When the agent acts, who answers?

Why the risk bill hardened when the agent started acting alone

For most of the software era, liability for a product defect had a settled home. A vendor shipped a tool, a person operated it, and when something went wrong the general liability and errors-and-omissions policies that every enterprise carries did their quiet work in the background. That arrangement assumed a human in the loop making the consequential call. It starts to strain the moment the software stops assisting a decision and starts making one — when an agent approves an invoice for payment, files a document into a system of record, or triggers a downstream action without a person signing off first.

Insurers noticed before most buyers did. Through 2026, carriers began attaching AI-exclusion endorsements to commercial general liability renewals by default — language that carves losses "arising from the use of artificial intelligence" out of the policy that a company assumed covered its operations. These endorsements rarely arrive with a headline; they surface as a clause in the renewal packet, and the coverage a business thought it had for an automated action is simply no longer there. The gap opens at the worst possible moment: exactly as the agent takes on the actions — the payment, the decision, the write to a system of record — that create real financial exposure.

The market's response was a new product line. Standalone AI-liability policies emerged from specialist insurers and reinsurers, with limits reported in the low-single-digit to low-tens-of-millions range, written specifically to cover losses from autonomous or AI-driven action. And the underwriting for those policies did something the old general-liability renewal never bothered to do: it asked to see the governance. A company that can show a documented AI-governance programme — an inventory of what the agents do, the authority limits they operate under, the audit trail they leave — gets cover, and gets a higher limit. The company that cannot gets a smaller limit, a higher premium, or a decline. Governance conformance stopped being a virtue and became a condition of insurability. Directors' and officers' cover has moved the same way, with underwriters now reading a board's AI-governance maturity as a signal of how well the enterprise's automated risk is contained.

This is risk transfer, not identity and not tracing

Three adjacent disciplines get bundled together whenever "agent risk" comes up, and confusing them is the fastest way to buy the wrong control and believe the exposure is handled. Each answers a genuinely different question, and only one of them is about who pays when the agent is wrong.

Knowing which agent is acting is an identity problem — the agent equivalent of Know Your Customer, establishing which model, which version, which provider, and who delegated the authority. Knowing what the agent did is an observability problem — tracing the action, its inputs, and its context so you can reconstruct the event afterwards. Both are necessary, and both are upstream of the question this piece is about. Liability and insurance sit downstream of both: given that a known agent took a traceable action that caused a loss, who bears the financial consequence, under which contract clause, backed by which policy? Identity tells you it was your agent. Observability tells you what it did. Neither pays the claim. That is risk transfer, and it is allocated in a contract and backed by a policy — a different instrument entirely.

Read the rows together and the design consequence is clear: a vendor can have flawless agent identity and rich observability and still have no answer to the buyer's real question. Those two capabilities produce the evidence; they do not allocate the loss. The allocation happens in the master services agreement and the policy behind it, and a company that has built the first two rows and left the third blank has instrumented the incident without deciding who pays for it.

The framework that is forming

What is emerging is not a single clause but a small set of moves that together turn "the agent might cause a loss" from an unpriced open risk into a contained, insurable one. None of them is exotic; each is the agentic-era version of a discipline enterprises already know.

Allocate liability for agent action explicitly in the contract

The foundational move is to name, in the master services agreement, who answers when the agent acts with a side effect — vendor, customer, or shared — with a stated cap and an indemnification that matches it. The agentic era makes the old silent contract untenable: when an agent approves a payment or writes to a system of record, "the software" caused the loss, and a contract that never says whether the vendor or the customer owns that outcome leaves both parties to discover the answer in a dispute. The durable pattern states the allocation plainly and sizes the cap to the actual exposure the agent's authority creates — a decision that belongs in the negotiation, not in litigation after the first bad action.

Governance evidence that unlocks insurability and a higher limit

Because underwriting now reads governance, the documented programme is no longer an internal nicety — it is what converts an uninsurable posture into an insurable one, and a small limit into a larger one. The evidence an underwriter wants is concrete: an inventory of what the agents do, the authority ceilings they run under, the human-review gates on consequential actions, and the trail each action leaves. This is the same material that proportional agent governance tells you to build in the first place — the difference is that in 2026 it also sets the price of your cover. A vendor who can hand the underwriter a real governance package negotiates from a different position than one who describes intentions.

The signed audit trail as a claim prerequisite

An insurance policy is only useful if a claim can be substantiated, and an agent action that no one can reconstruct is a claim that cannot be paid. The audit trail therefore stops being a compliance artefact and becomes a precondition of the coverage: when a loss occurs, the insurer and the counterparties need to see what the agent did, on what input, with what authority, and whether the guardrails held. That is exactly the record that makes a non-deterministic system defensible — a signed, versioned trail of each consequential action — repurposed here as the thing that turns a policy into a payable claim rather than a contested one.

Runtime guardrails and human review, designed as premium reducers

The last move is to treat runtime controls not only as safety engineering but as instruments that shrink both the premium and the exposure. An authority ceiling that caps what any single agent action can commit, a human-in-the-loop gate on the highest-consequence decisions, and a kill switch that can halt an agent mid-run all reduce the size of the worst plausible loss — which is precisely what an underwriter prices. The same review that already exists against the general-liability renewal should now run against the new AI-exclusion endorsements specifically: read what the current policy carves out, and design the runtime controls to fit the coverage you can actually obtain rather than the coverage you assume you still have.

The old contract answered "is the software secure?" The new one has to answer "who pays when the agent decides, and are you covered for it?" — allocation named in the agreement, governance evidence that unlocks the limit, a signed trail that makes the claim payable, and runtime controls sized to the loss an underwriter will actually price.

Four ways it goes wrong

The failures here are predictable, and they cluster into four shapes. Each one lets a company operate an autonomous agent while believing it is covered, and each surfaces at the worst possible time — the first incident, when the policy is read line by line.

1. Assuming the old policy still covers the agent's action

The most common failure is the quietest: a company keeps operating on the assumption that its long-standing general-liability cover handles whatever the software does, without reading the endorsement that was attached at the last renewal. The AI-exclusion clause is already there, the automated action is already outside the policy, and no one finds out until a claim is denied. The fix is to read the current policy against the new endorsements now, before the incident, and to know precisely which automated actions are excluded rather than discovering it in a denial letter.

2. Running an autonomous agent with no authority ceiling

The second failure is operational: an agent is given the ability to act with no hard cap on what a single action can commit, so the potential loss from one bad decision runs past anything a policy will insure. An agent that can approve a payment of any size, or write to any record, creates an exposure that an underwriter either declines or prices punitively. The fix is the authority ceiling — a stated maximum on what any agent action can commit without escalation — which keeps the worst plausible loss inside a band that is actually insurable, and turns "unbounded exposure" into a number the policy can hold.

3. No audit trail, so the claim cannot be proven

The third failure defeats the coverage even when it exists. The agent acts, a loss occurs, the policy nominally applies — and the company cannot reconstruct what happened, on what input, under what authority. Without a substantiating record the insurer cannot validate the claim and the counterparties cannot apportion the fault, so a covered loss becomes a contested one. The fix is to make the signed trail a non-negotiable part of any consequential agent action, so that a claim arrives with its evidence attached rather than depending on a reconstruction that never materialises.

4. A contract silent on who answers for the agent's decision

The fourth failure is contractual. The master services agreement never says whether the vendor, the customer, or both own the outcome of an agent's action, so when the agent errs the two parties face each other across a gap the contract declined to close. Silence does not default to a fair split; it defaults to a dispute. The fix is the explicit allocation — who is liable, up to what cap, with what indemnity — written while the deal is being negotiated and both sides are still reasonable, not litigated afterwards when neither is.

The trade-off, stated honestly

The honest version names the tension, because it is real: agent autonomy and insurable exposure pull against each other. The more you let an agent decide and act without a human gate, the more value it can create unattended — and the larger the worst plausible loss an underwriter has to price. Capping authority, inserting human review on the highest-stakes decisions, and building the audit trail all cost something: they slow the fully-autonomous path, they add engineering, and they concede that some actions are not worth letting an agent take alone. A vendor who claims unlimited autonomy with full coverage and no controls is describing a product that does not exist at a price anyone will write.

What you buy for that cost is a business that is actually insurable and a contract that survives the first incident. The platform that sizes its agents' authority, gates the consequential actions, and leaves a signed trail can go to an underwriter with a governance package and negotiate a real limit — and can put a clean liability allocation in front of a customer instead of a silence both sides will regret. The trade is worth it precisely where the agent takes actions with financial or legal side effects, which is most of what makes agentic document work valuable. It is over-engineering only for an agent that never does anything consequential on its own — reads, drafts, suggests, and always hands the decision to a person. The tell that a vendor understands the trade is that they can state the authority ceiling their agent runs under, show the trail it leaves, and name who is liable when it errs — rather than promising autonomy with no mention of who pays.

What this looks like for document AI specifically

Document AI is where the abstract exposure gets concrete fast, because an extraction platform no longer just reads a document — an agent built on top of it acts on what it read: approves the invoice, files the record, writes the extracted figure into the system that pays or reports on it. Four things change when a document pipeline is built to be insurable rather than merely functional.

The agent's authority is capped per action, not open-ended. When an agent approves a payment from an extracted invoice or posts a figure to a system of record, a stated ceiling bounds what a single action can commit before it must escalate to a person. That ceiling is what keeps the worst plausible loss from any one bad extraction inside a band an underwriter will actually cover, instead of an exposure that scales with whatever number the document happened to contain.

Every consequential action leaves a signed, replayable trail. The approval, the figure that drove it, the confidence the model had, the authority the agent held, and whether a human gate applied are recorded as a versioned event — the same record that makes a non-deterministic pipeline defensible. When a loss surfaces, the claim arrives with its evidence attached: this action, this input, this authority, this outcome — provable, not reconstructed.

Human review is placed where the exposure concentrates. The highest-consequence decisions — a payment above a threshold, a filing with legal effect — pass through a person, and that gate is designed as much as a premium-and-exposure reducer as a quality control. It shrinks the set of losses that can happen fully unattended, which is exactly the set an underwriter worries about, and it maps cleanly to the obligations that attach to consequential systems under emerging AI regulation.

The liability allocation is scoped into the agreement, per action class. Rather than a single silent clause, the contract names who answers for which kind of agent action — the vendor for a defect in the model's behaviour within its stated authority, the customer for actions it configured beyond a recommended bound — with a cap and an indemnity that match. It is the commercial counterpart to the governance evidence an auditor and an underwriter both ask for, written before the agent acts rather than after it errs.

Closing thought

The insurance market repriced agentic risk before most boards finished their pilots, and it did so with a blunt instrument: it carved AI out of the policies companies already held, and offered new ones only to the governed. That turned a question the board could defer — "who answers when the agent errs?" — into a condition of doing business, because the honest answer determines whether you can get cover at all. A company that still treats agent risk as ordinary software risk will find, at the first incident, that its policy excludes exactly the event that occurred, its contract never said who pays, and its trail cannot prove what happened.

At Cogneris we build the agent to be insurable, not just capable: a stated authority ceiling on every consequential action, a human gate where the exposure concentrates, and a signed per-action trail that turns a claim into something an underwriter and a counterparty can both verify — because a platform whose agent acts on a document is a liability question whether or not anyone drafts the clause. Governance evidence unlocks the limit, the authority ceiling keeps the loss insurable, and the audit trail makes the claim payable. If you are working out how to move agent risk off "the old policy probably covers it" and into an allocation your contract states and your cover can back, and want to map which of your agent's actions carry a side effect that an underwriter will price, see our product page, read the security page, or talk to our team. We would rather scope the liability line — which actions, whose exposure, what the trail proves — in the first conversation than watch it surface as a coverage gap on the day the agent errs.