> For the complete documentation index, see [llms.txt](https://tatsu.gitbook.io/tatsu-whitepaper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tatsu.gitbook.io/tatsu-whitepaper/risks-and-mitigations.md).

# Risks and Mitigations

| Risk                                                          | Likelihood | Impact   | Mitigation                                                                                                                                 |
| ------------------------------------------------------------- | ---------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Cryptographic flaw in firmware                                | Low        | Critical | External audit; mainstream curve and library; conservative receipt format                                                                  |
| Signer-key compromise                                         | Low        | Critical | KMS/HSM with multi-region access controls; multi-signer firmware support; rotation procedure with overlapping validity                     |
| Hardware partner slippage                                     | Medium     | High     | Maintain at least two qualified launch partners; treat OEM dates as soft until contracts signed                                            |
| BLE UX too painful for non-technical users                    | Medium     | High     | Pilot specifically tests this; fall back to QR-coded receipts as a secondary path if BLE adoption disappoints                              |
| Token-price volatility makes subscription pricing impractical | High       | Medium   | Subscription tiers priced in USD-denominated reference amount and converted to TATSU at burn time using a published exchange-rate schedule |
| Regulatory uncertainty (token + IoT)                          | Medium     | Medium   | Conservative jurisdictional choice; legal review before mainnet; clear separation between TATSU utility and any speculative claims         |
| Competing approach gains traction first                       | Medium     | Low      | The architecture is a moat in itself; first-mover advantage is real but not decisive                                                       |