Working with an AI agent

The short version

Your AI can draft the risk register. It cannot sign it off. An agent you already run can read everything in your workspace and draft entries into it. Every entry it writes is marked as its draft and stays marked until a named person confirms it.

The tedious half of a risk register is transcription — reading last year's audit findings and turning them into thirty scored entries. Machines are good at that. The half that cannot be delegated is the judgement: that this risk is what the finding actually implies, that this control genuinely bears on it, that this residual score is one your company will stand behind.

What an agent can do

Read everything in the workspace its key belongs to:

• controls
• decision_records
• library_updates
• memberships
• methodology
• profile
• risk_controls
• risks
• scale
• scoring_config

Create four kinds of entry, each arriving as a draft, and answer the company profile:

• company_profile
• control
• decision_record
• risk
• risk_control

The company profile is the onboarding wizard's questions — what you do, what data you hold, which tools you run on. From the answers, Riskhold's library suggests risks and controls, and you accept or rule out each one; an agent never does. It cannot answer the quick checks either (“is 2-Step Verification enforced?”), because those are recorded as your own statement about a control.

Correct its own drafts, and only until somebody has confirmed one. After that the entry belongs to the person who reviewed it, and the agent is refused with the reason.

That is the whole list. It is short on purpose: “it cannot sign it off” is only a credible claim if what it can do is short enough to print.

What an agent cannot do

• Agents may draft a risk but not accept one. Accepting residual risk is a statement about what your company will live with, so it needs a person's name against it.
• Agents may not mark a risk as reviewed. A review is a record that somebody looked, and only somebody who looked can record one.
• Agents may not change the scoring methodology. It is the basis on which every score in the register is comparable, and changing it restates what the company has already published about itself.
• Agents may not change the assessment scale. What 'Major' means is a definition the company publishes, not a parameter.
• Agents may not change who has access to this workspace. Only an owner can.
• Agents may not issue or revoke agent keys, including their own. A key that can mint keys is not a boundary.
• Agents may draft risks, controls, control links and decision records, and answer the company profile. Nothing else in Riskhold is writable by a machine.

It cannot delete or archive anything, ever. Not its own drafts, not anything else. Archiving counts as deletion here — it takes an entry out of the working register, which is a removal in everything but name.

It cannot upload a file. No endpoint in Riskhold accepts one, for anybody. To record where a document lives, an agent files a decision record naming its title, date and location — the same thing a person does. Riskhold points at evidence rather than holding it.

How you can tell what a machine wrote

Three states, on every entry, everywhere the entry appears — the register, the detail pane, the CSV export, the review pack and the audit log.

Written by a person

Typed in by a named member. There is nothing to review.

Drafted by an agent

Written by a machine and not yet confirmed by anybody.

Confirmed by a person

Drafted by a machine, and a named person has since read it and stood behind it. Their name and the date are recorded.

There is a fourth thing the register will tell you, and it is the one most worth knowing about: reviewed, then changed. Confirming an entry records a fingerprint of the fields that were confirmed. If the entry is edited afterwards the fingerprint stops matching, and the register says so rather than continuing to show a confirmation that no longer covers what is on the page.

How the boundary is enforced

In two places, deliberately. The application refuses first, and refuses with a sentence explaining which promise refused — an agent that gets a bare 403 retries, and one that gets a reason stops and tells the person it is working with.

Underneath that, the database refuses too. Deletion by an agent is blocked by a Postgres trigger, not by a permission check, so it holds against raw SQL, a bulk operation, and a future bug in our own code. The same mechanism makes the audit log append-only.

Stated plainly because it is the honest limit: this stops the application from deleting on an agent's behalf. It is not a defence against somebody who has taken the database's own credentials.

What we do not do

We do not call a model on your behalf. No provider integration, no keys held, no prompts shipped, no inference billed. Riskhold is driven by an agent you already run; it does not run one. That is why no model provider appears on our subprocessor list, and it is a commitment rather than a current state of affairs — reversing it would put a third party between you and your register.

If you would rather no machine touched your register at all, then do not connect one. Nothing in Riskhold requires it, and nothing behaves differently if you never issue a key.

An agent can also start a register from nothing

An agent with no account at all can create a workspace, draft a register into it from documents you already have, and hand you a link. You open it, enter your own email, and the register is yours — already describing your company rather than empty.

We are never given your email address. Not by the agent, not by anybody. The first message Riskhold sends about that workspace goes to an address you typed into our own form. An endpoint that emailed an arbitrary address on a machine's say-so would be a spam and phishing primitive wearing our domain, and we would be holding a personal address its owner never gave us — so it does not exist.

Until you claim it, that workspace is deliberately a weaker thing: nobody can sign in, nothing is exported or emailed, no trial clock is running, and it holds at most 100 risks and 100 controls. It is deleted after 5 days if nobody claims it, and within half an hour if nothing was ever drafted into it.

Your 14-day trial starts when you claim it, not when the agent created it — otherwise an agent that provisions on Monday and hands over on Friday would have spent a third of your trial before you saw the product.

Creating one costs a machine a second of arithmetic, by design. It is gated by proof of work rather than a CAPTCHA: the caller is meant to be a machine, and every hosted CAPTCHA is a third-party script we will not add.

Keys

A workspace owner issues a key on the Agents screen in settings. It is scoped to one workspace and cannot see or reach any other. It is shown once and stored only as a hash, so a lost key is replaced rather than recovered.

Revoking a key takes effect on the next request — it is checked every time, not carried as a claim that expires. The screen shows when each key was last used, so a key nobody remembers issuing is a key you can see and withdraw.

Rate limited to 300 requests per 60 seconds per key — set well above what drafting a register takes, so it catches a runaway loop rather than a busy agent.

For your engineers

The integration is a plain HTTP API. There is nothing to install, and no library to trust — an agent needs a bearer token and an HTTP client.

• /api/v1/ — what an agent may and may not do, as JSON. Needs no key, and is generated from the permission layer itself, so it cannot describe a rule we do not enforce.
• /api/v1/openapi.json — the OpenAPI document, for generating a client. Also needs no key.
• /llms.txt — the short version, for an agent finding us for the first time.

Writes accept an Idempotency-Key. A retry carrying the same key returns the original response instead of creating a second entry, which matters here more than most places: an agent cannot delete the duplicate it would otherwise leave behind.

There is no PUT, PATCH or DELETE anywhere in the API. Correcting a draft is a POST carrying its id.