Risks

Most governance tooling is useful only after you've configured it. Risks is the answer on day one: open it on a fresh install, with no rules written, and it tells you what is already wrong.

It's at Oversight → Risks, and it's operator-only.

What it looks at#

Two things, ranked together:

• Your standing posture — trust that was switched on and left on, grants that are broader than they need to be, credentials with no expiry, workers with no accountable owner, and how much containment your deployment actually gives you.
• What your AI workers actually did — including the ones running outside damn.dev. A coding agent that touched a production branch, or reached the network, shows up here with the specifics, and a link straight to the Trace rows behind it.

It's derived, never stored#

Findings are recomputed every time you open the page, from the same grants and the same audit log everything else reads. There's no scan to schedule and no state to go stale — fix something and it's gone next time you look. The only thing that persists is a decision you make.

Every finding says how strongly it's known#

This is the part that keeps the page honest, and it's on every card:

• Enforced — the boundary is real and holds.
• Best-effort — a cooperating agent is gated on a tamper-evident record. Useful, bypassable.
• Observed — this was reported. Findings about agents you don't run are always this, never anything stronger, because damn.dev watched it happen; it did not prevent it.

The distinction is the same one used across the whole product — see Enforced vs Trusted.

Fixing, or deciding not to#

Where the fix is one safe, bounded action on the exact item you're looking at, it's inline — turn off trust, scope a credential, add an expiry, narrow a rule. Where it isn't, you get a precise link to the control that owns it rather than a button that half-does the job.

Some risks are ones you accept. Accept risk takes a finding off the list and records the decision, so the page can be driven to zero honestly — an inventory nobody can clear is an inventory people stop reading.

Ceiling — Risks ranks what your posture makes possible, and what was reported. It is not a threat detector, not an alerting system, and not evidence that anything was attempted or prevented. Accepting a risk records that you decided to live with it — it changes nothing about what's enforced.

Next#

• Oversight & the Registry — the inventory these findings hang off.
• Systems & Keys — what your AI can reach, and what unlocks it.
• Policy & enforcement — turning a finding into a standing rule.