# Agent Governance & Insurability Package

Your insurer is asking what your agents can do. You do not have the document.

Three to four weeks: technical controls and a traceable evidence pack prepared for review by a carrier, auditor, or enterprise customer. Acceptance depends on their requirements.

3-4 weeks · $18K-30K

Beta pricing. This package is new, so the price is being set against real scopes rather than guessed in advance. Bring yours to the call and the number comes out of it — not out of a template.

## Who this is for

- A cyber policy renewal questionnaire has landed and it asks about AI risk assessment, agent inventory, or least-privilege.
- An enterprise customer's security review is holding up a deal.
- You have the controls in some form but nothing you could hand to a third party as evidence.

## Who this is not for

- You want a policy document as paperwork. The dossier carries weight precisely because the controls behind it are real — building and verifying those is the substance of the engagement.
- You need a formal certification. This produces the evidence an assessor works from; it is not the assessment.

## What you get

- An agent inventory and Agent Bill of Materials: what exists, what it can reach, and under whose authority.
- Identity and least-privilege enforced at the tool layer, with the gaps closed rather than documented.
- Cryptographic audit trails and attributable logging on every tool call.
- Human-in-the-loop review paths on the actions that need one.
- A risk assessment mapped to NIST AI RMF, and a carrier-facing dossier written for the underwriter rather than the engineer.

## How it runs

### Week 1: Inventory and gap analysis

What agents exist, what they can reach, what is logged, and what an underwriter would ask that you cannot currently answer.

### Weeks 2-3: Close the gaps

Identity, least-privilege, attributable logging, spend controls, and human review paths — shipped, not specified.

### Week 4: The dossier

The evidence pack, written to be read by a carrier, an auditor, or an enterprise security reviewer without a translator.

## Reported experience

- 80 + 17: Python rules + additional TypeScript/JavaScript rules in the reviewed Drako revision
- Versioned: Public control implementation and benchmark conditions
- Traceable: Control-to-test evidence, with gaps and limitations recorded

## Evidence and limits

Drako deterministic controls (author-reported, reviewed 2026-09-22): The README distinguishes 80 Python rules and 17 additional TypeScript/JavaScript rules. Timings depend on the benchmark and are not a latency guarantee for an entire agent request. Repository code is not evidence of insurer acceptance.

[Source](https://github.com/drakolabs/drako/blob/23c9b64318043a09543c32c4e46070caf3ee530a/README.md)

Epica belief-revision runtime (experimental, reviewed 2026-09-22): An implementation of selected research ideas. Cryptographic integrity does not establish that a recorded statement is true or that a system is compliant.

[Source](https://github.com/angelnicolasc/epica)

[Agent controls: sample evidence dossier](https://nickcerutti.com/evidence/agent-controls-sample.md) — Synthetic scenario: inventory, permissions, test results and unresolved gaps.

## Questions

### Will this get us covered, or lower our premium?

Nobody can promise that — underwriting is the carrier's decision and depends on far more than agent controls. What this package does is move every question on the form from assertion to evidence, which is the part you control and the part that moves renewals.

### Why is the pricing marked beta?

Because the demand signal for this package comes largely from enterprise and mid-market insurance sources, and it has not yet been validated at Series B to C scale. Rather than pretend otherwise, the price is being set against real scopes. That honesty is the point.

### Is this the same as an EU AI Act package?

No, though the controls overlap heavily. This one is aimed at insurers, auditors, and enterprise security reviews. The regulatory package is aimed at a specific legal obligation with a date attached.

### Do you do the assessment yourself?

The technical risk assessment, yes. Formal third-party attestation, no — the two stay separate by design, because independence is what makes an attestation worth having. When you need the certification, we bring in an accredited auditor and hand them a ready file.

Technical readiness, not legal advice. Counsel determines which obligations apply.

## Contact

[Discuss this engagement](mailto:n@nickcerutti.com) · [Pricing and terms](https://nickcerutti.com/pricing)

Canonical page: https://nickcerutti.com/services/agent-insurability