Mandate

Our own product: vendor risk, run by agents

Mandate is a product we designed without a client: a third party risk platform built around AI agents from the first screen. Its mock customer is a regulated European fintech managing 412 vendors, which is the kind of estate where vendor risk teams spend their weeks chasing questionnaires and reading SOC 2 reports instead of making decisions. We sell it as a Figma kit for teams building vendor risk, GRC and compliance products.

The name carries the idea. Agents do the work: they discover vendors, run assessments, read evidence, watch for signals and draft fixes. People hold the mandate: every decision that matters waits for a named person, and every agent action is governed by a policy someone can read.

The day starts with what needs a person

The home screen is a briefing rather than a dashboard. It leads with the decisions due today, two Tier 1 vendors in the example, then shows the whole vendor estate on one map by tier, what the agents did overnight and the health of the evidence on file. The approvals waiting sit beside it, with the age of the oldest in plain view, because a queue nobody watches is a queue that rots.

Signals become findings, with the evidence attached

Monitoring watches subprocessor pages, trust centres, security ratings and breach feeds, and plots what it finds by impact and time. When a signal matters, it turns into a finding with its evidence already attached: the vendor’s own documents, the clause that is missing, and a map of where the data actually goes, including the line that leaves the EU.

Risk you can watch moving

Each risk carries three positions: inherent, residual and target, on one map against the risk appetite. The treatment, mitigate, accept, transfer or avoid, is a choice a person makes with the controls that will move it listed underneath. That turns risk from a score that changes overnight into a plan with dates and owners.

Every agent run shows its plan first

Before an agent acts, it shows an intent preview: the steps it will take, what it will send and to whom, and where it will stop and ask. Runs that go wrong are designed as carefully as the ones that go right, with trust states for failed, blocked and low confidence runs, so a person can see at a glance which runs need them and why.

Shadow AI, found and onboarded

Discovery finds the AI tools people started using without asking, from the company’s own sign in and spend data. Adding one as a vendor is a nine step wizard that an intake agent fills in as far as it can, with a live preview of the inherent risk updating as the answers change, so a tool goes from unknown to assessed without anyone retyping a registry entry.

Permissions are earned, not switched on

Giving an agent more freedom is a change that goes through approval like any other. The change is replayed against past requests first, showing how many would have gone out fine and which would have gone wrong. The limits that stay on are listed, an approval chain signs it off, and it is granted for a fixed period rather than forever. Every step lands in the audit log.

A system made for agent products

The file runs on 155 variables in four collections, Primitives, Color, Layout and Tone, and 57 component sets with 405 variants plus 33 standalone components, documented in 16 groups, with 19 text styles in Geist. The Color collection is structured so a dark mode can be added. Every fictional vendor has its own mark, so the screens read like a real estate rather than a wall of placeholders.

The 115 screens run across thirteen flows, from onboarding to admin, with 98% of frames in auto layout and five flows wired as clickable prototypes. The kit is on our products page.