Risk Manager

If the Operator decides what to do, the Risk Manager decides within what limits. It sets the boundaries the Operator must operate inside (the instruction set, the loss caps, the staleness thresholds), balancing enough flexibility to pursue the mandate against tight enough control to protect user funds.

Crucially, the Risk Manager cannot execute the strategy. It defines rules, and the Operator acts under them. This separation means neither can do the other's job, and neither alone can both set a limit and exploit it.

Responsibilities

• Curate the instruction set. Review instructions proposed by the Operator and schedule the Merkle-root update that authorizes them on a Caliber.
• Set risk parameters on Machines and Calibers: position loss caps, swap loss caps, cooldowns, accounting staleness thresholds, fee accrual-rate caps, share-price change-rate limits, bridge loss limits.
• Curate base tokens: register and unregister the tokens each Caliber may hold.
• Set the share supply cap that limits new deposits.
• Manage access screening: the whitelists on the Depositor, Redeemer, and Pre-Deposit Vault, and the sanctions screening toggle on the Depositor and Redeemer.

Two speeds: immediate vs. timelocked

Not every change carries the same risk, so they don't all move at the same speed:

• A small number of lower-risk settings can be applied immediately by the Risk Manager, for example the share supply cap, the deposit/redemption whitelists, and sanctions screening.
• The risk-sensitive parameters are applied through a separate Risk Manager Timelock address. Changes routed through it are delayed, so they cannot be applied atomically or unilaterally, and the instruction-root update can be vetoed during its delay by the Security Council or the Root Guardians.

The net effect is trust minimization: the Risk Manager can keep a strategy adaptive, but every consequential change is delayed and observable, giving users time to exit and the Security Council time to veto if a change is unacceptable.