Agent Governance & Insurability Package
Your insurer is asking what your agents can do. You do not have the document.
Three to four weeks: the technical controls plus the evidence pack a carrier, an auditor, or an enterprise customer will actually accept.
3-4 weeks · $18-30K · Signed off by CISO, or CFO through the policy renewal
97 rules
Deterministic policy engine, zero-LLM enforcement
sub-2ms
Enforcement overhead — under 0.3% of an LLM call
Zero
Known policy bypasses across audited deployments
Technical readiness, not legal advice. The controls, the mechanics, and the evidence get built and verified. Whether an obligation applies to you is counsel's call — the engagement runs alongside them, and introductions to specialist counsel are part of the package.
Who this is for
- A cyber policy renewal questionnaire has landed and it asks about AI risk assessment, agent inventory, or least-privilege.
- An enterprise customer's security review is holding up a deal.
- You have the controls in some form but nothing you could hand to a third party as evidence.
And who it is not
- You want a policy document as paperwork. The dossier carries weight precisely because the controls behind it are real — building and verifying those is the substance of the engagement.
- You need a formal certification. This produces the evidence an assessor works from; it is not the assessment.
What you get
- An agent inventory and Agent Bill of Materials: what exists, what it can reach, and under whose authority.
- Identity and least-privilege enforced at the tool layer, with the gaps closed rather than documented.
- Cryptographic audit trails and attributable logging on every tool call.
- Human-in-the-loop review paths on the actions that need one.
- A risk assessment mapped to NIST AI RMF, and a carrier-facing dossier written for the underwriter rather than the engineer.
How it runs
Week 1
Inventory and gap analysis
What agents exist, what they can reach, what is logged, and what an underwriter would ask that you cannot currently answer.
Weeks 2-3
Close the gaps
Identity, least-privilege, attributable logging, spend controls, and human review paths — shipped, not specified.
Week 4
The dossier
The evidence pack, written to be read by a carrier, an auditor, or an enterprise security reviewer without a translator.
This has shipped
Read the code first
What it costs
$18-30K
Beta pricing. This package is new, so the price is being set against real scopes rather than guessed in advance. Bring yours to the call and the number comes out of it — not out of a template.
Every engagement can start as a $2,500 paid pilot, credited in full against the full scope if you go ahead.
Every engagement and what it costsBefore you talk to anyone
Agent Insurability Scorecard
Twenty questions a cyber underwriter or an enterprise security review will ask about your agents. Free, runs in your browser, and nothing you type leaves it.
Open the agent insurability scorecardQuestions people actually ask
Will this get us covered, or lower our premium?
Nobody can promise that — underwriting is the carrier's decision and depends on far more than agent controls. What this package does is move every question on the form from assertion to evidence, which is the part you control and the part that moves renewals.
Why is the pricing marked beta?
Because the demand signal for this package comes largely from enterprise and mid-market insurance sources, and it has not yet been validated at Series B to C scale. Rather than pretend otherwise, the price is being set against real scopes. That honesty is the point.
Is this the same as an EU AI Act package?
No, though the controls overlap heavily. This one is aimed at insurers, auditors, and enterprise security reviews. The regulatory package is aimed at a specific legal obligation with a date attached.
Do you do the assessment yourself?
The technical risk assessment, yes. Formal third-party attestation, no — the two stay separate by design, because independence is what makes an attestation worth having. When you need the certification, we bring in an accredited auditor and hand them a ready file.
Fifteen minutes is enough to work out whether this is the right engagement, or whether it is one of the others, or none of them.
Book a 15-min callScoping by email works too — send what you're building and the read-back comes with a recommendation on where to start — even when the right start is smaller than you expected.
The carrier-facing one-pager template: your score turned into the document format an underwriter can actually read.