Your Insured's AI Agent Caused the Loss: Was It Authorized to Act?

This paper examines a developing insurance problem created by autonomous and semi-autonomous AI agents: when an insured deploys an AI agent that causes a financial, operational, contractual, cyber, or physical loss, who bears responsibility and how should insurers evaluate the resulting exposure? It argues that conventional concepts of permission, access control, spending limits, and technical capability may be insufficient for underwriting increasingly autonomous systems. The paper distinguishes an agent’s capability to act from its presently verified authority to perform a particular consequential action, and considers how authority verification, delegation controls, provenance, reversibility, and auditability could become measurable components of AI risk. The paper is intended as an insurance-industry discussion document addressing emerging questions in underwriting, coverage, claims, risk engineering, and AI governance.