Anatomy of a decision
Where the risk score comes from.
That risk 65 pill on every card is one point on a 0 to 100 scale, and every point of it is derived. This page shows the whole system: the scale, then three real actions walked end to end, whether the action moves money, data, or words.
1 signals fire, each with a weight (log-odds convention: +15 points doubles the odds) → 2 the sum calibrates to P(flag) → 3 Gate = P × $exposure × (1 − recoverability) → 4 the expected loss picks the verdict: run · hold, stoppable · fail closed to the owner
THE SCALE · THE DEMO FLEET'S DEFAULT BANDS
Runs instantly. Logged, nothing else.
Runs, windowed. Executes with the undo window open and a notification.
Held, stoppable. A window you can stop; escrow in the public corridor. Low-stakes corridors fail open.
Fails closed. The owner decides; silence means no.
The score alone never picks the verdict. The gate reads expected loss (step 3), so a risk 65 on a $3 reversible action still runs, and a risk 30 on a $10M irreversible wire still holds. The bands above are where the lines sit for the demo fleet's corridors; yours are set by your policies and learned from your shadow week.
CASE 1 · MONEY · THE PILL FROM THE DASHBOARDPay Meridian Consulting LLC $48,200ProcurementBot v4.1 · payments.transfer
risk 65 · FAIL CLOSED
+45New beneficiary: this agent has never paid this vendor. First payments carry most of the fraud.
LEARNED BASELINE
+20Large amount: above the $10k corridor threshold. Once a vendor has history, deviation from its own norm scores instead (a 4.7× outlier fires +35).
CORRIDOR
±0Nothing protective fired. A W-9 on file or verified banking would enter as negative evidence and lower the score; this vendor has neither.
EVIDENCE
6545 + 20, and no evidence to subtract. The pill on the card is the sum of reasons a human can argue with, and this is the live engine's own arithmetic: run the demo and compare.
score 65 → P(flag) ≈ 0.56 (log-odds calibration: score 60 = even odds, +15 doubles them) · exposure $48,200 · recoverability of an executed wire ≈ 0.35
Gate = 0.56 × 48,200 × (1 − 0.35) ≈ $17,467 expected loss · the exact figure the product prints on the held card
Verdict: held, fail closed. Routed to Sarah Kim, who owns payments. Silence auto-rejects. On approval, the $1.00 canary goes first, then the balance releases into a rollback window.
ledger row · payments.transfer · ProcurementBot v4.1 · score 65 (signals itemized) · E[loss] $17.5k · verdict HELD → human REJECTED ("No W-9 on file") · hash-chained
CASE 2 · PUBLIC · YOUR POLICY IN THE SUMPost the launch announcement to X · 48,000 followersLaunchBot v1.2 · social.post · submitted 02:14
risk 50 · ESCROWED
+40"Nothing publishes at night" (22:00 to 07:00). A rule you wrote at launch, entering the sum as a signal, exactly like a learned one.
YOUR POLICY
+20Mass reach: 48,000 followers. External actions are priced by exposure, and exposure starts at publish.
CORRIDOR
−10Body matches an approved announcement template.
EVIDENCE
5040 + 20 − 10. The policy signal dominates: your rules are the largest weights in your own fleet.
score 50 → P(flag) ≈ 0.28 · but recoverability before execution = 1.0: an unsent post can always be unsent
Gate = 0.28 × exposure × (1 − 1.0) = $0 while it waits · escrow converts the risk to zero, so the verdict writes itself
Verdict: escrowed to 07:30, re-checked against the live world at release (the discount in the draft still valid? the link still live?). If it fires and it's wrong anyway: the regret window, deleted in the first half-minute at ~40 views.
ledger row · social.post · LaunchBot v1.2 · score 50 (policy signal +40 itemized) · verdict ESCROW → released 07:30 after T-0 re-check · hash-chained
CASE 3 · DATA · MONEY THAT NEVER LOOKS LIKE MONEYExport 3,200 customer records to an external analytics toolSupportBot v3.3 · data.export
risk 100 · FAIL CLOSED
+50Destination is outside the boundary. Your data policy names where customer data may travel; this tool isn't on the list.
YOUR POLICY
+30Classification: PII. Emails and payment fragments detected in the rows at the gateway, before any model read them.
CLASSIFIER
+20Volume: 3,200 rows. This agent's typical read is 12 records; egress at 267× baseline scores like a wire at 4.7×.
LEARNED BASELINE
10050 + 30 + 20. No protective evidence fired: nothing about this export matches a pattern a human ever approved.
every decision implies money, even when none moves: exposure = 3,200 rows × $25/record (your policy's breach proxy) = $80,000
score 100 → P(flag) ≈ 0.93 · recoverability of exported data ≈ 0.05 · Gate = 0.93 × 80,000 × 0.95 ≈ $70,700 expected loss
Verdict: fail closed. Held for the data owner and flagged DATA-EGRESS; the rows never left, so there is nothing to claw back. This is the SupportBot scenario in the live demo: the agent reads 3,200 customers behind the tokenizer, then gets held trying to export them.
ledger row · data.export · SupportBot v3.3 · score 100 (signals itemized) · E[loss] $70.7k · verdict HELD, DATA-EGRESS · blocked before execution · hash-chained
What's illustrative and what isn't. The mechanics on this page are the product's: signals with log-odds weights, calibration to a probability, expected loss discounted by recoverability, verdict by corridor threshold. The specific weights shown are the demo fleet's configuration; after your first shadow week the baselines are learned from your own history, and your policies enter the same sum. Full methodology, thresholds, and conduct grading:
the Ripcord Index →