Agent Governance & Insurability Package
Your insurer is asking what your agents can do. You do not have the document.
Three to four weeks: technical controls and a traceable evidence pack prepared for review by a carrier, auditor, or enterprise customer. Acceptance depends on their requirements.
3-4 weeks · $18K-30K · Signed off by CISO, or CFO through the policy renewal
80 + 17
Python rules + additional TypeScript/JavaScript rules in the reviewed Drako revision
Versioned
Public control implementation and benchmark conditions
Traceable
Control-to-test evidence, with gaps and limitations recorded
Technical readiness, not legal advice. The controls, the mechanics, and the evidence get built and verified. Whether an obligation applies to you is counsel's call — the engagement runs alongside them, and introductions to specialist counsel are part of the package.
Who this is for
- A cyber policy renewal questionnaire has landed and it asks about AI risk assessment, agent inventory, or least-privilege.
- An enterprise customer's security review is holding up a deal.
- You have the controls in some form but nothing you could hand to a third party as evidence.
And who it is not
- You want a policy document as paperwork. The dossier carries weight precisely because the controls behind it are real — building and verifying those is the substance of the engagement.
- You need a formal certification. This produces the evidence an assessor works from; it is not the assessment.
What you get
- An agent inventory and Agent Bill of Materials: what exists, what it can reach, and under whose authority.
- Identity and least-privilege enforced at the tool layer, with the gaps closed rather than documented.
- Cryptographic audit trails and attributable logging on every tool call.
- Human-in-the-loop review paths on the actions that need one.
- A risk assessment mapped to NIST AI RMF, and a carrier-facing dossier written for the underwriter rather than the engineer.
How it runs
Week 1
Inventory and gap analysis
What agents exist, what they can reach, what is logged, and what an underwriter would ask that you cannot currently answer.
Weeks 2-3
Close the gaps
Identity, least-privilege, attributable logging, spend controls, and human review paths — shipped, not specified.
Week 4
The dossier
The evidence pack, written to be read by a carrier, an auditor, or an enterprise security reviewer without a translator.
Relevant work and public code
Read the code first
Sources and sample deliverables
author reported · Reviewed 2026-09-22
Drako deterministic controls. The README distinguishes 80 Python rules and 17 additional TypeScript/JavaScript rules. Timings depend on the benchmark and are not a latency guarantee for an entire agent request. Repository code is not evidence of insurer acceptance.
experimental · Reviewed 2026-09-22
Epica belief-revision runtime. An implementation of selected research ideas. Cryptographic integrity does not establish that a recorded statement is true or that a system is compliant.
Inspect a deliverable
Synthetic scenario: inventory, permissions, test results and unresolved gaps. Free Markdown download; no email required.
What it costs
$18K-30K
Beta pricing. This package is new, so the price is being set against real scopes rather than guessed in advance. Bring yours to the call and the number comes out of it — not out of a template.
Every engagement can start as a $2,500 paid pilot, credited in full against the full scope if you go ahead.
Every engagement and what it costsBefore you talk to anyone
Agent Insurability Scorecard
Twenty self-assessment questions about inventory, permissions, evidence and response, to prepare for security and insurance reviews. Free, runs in your browser, and nothing you type leaves it.
Open the agent insurability scorecardQuestions people actually ask
Will this get us covered, or lower our premium?
Nobody can promise that — underwriting is the carrier's decision and depends on far more than agent controls. What this package does is move every question on the form from assertion to evidence, which is the part you control and the part that moves renewals.
Why is the pricing marked beta?
Because the demand signal for this package comes largely from enterprise and mid-market insurance sources, and it has not yet been validated at Series B to C scale. Rather than pretend otherwise, the price is being set against real scopes. That honesty is the point.
Is this the same as an EU AI Act package?
No, though the controls overlap heavily. This one is aimed at insurers, auditors, and enterprise security reviews. The regulatory package is aimed at a specific legal obligation with a date attached.
Do you do the assessment yourself?
The technical risk assessment, yes. Formal third-party attestation, no — the two stay separate by design, because independence is what makes an attestation worth having. When you need the certification, we bring in an accredited auditor and hand them a ready file.
Fifteen minutes is enough to work out whether this is the right engagement, or whether it is one of the others, or none of them.
Book a 15-min callScoping by email works too — send what you're building and the read-back comes with a recommendation on where to start — even when the right start is smaller than you expected.
The carrier-facing one-pager template: your score turned into the document format an underwriter can actually read.
Request by emailn@nickcerutti.com · Include the question or project you have in mind.