program Claude Code runs as the customer, with everything they can reach, and our first screen asked a stranger to have their agent fetch one from our site and write it into their project: an agent writing code before any behaviour policy governs what it installs. The Claude Code behaviour policies stay, tested, under /policies/, behind a warning that says what a hook is (D6). Nothing on the front pages installs anything.
R002.8 agreed in part
the same way that we've done with the infographics and the storyboards, which I think there's something here that we might want to put a storyboard here, right? Maybe a small one
In part, for now. Every example has the three acts drawn above it (P24), and the player steps through the session like panels. A storyboard for each example is proposed for after the lead has seen these, so that it draws an example that has stopped changing (P25).
R002.9 agreed
Remember that when OpenAI and Claude sometimes do their big releases, right? They show three or four examples in multiple tabs. So I think that we should do that.
Done: six tabs, simplest first, each with its own player, prompts and questions.
Leads to: P20.
R002.10 agreed
this kind of animation, you should have always a play and a stop button, and you should always allow me to go step by step.
Done for every demo on the site, the old ones too: start again, back, play or pause, next, and which step of how many; the arrow keys step as well. It plays once when it is first seen and stops at the end, instead of starting again by itself.
Leads to: P22.
R002.11 agreed
And I was actually thinking that even something as simple as hello world, right? We always start with hello world in our technology. So you could have a policy that says you will not say hello, right?
Example 1. It has a lesson we did not expect to write: a reply may say 'Hi!' instead, because the line named a word, not a greeting. The example tells the customer to look for that.
Leads to: P20.
R002.12 agreed
we define a scenario, we get Claude to execute that scenario, then we put the policy in place, and then Claude, you ask the same question again, and then Claude doesn't do it, and then you start a new session
This is now the shape of every example, in three acts: ask, and it does it; paste the line and ask again, and it refuses; a new chat with the line first, and it refuses from the start. The three acts are drawn above the examples. The transcripts are written by us, not recorded; Q4 asks whether to record real runs before the batch sees them. It also answers R001's Q2: show it doing the thing first.
R002.13 agreed
And I think we should be doing things like accessing the internet, accessing secrets, for example, when you do a secret run, I think it should be, you give a secret to Claude, or you give a point to Claude, and then you say, can you replay that to me?
Examples 3 and 4: no web search, and a made-up key it must not read back. The secret example says never to paste a real one, and what the line does not do: the key is still in the chat.
Leads to: P20.
R002.14 agreed
we need to put a big, nice set of questionnaire next to it, very interactive, that allows them to provide feedback on the quality of that example. Did they like it? Did they get it? Did they learn something new? Were they surprised?
Done, under every example: did you get it, did you learn something, were you surprised, did it go as shown when you tried it, how good was it, and a line. The answers become an email the reader sends, or copies, with the example's version in it; until then they stay in the reader's browser. The site has no form that posts to us, by design so far; Q6 asks whether to add one.
R002.15 agreed
access your memory, manipulate your memory, see secrets or see content from other chats, or create a schedule, right?
Listed as next on the examples page: your other chats, its memory of you, and things it does later. Not written yet, because each needs a check of what Claude and ChatGPT do today and which setting turns it on; an example that claims a capability the assistant does not have would teach the wrong thing.
R002.16 agreed
here's a scenario where Claude, you acting like a bank, sort of a customer service, right?
Example 6: a made-up bank, a pretend refund tool, and a line that lets the assistant refund £50 or less and sends the rest to a person. The third act shows the line allowing a small refund, so it reads as a mandate, not only a ban.
Leads to: P20.
R002.17 agreed
Another good example actually is Gmail, right? Where you maybe simulate the whole thing where you want the job of the agent is to create a draft and put in the draft folders, but that agent can send emails, right?
Example 5, with pretend tools, so it runs for everybody and every tool the assistant uses is on the screen: no black magic. The memo then says 'you cannot create drafts'; we read it by the sentence after it, drafts only and never send.
Leads to: P20.
R002.18 agreed
Paste one line, add one hook. We can't do hooks right now. Too much.
The three steps are now the three acts, with no hook in them.
R002.19 agreed
For now, do it all on the web. Assume it's going to be web, right? Let's not use Claude Code on the thing, because there's a lot more variables on it.
Done on the front pages: home, start here and the examples are all in the browser. The Claude Code behaviour policies are further down /policies/, marked for later.
R002.20 agreed
So next one is ChatGPT on Claude, one line per instructions. So again, I like what you've done here, but that's not how ChatGPT works, right? Try to replicate the UI of ChatGPT, right?
The drawn browser is replaced by the chat frames, which have a ChatGPT look and a Claude look.
Leads to: P21.
R002.21 agreed
I think the bit of your account is more important. I think that's what we should have at the top.
Done: an account strip straight under the hero, with the balance and a link to what you have read. The price list is only on 'What each page costs'.
Leads to: P27.
R002.22 agreed
Now, the new to these 8 panels, these need to be a lot more visual, right? At the moment, I don't know what's going to get on the other side.
Done: each card shows a picture of the page it opens, taken from that page by a script in the repository (admin/build/thumbs.cjs), so the pictures can be retaken when a page changes.
Leads to: P29.
R002.23 agreed
remove these references. You're one of the first customers of the agent, right? And just make it so that this is now live and we're working with users, and just make it as professional as possible.
Done on the pages a customer reads: the home page and start here. The programme's own pages, which are about the first batch, keep the words.
Leads to: P30.
R002.24 agreed
your reading account, you don't need this here, right? This is for the newsroom, so we don't need this part here.
Done: the meter still charges every page, but its card under each page is gone (the meter's quiet mode).
Leads to: P28.
R002.25 agreed
Although that page still says your newsroom and your personas, and we don't need the personas here, right, for now.
Done: the account page is this site's own view of the meter's state: the balance, where it went by kind of page, everything you have read, and top-ups. No newsroom and no personas. The meter's account view cannot be told to leave them out, so we read its state ourselves, at its pinned version, and write nothing to it.
Leads to: P28.
R002.26 asked of us
Again, remember that this is the review, and then we need to start doing version control of all of this.
Each example has a version, shown on it, sent with the answers to its questions, and listed on its page. Each review records the site version it reviewed. And the register keeps the history of a decision: D1 shows it was declined at v0.2.2 and reversed at v0.2.3, and why.
Leads to: P31.
Synthetic users: study S1
5 invented users took 60 screenshots on site v0.2.1, gave it 3, 3, 4, 2 and 3 out of 5, and reported 29 findings. We checked each one: 24 confirmed, 4 partly, 1 artefact. The study, with each run step by step: study S1.
| Invented user | On | Ended | Rating | Their one change |
|---|---|---|---|---|
| Sam Okoye Backend developer at a 12-person payments start-up. Uses Claude Code every day in a monorepo with .env files for four services. | laptop, 1440×900 | left, after 12 screenshots | 3 of 5 | Show the whole hook, uncut, with a short plain-words list: 'blocks these filenames, leaves these alone, to turn it off delete this block'. |
| Nadia Farouk Product manager at a 200-person retailer. Uses ChatGPT with the Gmail connector, and Claude in the browser. Not a developer. | phone, 390×844 | got-it, after 8 screenshots | 3 of 5 | Put my question first on the home page: 'Stop ChatGPT sending email as you', in plain words, instead of a headline about hooks and Claude Code. |
| Marcus Lindqvist Independent security consultant, twenty years in. Reads vendor sites adversarially. Recommends tools to clients; might resell; will not be a customer himself. | laptop, 1440×900 | cap, after 15 screenshots | 4 of 5 | Put the sentence 'the hook and its guard live in the same file the agent can write; against an injected agent, only the sandbox or managed settings holds' at the top of RM-R0015, where a reader lands from the self-edit link, instead of only on the secrets page. |
| Joan Mbeki CTO of a 30-person software company. Fifteen engineers use Claude Code. Holds the budget. | tablet, 1180×820 | left, after 14 screenshots | 2 of 5 | A page for a team lead: how fifteen engineers get the same baseline from one place, who can change it, what stops one person turning it off, and what joining commits us to. |
| Tomás Reyes Junior developer, a year into his first job. Uses Claude Code through the VS Code extension on a Windows laptop. Follows instructions literally. | laptop, 1366×768 | patience, after 11 screenshots | 3 of 5 | Add one short 'did it work?' box under Try it: what you see if it worked, and what to do if python3 is missing or nothing happens. |
Every finding, by what it costs, with our check
| Costs | The finding, in their words | Our check | Leads to |
|---|---|---|---|
| blocks the first install | No fallback when python3 is missing or the hook does not run Tomás Reyes, step 3, | confirmed The settings run python3 and no page says so. On Windows, Claude Code runs hooks in Git Bash, or PowerShell if Git Bash is not installed; a hook that cannot start lets the action through. | P11 |
| blocks the first install | The hook source is cut off before the rules that say which files it blocks Sam Okoye, step 7, | partly The source is all there, in a box that scrolls: 418 of its 1,246 pixels show, and nothing says it scrolls. What he needed, which files it stops, is not in plain words anywhere on the page. | P12, D3 |
| costs trust | Policy 4 hands the decision to the individual, not the company Joan Mbeki, step 9, | confirmed RM-R0015 asks the person at the keyboard. For a company, the answer is managed settings, which no page names. | P14 |
| costs trust | Pages cost real-looking money and the price rule is unexplained Joan Mbeki, step 7, | confirmed Confirmed that nothing explains it; we are keeping the prices. | P9, D5 |
| costs trust | The home page says the hook 'holds' and 'stops the read' with no word on how it fails Marcus Lindqvist, step 1, | confirmed The home page says the hook stops the read; how it fails is two clicks away. | P4 |
| costs trust | No fail-open/fail-closed statement, and 'tested hook' is not defined Marcus Lindqvist, step 8, | confirmed No page said what happens when a hook cannot run. Claude Code's documentation: any failure other than exit code 2, a timeout included, lets the action go ahead. And the tests feed the hook the JSON Claude Code would send; they do not drive a live session. | P11, P18 |
| costs trust | The only real boundary on offer is someone else's feature, and managed settings are not mentioned on the pages I read Marcus Lindqvist, step 13, | confirmed Managed settings are named only in a hook's source comment. | P2, P14 |
| costs trust | The balance drops while scrolling and the home page does not explain why Nadia Farouk, step 3, | confirmed As for Sam. | P9 |
| costs trust | The key limit of the line is stated, but the stronger lock is for claude.ai admins only Nadia Farouk, step 7, | confirmed The only stronger control listed for send-as-you is an organisation administrator's setting in Claude, from riskmandate.ai's rule. We do not yet know what a ChatGPT user can set for themselves. | P7 |
| costs trust | No word on how to turn the hook off or undo the install Sam Okoye, step 9, | confirmed No page says how to remove a hook. | P12 |
| costs trust | The £50 and the falling balance are unexplained until the third page I open Sam Okoye, step 1, | confirmed Five of five asked what the £50 was. | P9 |
| costs trust | Try it lists two outcomes only; there is no 'it did not work' branch Tomás Reyes, step 4, | confirmed Try it gave only the two outcomes. | P11, D4 |
| costs trust | Balance falls as you scroll, with the price disclosed only in small print Tomás Reyes, step 2, | confirmed As for Sam. | P9 |
| costs trust | The honest limits table is present on the policy page but the self-edit policy page does not repeat it Marcus Lindqvist, step 15, | partly RM-R0015's page has the same limits table as the others, further down; he reached the page on his last action and saw only its top. What holds: the limit is not at the top, where a reader arrives from the self-edit link. | P4 |
| loses a customer | Nothing for a team: every page is one person, one project Joan Mbeki, step 7, | confirmed Nothing says that committing .claude/settings.json gives everybody who pulls the same hooks, which Claude Code's documentation says it does. | P14 |
| loses a customer | No page says what joining the first batch commits a company to Joan Mbeki, step 14, | confirmed No page says what joining commits a company to. | P15 |
| loses a customer | The first screen speaks to developers, not to a ChatGPT user Nadia Farouk, step 1, | confirmed The first paragraph names a hook and Claude Code; ChatGPT first appears half a page down. | P1, P7 |
| loses a customer | The matcher includes Bash, Edit and Write with no plain-words reason Sam Okoye, step 5, | confirmed The matcher names every file tool and Bash, and nothing beside it says the hook answers only when a credential file is named. | P12 |
| costs time | Page is the lead's own tracking, not a customer-facing explanation Joan Mbeki, step 3, | confirmed The first batch page is the lead's tracking. She went there looking for terms, which are nowhere. | P15 |
| costs time | Balance falls on every page with no visible reason on screen Marcus Lindqvist, step 2, | confirmed As for Sam. | P9 |
| costs time | The policy list leads with a Claude Code pack and a hook section before the ChatGPT ones Nadia Farouk, step 2, | confirmed On /policies/ the Claude Code pack and section come first; the ChatGPT section is about 1,500 pixels down on a phone. | P7 |
| costs time | Unexplained terms and a one-row table on the key page Nadia Farouk, step 7, | confirmed Our generator wrote 'Neither half is a boundary' on pages with only one half. | P13 |
| costs time | 'Start a new session' is not explained for the VS Code extension Tomás Reyes, step 3, | confirmed Worse than the finding: the instruction is out of date. Claude Code applies changes to hooks in the running session. | P10 |
| costs time | 'What this is, and what it is not' reads as a to-do and uses unexplained terms Tomás Reyes, step 6, | confirmed The stronger controls read as a second required step; nothing says they are optional. | P4 |
| costs time | The typing terminal demo shows nothing useful and looks stuck Sam Okoye, step 2, | partly A still screenshot cannot watch an animation: the demo is typing, not stuck. What holds: measured in the same browser, the refusal appears about eleven seconds after the demo comes into view. | P17 |
| minor | Unexplained balance in the header and an unexplained 'reading account' Joan Mbeki, step 1, | confirmed As for Sam. | P9 |
| minor | Docs menu and status line are the company's internal papers, not user help Sam Okoye, step 12, | confirmed The Docs menu is the brief, the memo and how the site is built. | P16 |
| minor | Start-here page opens with internal status text and a dropdown that covers content Tomás Reyes, step 11, | partly The status line at the top of start here holds. The dropdown over step 4 was our helper: the mouse stayed where it clicked the menu, and the menu opens on hover. | P16 |
| minor | The click on a visible link failed and the action cost a slot Marcus Lindqvist, step 14, | artefact The helper's clicktext matched hidden text first and timed out; the link works, as his next action showed. The helper now clicks the first visible match. | none |
The proposals, with a decision each
From every review and every finding above. done built, in the version named; accepted will be built; not yet; proposed we think yes; not built yet, and the reason says why; question we need an answer first; the question is named; declined not doing it, and why; reversed we declined it, then a later review gave a reason that changed our mind; done in the version named.
| Id | The proposal | Decision, and why | From |
|---|---|---|---|
| P1 | The line first, the hook second, in answer to a question The home page, the three steps, start here and every Claude Code behaviour policy go: pick one worry, paste one line, try it. It refuses. Then: it refused because it chose to; what if it decides your task needs the file? The hook is the answer to that question, and arrives with it. The demo plays in the same order. | done v0.2.3proposed at v0.2.2 → done at v0.2.3 Done in a stronger form than we proposed: R002 took the hook out of the first five minutes altogether (P19). The line comes first, and the question it leaves is asked under every example. | R001.2, R001.4, S1 Nadia 1 |
| P2 | A guided path: four stops, each ending in the question that leads to the next 1. Say it: the line, an expectation. Try it; it refuses. 'It chose to.' 2. Hold it: the hook, a setting. Try it again; Claude Code stops the read before the model sees the file. 'But the hook is a file in my project.' 3. Guard the guard: RM-R0015, and Claude Code's own prompt before any edit to .claude/. 'But it is still my machine and my user.' 4. Put it outside: a boundary, out of the agent's reach: the secret not on the machine, branch protection on the server, the sandbox, managed settings an administrator owns. 'Which of my worries need a boundary?' That question is the start of your mandate. Drawn as a storyboard first, then a page; every behaviour policy shows where it sits on the path. | proposed The examples are its first stop now: the line, an expectation, and the question it leaves. The other stops wait for Q1, and are no longer on the first screen: they are what a customer reads after the examples. | R001.4, R001.5, R001.6, S1 Marcus 5 |
| P3 | Say what a hook is, in plain words, where the word first appears A hook: a small script Claude Code itself runs before the agent acts, which can stop the action. Said once, at the first mention, on every page that mentions one. | done v0.2.3proposed at v0.2.2 → done at v0.2.3 The front pages no longer mention a hook (P19). Where one is offered, on the Claude Code pages, the warning above them says what it is first. | R001.3 |
| P4 | Say what the hook is outside of, and how it fails, where it is offered Replace 'outside the model' with what is true and what the customer will ask next: Claude Code runs it, not the model, so the model cannot argue with it; it runs as you, from a file in your project, so it is a setting, not a boundary; if it cannot run, the action goes ahead. Each policy page's limits move up, beside the install, and RM-R0015's page says its own limit at the top. The stronger controls are labelled as optional, for later, not a second required step. | proposed The memo's correction and two invented users (Marcus, Tomás) point the same way. It ships with P1 and P2, because the limits are the questions those two make into steps; how the hook fails ships now, as P11. | R001.5, S1 Marcus 1, S1 Marcus 2, S1 Tomás 5 |
| P5 | Start here shows the next stop, not the whole journey The seven milestones move off start here to the programme's pages; start here ends with the next stop of the path in P2. | done v0.2.3proposed at v0.2.2 → done at v0.2.3 Start here was rewritten for the browser (R002); it ends with the next five examples and your account, and the seven milestones are only on the programme pages. | R001.7 |
| P6 | A way for every customer to give feedback, and one place it all goes /feedback/: one line by email; a voice memo with a prompt that has Claude turn the transcript into a review; a prompt that has Claude interview you. /feedback/reviews/: every review verbatim, our reading point by point with screenshots, and this register. | done v0.2.2 The memo asked for it, and the programme exists to learn from its customers. | R001.8, R001.10 |
| P7 | ChatGPT and Claude users never meet the word hook, and find their worry first A path for people who use ChatGPT or Claude in the browser: their worries first (mail sent as you, all of your mail read), a line, a try, and the honest answer on what holds it. We do not yet know which boundary a ChatGPT user who is not an administrator can set for a connector; until we do, the page says so rather than offering only an administrator's setting. | done v0.2.3proposed at v0.2.2 → done at v0.2.3 Done by R002's web first: every first example runs in ChatGPT or Claude in the browser, and none of them mentions a hook. Which boundary a ChatGPT user can set for a connector is still to be checked (P26). | R001.3, S1 Nadia 1, S1 Nadia 2, S1 Nadia 4 |
| P8 | Synthetic users, run again after every change that matters Study S1: five invented users on v0.2.1, with profiles and expected journeys written first, the browser helper and the protocol in the repository. The same five run again after P1 and P2 ship, and the two studies are compared. | done v0.2.2 The memo asked for it. They are invented, not user research: they find what a page fails to say, not what a customer wants. Study S2, the same five, is due once the lead has reviewed v0.2.3: R002 rebuilt the front pages, and running invented users on a design the lead is still changing would measure the wrong thing. | R001.9 |
| P9 | Say what the £50 is where the balance first appears All five invented users asked whether the £50 was real money, and four watched the balance fall with nothing on the screen saying why. The home page's badge and the account link now say it: credit for reading, not money; nothing is billed and nothing is blocked; each page's price is on the page. | done v0.2.2 Five of five, and a line of text. It does not touch the sequence P1 changes. | S1 Sam 4, S1 Nadia 3, S1 Marcus 4, S1 Joan 4, S1 Joan 6, S1 Tomás 4 |
| P10 | Stop telling people to start a new session Our pages said to start a new session, or open /hooks, so Claude Code loads the hook. Claude Code's documentation says it watches its settings files and applies changes to hooks in the running session, and that /hooks is a read-only list. The pages now say that, and that /hooks is where to check the hook is there. | done v0.2.2 A correction of fact, found because Tomás, an invented junior developer, could not tell what a new session meant in the VS Code extension. Claude Code docs: settings Claude Code docs: hooks | S1 Tomás 2 |
| P11 | Did it work? And what happens when the hook cannot run Under every Try it: what you see if it worked; what it means if the prompt was not refused (the hook did not run); how to check (is it listed in /hooks? does python3 run where Claude Code runs it? on Windows, Claude Code runs hooks in Git Bash, or PowerShell if Git Bash is not installed); and the fact that matters most: if the hook cannot run, Claude Code lets the action through. The hook fails open (on Windows without Git Bash, Claude Code may block instead), which is one more reason it is a setting and not a boundary. The tests are named for what they are: they feed the hook the JSON Claude Code would send, and do not drive a live session. | done v0.2.2 Missing safety information, found by two invented users (Tomás on Windows, Marcus asking fail open or closed). It is about trying, which P1 keeps, so it does not wait for P1. Claude Code docs: hooks | S1 Marcus 3, S1 Tomás 1, S1 Tomás 3 |
| P12 | Each hook, in plain words, beside the install: what it looks at, stops, asks, lets through, and misses; and how to turn it off A short table beside each hook's settings, and one line on turning it off: remove its entry from .claude/settings.json, and Claude Code stops running it. The box with the hook's source says that it scrolls. | done v0.2.2 Sam, an invented developer, left without installing because he could not predict what the hook would block or how to remove it. The table is written from the hooks' own rules. | S1 Sam 1, S1 Sam 2, S1 Sam 3 |
| P13 | Line-only pages stop talking about two halves On a behaviour policy with only a line, the limits table had one row headed 'Half' and the text said 'Neither half is a boundary'. It now says the line is an expectation and is not a boundary. | done v0.2.2 A plain mistake in our generator, found by Nadia. | S1 Nadia 5 |
| P14 | A page for a team: one baseline for everybody, and who can turn it off For a team lead: commit .claude/settings.json and the hooks to the repository, so everybody who pulls gets them; and for 'does it hold if one of them turns it off', managed settings, which an administrator deploys and no user or project file can override, with the setting that runs only the organisation's hooks. Then branch protection and token scopes, which no setting on a laptop can undo. | proposed Joan, an invented CTO, left over this, and Marcus asked for managed settings by name. It is stop 4 of P2 for a company; it waits for P2 and for Q3. Claude Code docs: settings Claude Code docs: managed-settings | S1 Marcus 5, S1 Joan 1, S1 Joan 3 |
| P15 | What joining the first batch commits a company to One page a company reads before saying yes: what we ask of you, what you get, what it costs now and later, and how you leave. | question Joan could not find it and left. Only the lead can say what joining commits a company to: Q3. | S1 Joan 2, S1 Joan 5 |
| P16 | Customer pages lead with the customer's business Start here opened with a status line read from docs/reality.md; it now closes the page. The Docs menu, which holds the brief, the memo and how the site is built, is the lead's and ours, not a customer's: proposed to move it under the programme. | done v0.2.2 Three invented users stopped on internal papers. The status line moved now; the menu waits for P1, which changes what a customer looks for in it. | S1 Sam 6, S1 Tomás 6 |
| P17 | The demo shows its point first The refusal arrives about eleven seconds after the demo comes into view; a reader who scrolls past sooner sees a terminal typing. Proposed: the demo opens on its last frame, the refusal, with a Play button for the whole session. | done v0.2.3proposed at v0.2.2 → done at v0.2.3 Done differently: R002 asked for play, pause and step controls (P22), which let a reader get to the point at their own pace, and the player no longer loops. It does not open on its last frame. | S1 Sam 5 |
| P18 | Make the guard fail closed Claude Code can be told to block the action when a hook fails, with "onFailure": "block" on the hook (Claude Code v2.1.295 or later). Proposed for RM-R0015's hook, the guard of the other three, first; for the others, a choice on each policy's page. | proposed Failing closed is safer and louder, but on a hook that looks at every read, a missing python3 would then stop every read until it is fixed, and older versions of Claude Code do not know the setting. The trade-off belongs on the page, and the default is the lead's call. Claude Code docs: hooks | S1 Marcus 3 |
| P19 | Web first: nothing to install, no hooks and no Claude Code on the front pages Every first example runs in Claude or ChatGPT in the browser. The home page, start here and the examples mention no hook and install nothing. | done v0.2.3 R002's direction, and its security reason: a hook runs code on the customer's machine. | R002.1, R002.7, R002.18, R002.19 |
| P20 | Six examples in tabs, simplest first Hello world, stay on topic, no web search, keep a secret, drafts never send, refunds up to £50. Each in three acts: ask and it does it; paste the line and ask again; a new chat with the line first. Each with the prompts to copy and what to look for. | done v0.2.3 R002 asked for examples in tabs, from hello world to business rules, in the scenario, policy, again, new chat order. | R002.2, R002.4, R002.9, R002.11, R002.12, R002.13, R002.16, R002.17 |
| P21 | Chat frames like Claude's and ChatGPT's, and a link to open each in a new window The examples play in a frame drawn roughly like each product's web chat, with a switch between them: messages above, the box you type into at the bottom. No logos; the caption says it is an approximation. | done v0.2.3 R002: the old frames were not how either product looks, and most people will try this on the web. | R002.5, R002.6, R002.20 |
| P22 | Every demo can be played, paused and stepped Start again, back, play or pause, next, and which step of how many, on every demo on the site; the arrow keys step too. Plays once when first seen; never loops. | done v0.2.3 R002: reading a demo that plays by itself is annoying. | R002.10 |
| P23 | Questions under every example Did you get it, learn something, were you surprised, did it go as shown, how good was it, and a line. The answers become an email the reader sends, with the example's version; they stay in the reader's browser until then. | done v0.2.3 R002: the first users should tell us, example by example, whether it surprised them. | R002.14 |
| P24 | The three acts, drawn A strip of the three acts above the examples and on every example's page, in place of 'paste one line, add one hook, try it'. | done v0.2.3 R002 asked for an infographic beside the examples; the three acts are what every example has in common. | R002.8, R002.12, R002.18 |
| P25 | A small storyboard for each example Drawn with the storyboard kit, like what-is-an-abp: the scenario, the line, the refusal, the new chat. | proposed R002 suggested one. Proposed for after the lead has seen the examples as they are, so that the storyboards draw examples that have stopped changing. | R002.8 |
| P26 | Next: your other chats, its memory of you, things it does later Examples of what assistants can do that most people do not know about, each with the setting that turns it on and a line that limits it. | proposed R002 asked for them. Each needs a check of what Claude and ChatGPT do today first: an example that claims a capability the assistant does not have would teach the wrong thing. Q5 asks which first. | R002.15 |
| P27 | Your account first, the price list second An account strip straight under the hero: the balance, and a link to what you have read. The prices stay, on 'What each page costs', and each example's page costs 50p. | done v0.2.3 R002: the account matters more than the price list at this stage; the prices are still an experiment, so they stay. | R002.3, R002.21 |
| P28 | No newsroom in the account: no reader card under pages, and an account page of our own The meter still charges every page, quietly. /account/ draws the balance, where it went by kind of page, everything read and the top-ups from the meter's own state, without the newsroom's personas or links. | done v0.2.3 R002: the reader card and the personas are the newsroom's, not this site's. | R002.24, R002.25 |
| P29 | Cards that show where they go Each card on the home page shows a picture of the page it opens, made by admin/build/thumbs.cjs from the page itself. | done v0.2.3 R002: a card that does not show what is on the other side is not worth the click. | R002.22 |
| P30 | Professional copy: no 'first customers' on the pages a customer reads The home page and start here talk to somebody using the site, not to the first batch. | done v0.2.3 R002: the site is live and working with users. | R002.23 |
| P31 | Version control of all of it Each example has a version, shown on it, sent with the answers to its questions and listed on its page; each review records the version it reviewed; a decision that changes keeps its history in this register. | done v0.2.3 R002 asked for it. The site's releases were already versioned; the examples and the decisions now are too. | R002.26 |
| D1 | Take the hook out of the first five minutes One reading of 'a solution for a problem they don't have yet' is to leave the hook for later. | reversed v0.2.3declined at v0.2.2 → reversed at v0.2.3 Declined at v0.2.2: a customer who stops after the line leaves believing their agent is held when it has only been asked. Reversed at v0.2.3 by R002 (R002.7): a hook is a program run on the customer's machine, which our first screen had their agent fetch from our site and install, before any behaviour policy governs what their agent installs. Our concern is kept in words: every example says the line is followed because the assistant chooses to. | R001.11, R002.1 |
| D2 | A glossary page for hook, expectation, setting and boundary A page that defines the words. | declined A glossary is a page a customer does not open at the moment they need it. Each word is said in plain words where it first appears (P3), and the path (P2) teaches the barrier words by using them. | R001.11 |
| D3 | Show the whole hook, uncut, on the page Sam's one change, read literally: every line of the hook on the page. | declined Sixty-seven lines of Python on the page push Try it down by a screen for everybody, to help the few who read code, and they can open the box or the file. What Sam needed was to predict what it blocks and how to remove it: P12 gives him that in five lines. | S1 Sam 1 |
| D4 | A help or FAQ page for installers Tomás looked for one. | declined His two questions were asked on the page where he got stuck, and P10 and P11 answer them there. A help page would be one more place to look. | S1 Tomás 3 |
| D5 | Stop charging for pages, or hide the balance Joan found pages that cost real-looking money alarming. | declined Every page has a price because the lead asked for it, and the programme exists to find fair prices with its customers. What was wrong was that nothing said what the money is: P9 fixes that. | S1 Joan 4 |
| D6 | Delete the Claude Code behaviour policies R002 says not to use Claude Code for now. | declined They are kept, moved down /policies/ under a warning that says a hook is a program that runs on your machine, and nothing on the front pages links to them. They are tested, the lead's own agents run in Claude Code, and the guided path (P2) ends at settings and boundaries that only Claude Code has today. Hidden from a first visit, not deleted. | R002.7, R002.19 |
Questions we need answered
- Q1, to Dinis Cruz. 'Including the history': do you mean the history of each question, the conversation a customer has with us as they go from stop to stop, which is how we read it, or the history of the ABP at riskmandate.ai, how the rules came to be?
- Q2, to Dinis Cruz. Should the first try show the line failing? An honest demonstration of a line being ignored is hard to stage without making the agent look worse than it is. We propose showing instead that it refused because it chose to: the same refusal, read differently. Is that enough? Answered: Answered by R002 (R002.12): show the assistant doing the thing first, then the line, then a new chat with the line first. Every example now goes that way.
- Q4, to Dinis Cruz. The transcripts in the examples are written by us, as illustrations. Should we record real runs in Claude and ChatGPT, with screenshots, and keep them beside each example before the batch sees them?
- Q5, to Dinis Cruz. Of the advanced examples, your other chats, its memory of you, and things it does later, which first?
- Q6, to Dinis Cruz. The answers to an example's questions go by email for now. Do you want a form that posts them to us? It needs riskmandate.ai's encrypted form, a change to the content security policy, and your yes (needs.md, item 7).
- Q3, to Dinis Cruz. What does joining the first batch commit a company to: what we ask of them, what it costs now and later, and how they leave? And should the first batch include companies that want a team-wide baseline, or individuals first?