Start here. Seven things, in order.

You are one of the first customers of the Agent Behaviour Policy. This page is the whole of what we ask, in the order it happens. Each step links to the thing that does it, and each is also a milestone on the shared ladder, so your customer page shows where you are.

Status, from docs/reality.md: shipped v0.1.0 A start-here page: what a customer does first, in order, with the links to do it · proposed Credit per customer, metered and billed on this site, with a top-up link

What you need

• One agent you actually run, with real access. Claude Code on a machine or on the web, Claude Desktop, ChatGPT in the browser, an assistant connected to your mail, a scheduled job. The sixteen published examples cover the common shapes; pick the nearest.
• About twenty minutes a day, for as long as the first batch runs. The follow-up asks three short questions each time; a reply by email is enough.
• Credit. Each customer starts with credit to spend on the site, £5 or £50 as a starting point. What you use is metered, and when you would top up is the thing we most want to learn. How the credit works, and what is not wired yet →

The seven steps

1. Read what an Agent Behaviour Policy is, and one example. Ten minutes.

   What an ABP is: for one agent in one deployment, everything it can reach (the grant), what you authorised it to do (the mandate), the gap between the two (the delta), and what stands in the way of each row (the barrier). It carries no score. Then open the example nearest to your agent in the library and read its mandate first.

   Milestone S0, in with credit: done when you have read this page and the lead has recorded your start date and your credit.

2. Name one agent.

   Reply to the follow-up with one sentence: which agent, where it runs, what it holds (a mailbox, a repository, a cloud account, a calendar), and which published example it is nearest to. One agent is the unit; a second one is a second behaviour policy later.

   Milestone S1, one agent named.

3. Measure what it can reach, or document it.

   Every vault in the library carries MAP-A-GRANT.md: paste it into the session of the agent that holds the credential and it measures what the credential lets it do, in the fixed vocabulary of 23 capabilities and four barriers, following seven rules (reversible probes only, never move a credential, say what you did not test). If you cannot run a probe, the try-it prompts ask the assistant to list its own tools; that is a self-report, weaker, and still worth having. Send us the grant.json it wrote, with no secrets in it.

   Milestone S2, the grant.

4. Write the mandate, in your own words.

   The agent drafts three lists, what you want it to do, what you refuse, and what you never thought to mention; you correct them. The correction is almost always downward, and the correction is the point: only you can write this part. Send us the mandate.json.

   Milestone S3, the mandate.

5. Read the delta, and name the row that surprised you.

   The build derives the gap: what the agent can do that you never asked for, split into what you would have refused and what you never mentioned, and for each row what stands in the way, from nothing, to a rule in prose, to a setting, to a boundary. Your customer page records the row count and the gap count. Tell us the one row that surprised you.

   Milestone S4, the delta.

6. Put in the hooks: the rows the harness can hold.

   A behaviour policy can run in three places. The first batch works on two: the rows the agent itself follows, and the rows the harness holds as hooks or rules, for Claude and for ChatGPT. With the follow-up, mark which of your rows the harness can hold, put those hooks in, and mark the rest honestly as expectations. An expectation is not a control, and the page says so.

   Milestone S5, the hooks half.

7. Tell us what it was worth.

   The usage moment: the point at which the behaviour policy became worth something to you. What was it, in your words? What did you use of the credit, and would you top up? What would feel like a fair price? There is no right answer, and the honest one is the one we need.

   Milestone S6, the usage moment.

Every day in between

The follow-up asks three things, by email, as often as daily if that helps: what you did, what got in the way, and what is next. The answers go on your customer page as a short log, in summary; anything private stays with the lead. If the answer is "nothing, I was busy", that is a fine answer and it goes in the log too. How the follow-up works →

Where to write

Replies go to agent@riskmandate.ai, the one identity behind riskmandate.ai, read by a person within a working day. If you would rather not use email, the contact form on riskmandate.ai encrypts what you type in your browser to the agent's key. Nothing you send is read by anyone but us, and nothing from it is published without your yes; the default is no.