<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Risk Appetite Statements — API Reference

## Appetite Statement Schema

```json
{
  "category": "cybersecurity",
  "appetite_level": "low",
  "appetite_score": 2,
  "tolerance_threshold": "Max 2 high-severity vulns in production",
  "hard_limit": "Zero unencrypted PII at rest",
  "escalation_trigger": ">5 critical findings"
}
```

## Agent Commands

```bash
# Define appetite statement
node agent.js --action define --category cybersecurity --level low

# Evaluate register against appetite
node agent.js --action evaluate --input register.json --appetite appetite.json

# Generate appetite framework report
node agent.js --action report --input appetite.json --output report.json
```

## Risk Appetite Levels

| Level | Score | Description | Board Oversight |
|-------|-------|-------------|-----------------|
| Very Low | 1 | Minimal risk acceptable | High — quarterly review |
| Low | 2 | Conservative approach | Medium — quarterly report |
| Moderate | 3 | Balanced risk-reward | Standard — annual review |
| High | 4 | Aggressive pursuit | Standard — exception based |
| Very High | 5 | Maximum risk acceptance | Low — delegated authority |
