Giving agencies freedom and security requires them to be risk aware, not risk averse