Agent Insurability Scorecard

Is there a current list of every agent running in production?

An inventory gives reviewers a defined scope for evaluating controls and exposure.

For each agent, is it recorded which tools, APIs, and datasets it can reach?

Reach is the blast radius. An agent with database write access is a different risk from one that can only read a wiki.

Is the inventory updated automatically, rather than by someone remembering?

A manual inventory is accurate on the day it is written. Renewal is annual; drift is continuous.

Does each agent have its own identity, distinct from a human user's?

Agents running under a developer's credentials are indistinguishable from that developer in every log you own.

Can an action taken by an agent be attributed to a specific agent, version, and triggering request?

Attributability is what turns an incident into a claim you can substantiate.

Are agent credentials rotated and scoped with an expiry?

Expiry and rotation bound credential exposure; retain evidence of both controls.

Is each agent's access restricted to what its task actually requires?

Broad credentials enlarge the set of actions that a compromised agent could take.

Are destructive or irreversible actions gated behind an explicit control?

Deletion, payment and outbound communication are examples of actions requiring explicit authorization.

Is there a deny-by-default policy on tool access rather than allow-by-default?

The default determines what happens when someone adds a tool and forgets to think about it.

Are tool calls attributable, with redacted input/output metadata and outcomes?

Reconstructing an incident from application logs alone is the reason investigations take weeks.

Are those logs tamper-evident, or at least write-once?

Integrity controls help reviewers detect changes; restricted access and retention remain necessary.

Are logs retained long enough to cover a late-discovered incident?

Thirty-day retention against a breach discovered in month four means the answer is permanently unknown.

Is there a defined set of actions that require human approval before execution?

Document which actions require approval and how that requirement is enforced.

Is the approval enforced in the system, rather than being a documented expectation?

Verify the approval gate with a denied-action test and an authorized-action test.

Are there hard spend caps enforced at runtime?

Hard limits bound exposure even when a loop or repeated retry is not noticed.

Do circuit breakers stop an agent after a set number of tool calls per task?

A cap that does not depend on anyone noticing is the only one that works at three in the morning.

Is there a kill switch that stops a specific agent in production?

A tested shutdown path can shorten containment without requiring a full deployment.

Has an agent-specific incident been rehearsed in the last year?

The first time the kill switch is used should not be the first time it is tested.

Has an AI risk assessment been completed in the last twelve months?

Record the review scope, date, owner and outstanding findings.

Is that assessment mapped to a recognised framework such as NIST AI RMF?

A framework mapping explains how controls address risks. It does not establish legal compliance or insurance eligibility.