Facing the risks: making strategic autonomy work in practice