Risk · StartupBuilder

Properties

Property	Type	Required	Description
`scope`	`string`	required	Whose Risk it is: `startup` or `portfolio`, for exposure shared across siblings.
`likelihood`	`integer`	required	How likely it is within a year, from 1 (rare) to 5 (expected).
`impact`	`integer`	required	How much harm it does if it happens, from 1 (minor) to 5 (ends the Startup).
`treatment`	`string`		The chosen response: `treat`, `accept`, `transfer`, or `avoid`.
`owner`	Role	required	The Role that owns the Risk and its next review.
`status`	`string`	required	`open`, `treated`, `accepted`, or `closed`. A closed Risk is kept forever.
`reviewBy`	`date`		When the owner next scores it again.

Object

JSON

{
  "$id": "https://api.sb/ledgerlark.com/risks/risk_1",
  "$type": "Risk",
  "scope": "Example scope",
  "likelihood": 1,
  "impact": 1,
  "treatment": "treat",
  "owner": "role_1",
  "status": "open",
  "reviewBy": "2026-10-22"
}

Relationships

A Risk has one Portfolio: Exposure shared across sibling Startups, such as one upstream every sibling relies on. portfolio, inverse risks.
A Risk has one Startup: the Risks scored for one Startup, open and closed. startup, inverse risks.
A Risk is treated by many Controls: the Controls that lower the Risk. Every Control cites the Risks it treats. treatedBy, inverse treats.

Verbs

createCreates a Risk.
POST /{namespace}/risksdoRisk.created
getReturns one Risk by id.
GET /{namespace}/risks/{id}readNo Event
listReturns Risks, newest first, one page at a time.
GET /{namespace}/risksreadNo Event
updateChanges the given properties of a Risk.
PATCH /{namespace}/risks/{id}doRisk.updated
acceptAccept records an officer’s signed Decision to carry a Risk untreated until its next review.
POST /{namespace}/risks/{risk}/acceptdoRisk.accepted
assessAssess scores a Risk’s likelihood and impact from the Startup’s records and sets its next review date.
POST /{namespace}/risks/{risk}/assessdoRisk.assessed
closeClose ends a Risk that can no longer happen and keeps it, with its scores and treatments, forever.
POST /{namespace}/risks/{risk}/closedoRisk.closed
treatTreat links a Risk to the Controls that lower it and records the score it should reach.
POST /{namespace}/risks/{risk}/treatdoRisk.treated

A Risk is never deleted: it ends by Risk.close, and its records stay.

Permissions

Which Access level may call each Verb. One-way Verbs wait their delay window.

Operation	`owner`	`admin`	`member`	`viewer`
`Risk.create`	Yes	Yes	Yes	No
`Risk.get`	Yes	Yes	Yes	Yes
`Risk.list`	Yes	Yes	Yes	Yes
`Risk.update`	Yes	Yes	Yes	No
`Risk.accept`	Yes	No	No	No
`Risk.assess`	Yes	Yes	Yes	No
`Risk.close`	Yes	No	No	No
`Risk.treat`	Yes	Yes	Yes	No

Call it

Text

Assess the latest risk.

A Startup relies on one model upstream for every reply. The Risk Analyst records a Risk with likelihood 3 and impact 4. It treats the Risk with a failover Control and sets the next review for the end of the quarter.

PropertiesCopy Anchor Link

ObjectCopy Anchor Link

RelationshipsCopy Anchor Link

VerbsCopy Anchor Link

PermissionsCopy Anchor Link

Call itCopy Anchor Link

ExampleCopy Anchor Link