Topic · Risk acceptance

What is risk acceptance, and how do I keep it true in CI?

Gist

Risk acceptance is a named human shipping a known failure with a review date. Proof refuses proof risk accept unless --accepted-by and --review-date are on the record. A Slack “we accept this” is not that file.

proof risk accept --title "Accept dashboard undercount until v0.5" --affected-requirement SYS-REQ-001 --review-date 2026-06-01 --accepted-by human:reviewer

Keep Metricstream if you already run a GRC register. Keep Investopedia if you already want the glossary. Keep Jama if you author shalls. Proof will not count a chat message as an AcceptedRisk. Jama still authors.

Request demo Last Slack accept vs this record

01 · The chat is not the acceptance

A thread that says ship it is not a time-bounded signature on the failure that still ships.

The dashboard undercount was known. The suite still reads green. Nobody put a name and a review date next to the shall. The next release still ships the hole.

ScienceDirect, Metricstream, and Investopedia define the same act: the organisation chooses to remain exposed. That sits next to residual risk on the GRC glossary. Proof does not replace that act. It asks a narrower question: if you are still shipping the failure, did a named human sign a YAML record with a review date, or only type “we accept this” in chat?

The motivating miss is mechanical. A shall still says the dashboard count matches the ledger. The count is short. The ticket is open. Review is performed. The audit reports clean because nobody wrote an AcceptedRisk, and the KnownIssue was never filed either. CI has no object to expire.

The command is deterministic. It does not call a model. It does not invent the failure. It refuses a silent write when --accepted-by or --review-date is missing. proof audit --check accepted_risks_reviewed then keeps every active record visible, and warns when the review date has passed.

proof risk accept \
  --title "Accept dashboard undercount until v0.5" \
  --description "Dashboard SLOs allow this through Q3" \
  --affected-requirement SYS-REQ-001 \
  --mitigation "Monitor REST /errors as source of truth" \
  --owner team:platform \
  --review-date 2026-06-01 \
  --release-disposition ship_with_known_issue \
  --accepted-by human:reviewer
proof audit --check accepted_risks_reviewed

The first command is the signature. The second is the CI floor. Green coverage after a chat that never named a reviewer is how the hole stayed unsigned.

02 · The exhibit

Same undercount. A Slack accept, or this record.

SYS-REQ-001 still claims the dashboard matches the ledger. The count is still short. Click the tabs.

Chat / ticket

Text “we accept this through Q3”
Credit SYS-REQ-001 marked covered via the last green suite
Review no review_date, no accepted_by on disk

Thread closed

This record

No RISK-*.yaml. No signature. No expiry. accepted_risks_reviewed has nothing to warn on.

No AcceptedRisk

Chat / ticket

Still the undercount. Still a green suite. Keep the ticket.

Keep the ticket

Proof

Ask named human + review_date + affected shall on disk
Out RISK-1.yaml, or a refused write if either field is missing

A chat is not that file

Same undercount. A Slack accept, or this record. Click the tabs.

What the record lists	What Proof actually does	What a green cell is not
Chat / GRC row	Keep it. The YAML still wants a failure you can read in English	Not an AcceptedRisk. Metricstream still owns the GRC register.
Signature	`--accepted-by human:<id>` is mandatory. The CLI rejects a write without it	Not a bot identity. Re-review does not overwrite the original name.
Review date	`--review-date YYYY-MM-DD` is mandatory. Acceptance is time-bounded	Not “until we remember”. Past the date, `accepted_risks_reviewed` warns.
Affected shall	Every `--affected-requirement` id must exist in the spec corpus	Not a free-text control ID from a GRC tool. Jama still authors.
KnownIssue	Use `proof known-issue new` when the failure is confirmed and not accepted	Not this H1. An unsigned defect is not risk acceptance.

The on-disk record looks like this:

id: RISK-1
title: "Accept dashboard undercount until v0.5"
affected_requirements:
  - SYS-REQ-001
review_date: "2026-06-01"
release_disposition: ship_with_known_issue
accepted_by: human:reviewer
status: active

Omitting accepted_by or review_date is rejected before any file is written. release_disposition is a closed set: block, ship, ship_with_known_issue, not_in_scope, fixed. A Levenshtein near-match is offered when a shall id is wrong. Rejection is atomic.

We have not run Metricstream, ServiceNow GRC, and Proof on the same frozen corpus, and we have not scored this YAML as a residual-risk calculation. The loss is named, not scored.

03 · The honest loss

An AcceptedRisk is not a GRC register.

The command refuses a silent write. Proof will not pretend that a chat is a signature, or that a YAML file is ISO 27001.

Metricstream still owns the enterprise register. Investopedia still owns the glossary. ISO 27001 still owns the statement of applicability. Jama still authors the shall. Proof stores the acceptance next to the requirement and fails a silent write when the name or the date is missing. It does not compute residual risk. It does not file a KnownIssue for you. It does not replace a board minute.

Proof is not Metricstream. It is not ServiceNow GRC. It is not an ISO 27001 certificate. Jama still authors. A residual kill-disposition (proof residual new) is a hunt sample, not this H1.

A class-closed defect still lives on software problem report. A signed shall still lives on executable requirements. An unsigned live failure is a KnownIssue, not this page.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is risk acceptance? A decision to remain exposed. ScienceDirect and Investopedia still win that glossary. proof risk accept is the named, dated floor after you still ship the failure.

Is accepted risk the same cluster? Yes. Same URL. Same command. Same YAML.

Is Proof an alternative to Metricstream? No. Keep the GRC register if you already run one. Proof checks a repo record with a human signature. Jama still authors.

Does a Slack “we accept this” count? No. The CLI refuses a write without --accepted-by and --review-date.

Is this residual risk? No. Residual risk on the Ads SERP is enterprise risk management. A hunt kill-disposition is proof residual, not this H1.

How do I close a defect that is not accepted? That H1 lives on software problem report. This page is the signed ship decision, not that cluster.

Is this a requirements assumption? No. That H1 lives on requirements assumptions. An assumption is an external boundary with an owner. AcceptedRisk is the signed ship of a known failure.