How the US Environmental Protection Agency designed the governance of risk and forged its legitimacy over the course of four decades. The US Environmental Protection Agency was established in 1970 to protect the public health and environment, administering and enforcing a range of statutes and programs. Over four decades, the EPA has been a risk bureaucracy, formalizing many of the methods of the scientific governance of risk, from quantitative risk assessment to risk ranking. Demortain traces the creation of these methods for the governance of risk, the controversies to which they responded, and the controversies that they aroused in turn. He discusses the professional networks in which they were conceived; how they were used; and how they served to legitimize the EPA. Demortain argues that the EPA is structurally embedded in controversy, resulting in constant reevaluation of its credibility and fueling the evolution of the knowledge and technologies it uses to produce decisions and to create a legitimate image of how and why it acts on the environment. He describes the emergence and institutionalization of the risk assessment–risk management framework codified in the National Research Council's Red Book, and its subsequent unraveling as the agency's mission evolved toward environmental justice, ecological restoration, and sustainability, and as controversies over determining risk gained vigor in the 1990s. Through its rise and fall at the EPA, risk decision-making enshrines the science of a bureaucracy that learns how to make credible decisions and to reform itself, amid constant conflicts about the environment, risk, and its own legitimacy.