The underwriter got there first.

Tuesday, October 13. Harbor came out of stealth in San Francisco with a $10 million seed led by Base10 Partners, Abstract, and 8VC. The pitch: find every AI agent a company runs, score each one against NIST AI RMF, SR 26-2, and the EU AI Act, block the decisions that break the company's own rules, then insure whatever risk is left. Banks and insurers in the US, Europe, and Latin America first. The why-now is blunt. When an employee screws up, professional liability, cyber, and tech E&O pay. When an agent screws up it does it a few thousand times before anyone notices, and carriers with no claims history are starting to carve AI out of the old policies.

Same day in Las Vegas, Workday opened Rising by agreeing to buy C1.ai, an identity platform that decides what people and agents can touch across email, CRM, code, finance systems, and cloud, then pulls the access when the job ends. A new Anthropic partnership puts Sana agents inside Claude, and the release says the user confirms every change. Aneel Bhusri's word of the day was lawful. "An agent that's not grounded in business rules might move fast. But it is essentially lawless."

Thursday the 15th, Crossmint and Harbor announced insurance and chargeback protection for agents that buy through Crossmint Agent Checkouts. Crossmint's own line: builders can "give users the confidence to hand off bigger purchases, without confirming each one." Coverage applies when an order doesn't match what the user asked for.

Same week, Mercury opened its MCP connector to payments. ChatGPT or Claude can queue a transfer, or a payment to a recipient you already have. Nothing moves until a person approves it in the Mercury app, the request dies after about five minutes, and new payees aren't allowed. The help page also says Mercury isn't responsible for losses from actions an authorized third party starts.

Last week I asked who stands behind the agent's yes when a supplier takes your domain at its word. The first people to show up with an answer weren't buyers or platforms. They were underwriters.

The read everyone had

Insurance is the grown-up signal. Once a carrier writes paper on it, the risk is real, measurable, a little boring. Workday locks down permissions, Mercury keeps a human on the button, Harbor covers the tail. Belt, suspenders, policy. Agents are cleared for bigger tickets.

Half right. It skips what a policy needs before it can pay a dollar.

Two ways to eat a bad order

Line the week up and there are two answers to the wrong purchase.

One is the click. Workday has the user confirm every change. Mercury makes you open a second app inside five minutes and won't pay anyone who isn't already on your list. The person approving is the control, and the other side is safe because a human signed for each move. It works. It also caps the agent at the speed of a thumb, and whoever approves forty payment requests before 11am stopped reading around number nine.

The other is the premium. Crossmint said it out loud: insurance so users can hand off bigger purchases without confirming each one. The premium replaces the click. You stop approving and start paying someone to absorb the times it goes wrong.

I like the second one more than I expected to. It's how the markets I invest around scale delegation. Nobody on a commodities desk approves every fill. There are limits, a margin account, and somebody on the hook for the gap.

But read the trigger. Crossmint covers an order that "doesn't match what the user asked for," and that clause is carrying the entire product. To pay a claim, someone has to pull up what the user asked for, in a form an adjuster can hold against the receipt. "Running shoes under $150, size 11, not the ugly ones" is a request. Which part of it is a limit, and which part did the agent get to interpret?

The adjuster reads it first

A policy can't pay on vibes. Every claim needs three facts: what the agent was allowed to do, what it did, and the gap. The second is easy now, everybody logs. The first barely exists. Inside Workday it's a permission set. Inside Mercury it's a payee list and a thumb. At the merchant it's whatever the user typed into a chat box.

So the insurer ends up writing it. Not out of ambition, the claim wording forces it. To price Harbor's residual risk a carrier has to define the covered act, which means defining what counts as authorized, which means somebody's underwriting form quietly becomes the agent's letter of authority.

This has happened before. Underwriters who drank at Lloyd's coffee house formed a register in 1760 because they needed to know which hulls they were insuring, and the ship classes it printed became what shipowners built to. Fire insurers backed William Henry Merrill's lab in Chicago in 1894 because they were the ones paying for electrical fires, and the UL mark became what inspectors and retailers looked for. Both times the people carrying the loss wrote the spec before the industry did.

i wonder if the authority document for agents turns out to be a policy schedule. Named agent, model version, tools, dollar limit, merchants, exclusions. Harbor already says it re-measures every time an agent's model, tools, or data change. That's an underwriting schedule wearing a monitoring feature's clothes.

The strongest case against

Carriers might not write it. They might just exclude it. ISO filed optional generative AI exclusions for general liability last year, and smaller carriers that take ISO forms on autopilot use them. But at the CIAB forum in Colorado Springs on October 7, Zurich's US CEO Alex Wells said Zurich doesn't use blanket AI exclusions and would rather treat AI as "an underwriting question rather than a contract question." Willis said AI is too embedded to exclude. Exclusion is losing because AI is in everything. That leaves underwriting, and underwriting leaves a schedule.

The sharper objection: a policy pays the insured. It doesn't tell the supplier on the other end of the email what your agent could promise. Harbor's own licensing page also says it places coverage as a distribution agent for surplus-lines carriers, so the assessor, the broker, and the balance sheet can be three different parties. Fair. Insurance makes the firm whole. It doesn't make the agent legible to anyone outside.

The machine-speed problem

The click doesn't scale and the premium does, so builders who want bigger tickets will buy coverage before they add another approval screen.

But a policy priced on last month's agent covers last month's agent. Swap the model Thursday and the schedule, if it was written well, no longer describes what's running. Re-measure on change is the right instinct. It's also an admission that the insured object moves faster than any paper does. Human E&O got away with annual renewals because a lawyer's judgment drifts over years. An agent's drifts on a deploy.

What the right layer looks like

The schedule shouldn't live only in the carrier's file. If an underwriter has already written down what the agent may do, in dollars, with which counterparties, on which model version, that same record is what the merchant and the supplier need to see before they ship. One record, three readers: the firm that issued it, the carrier pricing it, the counterparty relying on it.

Right now Workday has permissions, Mercury has a payee list, Crossmint has an order intent, Harbor has a risk score. None of them is readable by the person on the other side of the trade, and that's who loses money first.

The order is always wrong

#028 was the procedure nobody owned. #029 was supervision without a hire. #030 was a mailbox the counterparty can't see past. This week the loss got a price before the authority got a definition.

Same sequence every time. Capability, then presence, then controls, then a premium. Only after the first big claim does anyone write down what the agent was allowed to do, usually an adjuster.

Close

Tuesday Harbor raised $10 million to measure and insure agent risk, and Workday agreed to buy C1.ai and called its agents lawful. Thursday Crossmint and Harbor started insuring agent purchases so users can stop confirming each one. Mercury still makes a human approve inside five minutes.

The click and the premium are the two answers on the table, and the premium wins on speed. Whoever writes the claim form decides what the agent was allowed to do.

The underwriter got there first.

Max

Disclosure: Accords, where I'm Executive Chairman, is a portfolio position I chair.

Max Curnin has spent 11 years and 45+ investments on the physical rebuild of the economy: energy, compute, robotics, and the materials underneath. He writes The Agent Economy on the category he invests in.