There's a useful shortcut for figuring out whether a risk is real: watch what the insurance industry does with it. Underwriters aren't in the business of guessing. They price a risk when they believe it's quantifiable, and they stay away from it when it isn't. So when four separate companies start writing policies specifically for AI agents making autonomous mistakes, that's not a marketing trend. That's the market deciding the risk is both real and measurable, which for anyone deploying agents in production is worth paying attention to.

In screening more than 200 companies building AI agents that act inside customer systems, we found four that have moved past discussing agent risk and started pricing it directly.

Mount covers incorrect funds transfers, service failure and negligence, and data restoration, and is working with major reinsurance and brokerage names including Guy Carpenter, AON, and Zurich. Klaimee offers an insurance-backed warranty for autonomous agents that pairs pre-bind testing with parametric claims triggers, meaning a claim can pay out automatically once a defined condition is met, rather than waiting on a lengthy adjustment process. AIUC combines policies and audits with AIUC-1, a certification standard built specifically for autonomous agents, an effort backed by investors including Nat Friedman and Anthropic co-founder Ben Mann. Corgi writes professional liability specifically for AI agent startups, the kind of coverage that didn't exist as a distinct category two years ago.

None of these are hypothetical products sitting in a pitch deck. They're underwritten offerings, which means actuaries somewhere have already modeled loss ratios for agents taking the wrong action.

The reason this category exists at all comes down to a gap in what companies already carry. Cyber insurance is built to cover unauthorized access, someone breaking into your systems from the outside. Technology errors and omissions coverage is built to cover a bug in software a human wrote. Neither policy type was ever designed to answer the question an autonomous agent raises: what happens when nothing was hacked and no code was buggy, and the software simply made an independent decision that turned out to be wrong?

Klaimee has been direct about naming this gap in its own materials, describing the two existing coverage types and pointing out that neither one extends to an agent's own autonomous action. It's a clean way of putting a fairly abstract problem into concrete terms. An agent that files a claim on the wrong account, books a payment against the wrong invoice, or issues a refund it had no basis to issue hasn't triggered a security incident and hasn't hit a code defect. It did exactly what it was built to do, just on the wrong record. Standard commercial coverage has no line item for that.

Here's where the story moves from interesting to practically urgent. Klaimee's own positioning states that enterprise procurement and legal teams are increasingly unwilling to approve an AI agent deployment without proof of coverage. If that holds as a norm, and there's a reasonable case it will given how fast health systems, banks, and insurers are wiring agents into core workflows, then the question every agent company faces stops being "do you check your agent's actions" and becomes "can you prove it."

Those are very different bars to clear. The first is an engineering choice. The second requires an evidence trail: a record of what the agent proposed, what policy it was checked against, what was allowed or blocked, and why. That's precisely the kind of documentation an underwriter needs to model a loss ratio accurately, and it's precisely what most agent stacks aren't currently producing, because most of the existing safety investment sits either before deployment (evals) or after execution (observability), with very little captured at the actual moment a decision got made.

It's worth separating this from a related but different phenomenon: industries where a human never leaves the loop for legal reasons, independent of how good the underlying model gets. Clinical documentation requires a physician or therapist signature by law, so every ambient scribe product returns a draft rather than a finished record. In prior authorization, the Centers for Medicare & Medicaid Services considered but explicitly did not finalize AI guardrails for utilization management in its CY2026 Medicare Advantage final rule, choosing to hold off on rulemaking in that area for now, which means health plans have no regulatory cover to remove the clinician from that decision. Customs entries require a licensed broker who personally carries the liability for what's filed. Investment research runs into fiduciary duty, and in our screening, every single company we looked at in that category kept a human or committee making the final call. Financial reporting at public companies is bound by Sarbanes-Oxley's segregation-of-duties requirements.

In those five categories, the ceiling on autonomy is statutory. No amount of model improvement changes it. Everywhere else, the ceiling is trust, and trust is exactly the kind of thing an insurance market and a procurement checklist can both put a number on.

This is the part that connects directly back to what we build. An underwriter modeling loss ratio, or a procurement team asking for proof, isn't looking for a promise that your agent behaves well in testing. They're looking for evidence about what happens at the moment an action executes in production, because that's where the loss actually occurs.

Salus sits at exactly that point, between an agent and the tools it's about to use. For every proposed action, it checks whether the action is permitted by policy and backed by real evidence before your backend ever executes it. When something's missing, the agent gets a specific, structured reason back rather than a blanket denial, so the retry can actually succeed. And every decision, allowed, clarified, revised, or denied, leaves a receipt: what was proposed, what policy applied, what evidence was present, and what happened next. That's not just an internal debugging tool. It's the exact shape of documentation a claims adjuster, an auditor, or a procurement reviewer would ask for after the fact.

None of this requires betting your production traffic on day one. The typical path starts with replaying recent traces to see what an agent has actually been attempting, writing a policy for the single action route where a mistake would cost the most, and running that policy in shadow next to live traffic with nothing enforced. You see exactly what would have been caught before a single decision changes. Only once that picture is trustworthy does a route move to live enforcement, which is usually a one-endpoint change.

If an insurer or a customer's procurement team is starting to ask what happens the moment before your agent acts, it's a good time to have an answer that isn't a policy document. Salus can show you, in shadow mode, against your own traffic, before anything is enforced.