Agent Insurability Scorecard

Is there a current list of every agent running in production?

An underwriter cannot price exposure they cannot enumerate. This is the question everything else depends on.

For each agent, is it recorded which tools, APIs, and datasets it can reach?

Reach is the blast radius. An agent with database write access is a different risk from one that can only read a wiki.

Is the inventory updated automatically, rather than by someone remembering?

A manual inventory is accurate on the day it is written. Renewal is annual; drift is continuous.

Does each agent have its own identity, distinct from a human user's?

Agents running under a developer's credentials are indistinguishable from that developer in every log you own.

Can an action taken by an agent be attributed to a specific agent, version, and triggering request?

Attributability is what turns an incident into a claim you can substantiate.

Are agent credentials rotated and scoped with an expiry?

A long-lived token held by an autonomous process is the failure mode carriers have started asking about by name.

Is each agent's access restricted to what its task actually requires?

Convenience-scoped credentials are the single most common finding in agent security reviews.

Are destructive or irreversible actions gated behind an explicit control?

Deletion, payment, and outbound communication are the three that produce claims.

Is there a deny-by-default policy on tool access rather than allow-by-default?

The default determines what happens when someone adds a tool and forgets to think about it.

Is every tool call logged with its inputs, outputs, and outcome?

Reconstructing an incident from application logs alone is the reason investigations take weeks.

Are those logs tamper-evident, or at least write-once?

An audit trail an insider can edit is not evidence.

Are logs retained long enough to cover a late-discovered incident?

Thirty-day retention against a breach discovered in month four means the answer is permanently unknown.

Is there a defined set of actions that require human approval before execution?

Both regulators and underwriters ask this one, in almost the same words.

Is the approval enforced in the system, rather than being a documented expectation?

A policy that depends on the operator remembering it is a policy that has already failed once.

Are there hard spend caps enforced at runtime?

Runaway spend is the most frequent agent incident and the easiest to bound.

Do circuit breakers stop an agent after a set number of tool calls per task?

A cap that does not depend on anyone noticing is the only one that works at three in the morning.

Is there a kill switch that stops a specific agent in production?

Redeploying to disable an agent is not incident response.

Has an agent-specific incident been rehearsed in the last year?

The first time the kill switch is used should not be the first time it is tested.

Has an AI risk assessment been completed in the last twelve months?

This appears close to verbatim on renewal questionnaires. It is worth being able to answer yes with a document.

Is that assessment mapped to a recognised framework such as NIST AI RMF?

Framework alignment is treated as a safe harbour under at least one US state statute, and it is the vocabulary assessors already read.