store.sgit.ai / Corrected for your situation / paid
You bought: Corrected for your situation
£500, arriving 1 to 3 days from your reply, not from your payment. Nothing else is needed from you.
What happens now
A person follows up within 24 hours. The corrected vault follows what the prompt produced.
Run MAP-A-GRANT.md where the agent runs — it ships in every template zip and in every vault, so you have it before and after paying — and send back the two files it writes, grant.json and mandate.json, and the session record, with no secret in them and your order reference on the message.
Where the deeper material is
riskmandate.ai's page for this level carries the longer form of what is below. You do not need it to get what you bought.
See one of these now
One agent, its grant of twelve capabilities, its mandate of four, and the eight-capability delta no policy covers. It is the shape of the document you have just bought, built out end to end and published so anybody can open it. Yours will be your own — your shape, your licence, and no public key on it. This one is here because a vault is hard to picture from a description, and reading one takes about a minute.
posrhzp3121read-onlyOpen it in its own tab ↗ or read how it was published at sgit.ai.
dev.vault.sgraph.ai, in a frame this page builds at runtime. The key does not travel in the address: the frame is opened carrying nothing, it announces itself, and only then is the read key handed over by message with the target origin pinned — so it is not in a URL, not in history, not in a referrer and not in the frame’s storage. Replies from any other origin are ignored. It is a read key, which opens a vault and cannot write to it, and sgit.ai publishes it deliberately on that vault’s own page. Every page on this site that sells anything still opens nothing at all — this is a page you reach after buying, and a build check holds that line. One exception, stated because it is real: if the handshake does not complete within twelve seconds the component falls back to opening the vault with the key in the frame’s URL fragment. A fragment is never sent to a server and never appears in a referrer, but it is in that frame’s address. The link above avoids it entirely.What done looks like
The corrected mandate and the recomputed delta are committed, with the note of what changed and why committed beside them.
How you check it. The commit is in your history and the note names every changed row.
About keys
Out of band, and never on a page.
Who does it
Founder of the sgit.ai network, RiskMandate.ai, The Cyber Boardroom, MyFeeds.ai and VoiceDebrief.ai; former OWASP Board member and organiser of the OWASP Summits; creator of the O2 Platform.
Runs the correction at £500 and the two sessions at £1,500.
One name today, and the list is built for more — other security professionals are being approached to take some of this work. Everybody who runs a review here.
Back to the shop · what this level is · all four, side by side
Which agent do you run? → How buying works → Every claim, with its state →