# The Behaviour Policy Is The Document The Only Agent Insurer Already Requires: Sell The Correction, And Not The Draft > version v0.33.70 date 11 September 2026 from Human (project lead) to Whoever names the product, prices it, and stands at the table with it next week *Source: · site v0.2.0 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Docs](../../../docs/index.md) / [The briefs](../../../docs/index.md#briefs) / The Behaviour Policy Is The Document The Only Agent Insurer Already Requires: Sell The Correction, And Not The Draft # The Behaviour Policy Is The Document The Only Agent Insurer Already Requires: Sell The Correction, And Not The Draft > **The source bytes.** This page is generated from [`docs/briefs/v0.33.70__strategy-brief__the-behaviour-policy-is-the-document-the-only-agent-insurer-already-requires-sell-the-correction-and-not-the-draft.md`](../../../docs/briefs/v0.33.70__strategy-brief__the-behaviour-policy-is-the-document-the-only-agent-insurer-already-requires-sell-the-correction-and-not-the-draft.md), which is served unchanged. Anything rendered on this network stays one click from the file it came from. **version** v0.33.70 **date** 11 September 2026 **from** Human (project lead) **to** Whoever names the product, prices it, and stands at the table with it next week **type** Strategy brief (the product, its name, and the go to market, with five memos behind it) *First of 11 September, and the first document in this session written by a model that joined it today. Five memos arrived across two turns and were reviewed against the corpus and the published estate before anything was written. The review found that the product itself was decided yesterday in two briefs, that the estate already publishes the three set model this memo re-derives, that the only insurer underwriting autonomous agents specifically already requires the document this memo proposes as a scoping input, and that the estate has a built and tested vault mapping the standard that insurer underwrites against. Two naming hazards were found, one inside the estate and one in the memo's own slip of the tongue. Limitations: no pricing is proposed beyond placing the product on the ladder that already exists; the incumbent's offer was read from its own site on one day; and the go to market described is a design for a conversation, not a tested one.* ## What This Is The naming of a product that was decided yesterday, the resolution of two collisions that naming creates, and a go to market that can be run at a table in five minutes: **the memos propose selling a policy for an organisation's agents that states the grant, the mandate and the behaviour expected, observe that the mandate is already understood by most deployers while the grant is not, argue that because an agent can do a thing it must be explicitly told not to, so the prohibition list grows with the grant and its length is the finding rather than a defect, note that the list also serves as a partial defence and as the input to guardrails and monitoring, place the whole thing in a graph so that policy for an agent, for an agent in an environment, with particular credentials, in particular situations and at particular times are all the same structure, state that what people call a policy is a projection computed from that graph so that executives and engineers each get their own rendering of one fact set, propose the name agent behaviour policy, say the policy is the licence to operate, propose that it can be produced without the customer's involvement by handing over a draft and asking whether it is correct, and want it on sale next week; the first finding is that the product exists in the corpus already, in yesterday's ruling that the product is an agent policy for an organisation derived from what its agents can actually do, so this brief names it rather than proposes it; the second is that the name collides with the estate's own demonstration, where the word policy already denotes the insurance instrument with its bands, ceilings, pool and premium, so the behaviour policy must never be called the policy; the third is that the only insurer currently underwriting autonomous agents by name requires, as a scoping input, a document listing the agent's capabilities, its autonomy level, its data access permissions, the tools it can call and its deployment context, which is this document, and the estate has a tested vault mapping that insurer's standard; the fourth is that the strongest go to market is the one the memo states in half a sentence, being that a draft derived from the deployment shape is handed over and the correction is the elicitation, which needs no access, no engagement, no data and no packet sent to anybody; and the fifth is that the regulatory reason a United Kingdom buyer will cite is not the European deployer article, which was deferred to December 2027 in July, but consumer guidance published on 9 March 2026 saying a business should be clear about what tasks an agent is allowed to perform, what data it can access and what constraints apply.** New contributions: **the name and the two hazards attached to it; the resolution of the licence to operate collision by supplying its referent; the four object structure that turns a long list into a finding; the mapping onto the existing price ladder so that nothing is added five days before the event; the draft and correction go to market; the correct regulatory citation; and, added after the project lead's comments, the principle that the ABP describes and never judges, carries no score, and is the label in a three part structure whose prescription is signed by somebody who did not sell it.** ## The Product Was Decided Yesterday Two claims from 10 September, verbatim from their key claims tables: > The product is an agent policy for an organisation, derived from what its agents can actually do, and never an insurance policy. > The wedge is agent policies, and the two things we add that it cannot are provenance and a named human. **So this brief does not propose a product.** It names one, and it adds three things the yesterday's briefs did not have: the mechanism that makes the document a finding rather than an inventory, the go to market, and the reason the document is on an insurer's intake form already. ## The Name, And Two Hazards Attached To It **Agent Behaviour Policy. ABP.** Three letters, pronounceable, unclaimed as a product as of today. The phrase appears in one academic paper and nowhere as a thing anybody sells. **Drop user acceptance policy.** The memos reach for it four times and correct it each time. User acceptance already means user acceptance testing to every engineer in the room, and the artefact being described is an acceptable use policy in shape, not an acceptance one. The confusion is not cosmetic: an acceptable use policy governs a person's use of a system, and this document governs what an agent may do. Borrowing the frame imports the wrong subject and lands the product in a category where at least eight free templates dated this year sit on the first page of search. **Withdraw the earlier objection to behaviour.** It was argued yesterday that behaviour names what an agent does rather than what it is authorised to do. With the graph framing, the document is the union of grant, mandate and expected behaviour, so the word is the right one. **The first hazard is the memo's own slip.** The last memo says ADP twice. ADP is one of the largest payroll processors in the world and a registered mark in every relevant class. **Nothing with that string on it may be printed.** The acronym is ABP and it should be spelled out at first use on every surface. **The second hazard is inside the estate, and it is the more serious of the two.** The published licence to operate demonstration describes itself as an insurance policy for an agent, simulated, and its policy object carries a normal band, an ask above threshold, a per action ceiling, a pool with an untouchable reserve and a premium per interval. **In the estate's own vocabulary, the policy is the insurance instrument.** A behaviour policy that is ever referred to as the policy will collide with it on the first page that mentions both. **The rule: the behaviour policy is always called the ABP or the behaviour policy, and never the policy.** That is a discipline for the writer of every page, and it costs one word. **And pick a spelling.** Behaviour or behavior. The product will be sold in both markets and an acronym does not care, but a wordmark does, and the earlier brief on marks says the mark is the moat. ## The Licence To Operate Collision, And What Closes It **Open since 8 September, and it blocks any public page.** Licence to operate, ruled on 3 September, means a permission granted by an authority. Mandate to operate, written on 17 July, means a description of exposure already carried. They mean opposite things and both are in use. **The memo says the policy is the licence to operate, and that sentence supplies what the collision has lacked, which is a referent.** The organisation is the authority. The ABP is the instrument. The agent is the licensee. That is internally consistent with the 3 September sense, and it makes the 17 July phrase redundant, which is what the cheapest proposed resolution already recommended. **It is self issued and witnessed by us, which is how most assurance works.** **This is a proposal for a ruling, not a ruling.** But it is the first time either phrase has had a concrete thing to point at, and that is what the collision needed. ## The Mandate Is Known And The Grant Is Not, So The List Is The Finding The second memo corrects a wrong reading, and the correction should be recorded in the corpus rather than in a conversation. > Most users understand the mandate either explicitly or implicitly. They sort of understand that this is what we expect the agent to do. The problem is they don't understand the grant. **That is an empirical claim about buyers and it is right.** Nobody needs to be told what they wanted the agent to do. They need to be told what it can do. So the work, and the value, sit on the grant side, and **the length of the resulting list is the measurement, not a maintainability problem.** A list that comes back long is the finding that makes the buyer move. **But a long list on its own is an inventory, and an inventory is not a sale.** Your agent can do three hundred and forty things is a shrug. **Your agent can do three hundred and forty things and you authorised twelve is a finding.** The mandate is the edge that gives the enumeration a shape, and it must be captured even though it is already known. Captured cheaply, elicited rather than authored, because the buyer already holds it. **So there are four objects, and the memo's list is the fourth.** | Object | How it is obtained | What it is | |---|---|---| | **The mandate** | Elicited, in minutes, because the buyer already knows it | What the agent is authorised and expected to do | | **The grant** | Measured, from the deployment shape and the credentials | Everything the agent can do | | **The delta** | Computed, never stored | The excess authority | | **The prohibitions** | The enforceable projection of the delta | The subset a control can actually bound, written as instructions | **The prohibitions are smaller than the delta**, because they are the part something can enforce. That distinction matters for the next brief, because a prohibition has two very different lives depending on where it is enforced. **The memo's own line for the site, which falls out of this:** a human acceptable use policy is short because humans have judgement and social constraint. The agent version is long for the same reason the agent is useful. It does precisely what it is permitted to do, and nothing stops it. ## The ABP Carries No Verdict And No Score **Added after the project lead's comments of 11 September, and it sits above everything else in this brief.** **The ABP describes and does not judge.** It states the grant, the mandate, the delta and the barrier on each capability. It never says whether any of that is acceptable, because acceptability is not in the document. **The same ABP is dangerous in one deployment and harmless in another, and nothing about the document changed.** The most permissive grant running where nothing is reachable is a low risk; the same grant with a database attached tomorrow is a different risk; and the document is identical on both days. **A policy cannot be dangerous. A deployment can.** **So the ABP carries no score, anywhere.** No rating, no traffic light, no risk level. Every buyer will ask for one in the first meeting, and the answer is that **the score has a home, and it is the risk product**, where the assets are known, the acceptance workflow exists and a named professional signs. A score on the ABP is the fastest way to make it wrong in one of the two rooms. **This changes three things already in this brief, all for the better.** **The long list is an inventory and not an admission.** The ABP asserts that a capability exists, never that a risk is unacceptable, which is materially different from a findings register. It moves an exposure rather than removing it, and it is the right thing to draft toward. **The correction is factual.** The draft and correction motion never asks a buyer to agree that something is dangerous. It asks whether their agent can do a thing. That is a conversation you can have with somebody who knows their business better than you do. **The record is what is sold.** A description of the grant rots on a known clock, the product's releases and the deployment's changes. A verdict rots on an unknown one. **A document with a visible clock can be re-sold. A verdict cannot.** **The structure this gives the whole offer, which the project lead has adopted:** the ABP is the label, the twin is the patient record, and the risk score is the prescribing decision. The first two are the first product. The third is the uplift, and it is signed by somebody who did not sell the first two, because the standing rule is that the people who sell do not sign. **That rule is why the sequence separates cleanly rather than commercially.** **Two corrections to our own data that the principle forces.** The undo class is not fully context free, because reversibility depends on backups and retention, so it is recorded as the product's published behaviour with a note that the deployment can change it. And no assets does not mean no consequence; it means no consequence to you, since an agent with world reach in an empty environment can still reach third parties. **Every ABP carries a validity statement**: this describes the deployment shape as at this date, and if the risk changed, the deployment changed, not this document. ## The Only Agent Insurer Already Asks For This Document **One insurer underwrites autonomous agents by name today.** It launched in July 2025 with a fifteen million dollar seed round, is backed at Lloyd's, wrote what its customer called first of its kind agent insurance for a voice platform on 11 February 2026 after more than five thousand adversarial simulations, and offers limits reported at fifty million dollars per policyholder. **Its terms are tied directly to audit results against a standard it publishes.** **That standard's scoping requirements, quoted from its own site:** the organisation must document **capabilities**, meaning the specific functions the agent performs and its autonomy level; **architecture**, meaning data access permissions and which tools it can call; **deployment context**; and a **statement of applicability** listing which of roughly fifty requirements apply. Its second quarter update of 15 April 2026 added a mandatory control for permission ready architecture such as just in time permissions to limit the scope and duration of agent privileges, cryptographically verifiable agent identities, and tool authorisation and logging extended to protocol servers. **Read that list against the four objects above.** Capabilities and tools are the grant. Autonomy level and deployment context are the environment dimension. The statement of applicability is the mandate in the standard's own terms. **The ABP is the scoping document that insurer already requires, expressed as a graph.** **And the estate has already built the other half.** A published vault maps that standard's catalogue byte for byte, passes the catalogue's own twenty one tests and nineteen of its own, and produces conformance objects for a named subject with attestations carrying a tier and an expiry date, with unevidenced as the default. Its own wording: **it records what is evidenced and what is not; it certifies nobody, maps nothing officially, and makes no underwriting decision.** That is the correct posture, and it is the posture the ABP inherits. **Two others have entered the same space this year and neither has the document.** A conformance vendor announced continuous governance of agents on 4 August 2026, in limited availability and for one model provider's agents only, compiling plain English intent into enforceable rules. A guarantee backed startup raised five and a half million in July 2026 to insure agent actions in bounded business to business use cases. **Both are downstream of a written statement of what the agent may do, and neither produces one.** ## The Incumbent, Read From Its Own Site **One company sells a written policy for agents today.** Two thousand one hundred and ninety nine dollars, one time, for twenty or more editable word processor templates including an agent acceptable use policy described as what agents can and cannot do, an agent data access and permissions policy, an approval workflow, an escalation policy and a decommissioning runbook. It advertises a thirty minute onboarding call for the first twenty buyers and a thirty day guarantee. **What it does not have, and what the ABP is:** no machine readable form, no derivation from the buyer's own deployment, no review service, no provenance on any claim, and no named human. It is a template. **It cannot be a finding because it does not know what the buyer's agent can do.** **Yesterday's two additions stand, and this brief adds a third.** Provenance and a named human were the two things the wedge brief said we add. **The third is that the document is derived from the customer's own measured grant, which a template can never be.** ## Sell The Correction, Not The Draft **The best idea across all five memos is said in half a sentence.** > You could even do it from a point of view of, hey, here's the policy for your agent, can you then agree that this is correct or incorrect? And that's also a great way to reverse engineer actually what the agent is doing. **This inverts the sales motion completely.** No access. No engagement. No customer data. No infrastructure on their side or ours. **A draft ABP is derived from a deployment shape**, meaning which agent product, running where, with which class of credentials, in a container or on a desktop or with an administrator's rights. The draft is handed over. **The correction is the elicitation.** A person who corrects the document has told you their mandate, told you where the draft's grant was wrong, and engaged with the product before paying for it. **Three properties make it the right thing for next week.** **It is the only version producible in a room.** Every other form of the ABP is a booking. This one is a five minute conversation over a printed draft, and the printed draft is the card. **It is legally clean.** The standing rule is never to send a packet to a third party system that was not asked for, because causing a computer to output data intending unauthorised access is an offence with no research defence. **A draft about a deployment shape sends nothing anywhere.** It asserts, and asks to be corrected. **It respects the buyer's competence.** The mandate is theirs. The document says so by asking them to state it, rather than by pretending to know it. **The draft should be wrong on purpose in one place.** Not misleading, but conservative: it should state a grant that the buyer will recognise as too small, because the correction upward is the moment they realise the grant is larger than they thought. That is the mechanism the games site publishes, applied to a printed page: **make somebody state a belief before they are told the answer.** ## It Sits On The Ladder That Already Exists **Do not add a fifth tier five days before the event.** The four tiers were set on 10 September and the offer page is being built against them. | Tier | Price | What it delivers | Where the ABP is | |---|---|---|---| | **1** | GBP 10 | Their own answers, their measured grant, and the delta, as a file they keep | **This is a draft ABP.** The tier one product has had no name and now has one | | **2** | GBP 50 to 100 | The customised regulation as a vault they own | Not the ABP. The regulation the ABP is later mapped against | | **3** | GBP 150 to 1,000 | A person reviewing and running a vault | **The full ABP.** Mandate elicited properly, grant measured against the real deployment, prohibitions marked by where each is enforced, delivered as a vault with the projections | | **4** | GBP 5,000 to 10,000 | An assessment by security professionals | The ABP plus the assessment of whether the prohibitions are actually enforced where they claim to be | **The project lead's sequencing, added 11 September: the ABP and the twin are the first product, sold together, and the risk score is the uplift.** One dependency stands in front of that: the twin's running state was an open question in the third brief of today and is still open. If the twin is built, the first product is the ABP with a hooked twin. If it is not, the first product is the ABP and the twin is the second. **And the two have different sales motions**, because the ABP's draft and correction needs no access to the customer's environment and a hooked twin needs exactly that. That difference is the natural boundary between tier one and tier three. **So the ABP is not a new product.** It is the name for what tiers one and three deliver, and it is the thing that makes tier one worth ten pounds, because a measured grant with no name is a spreadsheet and a measured grant called a behaviour policy is a document somebody keeps. **The tier one dependency stands.** An application built in August, on which the ten pound product depends, has not been located. The draft and correction motion is a questions page with a printed output, and it can be built in the time available whether or not the August application is found. ## The Regulatory Reason A Buyer Will Cite, And The One They Will Not **The reason is not the European deployer article.** The omnibus regulation entered into force on 27 July 2026 and deferred the high risk obligations, including the deployer obligations on human oversight, monitoring and logging, to **2 December 2027**, and only for systems in the high risk annex. An organisation whose agent is not high risk has no duty under that article at all, and one whose agent is has fifteen months. **The reason is consumer guidance published in the United Kingdom on 9 March 2026.** It states that if an agent a business uses does something illegal, the business is responsible, and that businesses **should be clear about what tasks an AI agent is allowed to perform, what data it can access, and what constraints apply**, with testing before deployment and monitoring after. **That is the closest any regulator has come to describing the ABP by its contents**, it is current, it is domestic, and the consumer regime behind it carries fines to ten per cent of global turnover with direct enforcement since April 2025. **The security engineering reason, for the technical buyer.** The industry's own list of the ten agentic application risks, published 9 December 2025, puts tool misuse and identity and privilege abuse at positions two and three, with mitigations centred on least privilege, scoped credentials and enumerated tool catalogues. **An enumerated tool catalogue with a stated scope is the grant half of the ABP.** **For a buyer certifying against the management standard:** the standard's annex carries controls for an AI policy, its alignment with other policies, its review, and the intended use of AI systems. Titles only, because the standard's text may not be reproduced or fed to a model, per the standing licence rule. ## What This Does Not Try To Be - **A pricing decision.** The ABP is placed on the existing ladder and no number is changed. - **A ruling on the naming collision.** The referent is supplied and the ruling is the project lead's. - **The graph model.** That is the second brief of today. - **The insurance argument.** That is the third, and the word insurance does not appear on any page this brief describes. - **A test of the go to market.** It is designed here and has been run with nobody. ## Honest Tensions | Tension | Note | |---|---| | Naming a product decided yesterday | It is the right discipline, and it means the memo's energy went into something already ruled | | The word policy | The estate's own demonstration owns it for the insurance instrument, and every page will want to shorten ABP to it | | The long list as the finding | It is the measurement, and a list the buyer cannot act on is a liability document, which the third brief takes up | | Selling the correction | It needs no access and no data, and it means the first thing a buyer sees from us is something wrong | | The tier one placement | It gives the ten pound product a name, and it ties the ABP's first impression to an application nobody can find | | The consumer guidance as the driver | It is current and domestic, and it applies only to consumer facing agents | | The insurer's scoping document | It validates the shape exactly, and it is one insurer with one standard | ## Open Questions 1. **Is the licence to operate collision closed by this referent?** A ruling is needed and nobody has made it. 2. **Behaviour or behavior?** The wordmark decision, and it is due before anything is printed. 3. **What does the printed draft look like?** It is the card for tier one and it has not been drawn. 4. **Which deployment shapes get a draft?** The draft and correction motion needs a small library of shapes, and the first five have not been chosen. 5. **Does the August application exist?** If it does, tier one is that application with a new name. If not, it is a questions page. 6. **Who says the mandate?** For a corporate buyer, the person at the table is rarely the person who authorised the agent, and the standing rule is that the stakeholder is the entry point and not the risk bearer. 7. **Does the consumer guidance reach agents that never touch a consumer?** It is the strongest current citation and its scope is consumer law. ## Relationship To Previous Briefs **From the policy and wedge briefs of 10 September**, it takes the product, the incumbent and the two additions, and it adds a third addition and a name. **From the naming rulings**, it takes the instruction not to coin a noun but to name for the buyer's question, and it finds that the buyer's question was already chosen yesterday for the corporate card: what is your agent allowed to do. **From the licence to operate collision**, it takes the two definitions and supplies the referent that neither had. **From the published licence to operate demonstration**, it takes the three set model and the finding that the word policy is already spoken for. **From the payment and catalogue briefs**, it takes the four tiers and places the ABP on them without changing a number. **From the marketing brief's first hard rule**, it takes the prohibition on sending unrequested packets and finds that the draft and correction motion satisfies it by construction. **From the games site**, it takes the mechanic and applies it to a printed page that is conservative on purpose. ## Key Claims | # | Claim | |---|---| | 1 | The product was decided on 10 September as an agent policy derived from what the agents can actually do, so this brief names it rather than proposes it | | 2 | The name is Agent Behaviour Policy, and it must never be shortened to the policy, because the estate's own demonstration uses that word for the insurance instrument | | 3 | User acceptance policy is dropped because it names a different thing and imports the wrong subject | | 4 | The string in the last memo's slip is a large payroll company's mark and may not be printed | | 5 | The mandate is known and the grant is not, so the value is on the grant side and the length of the list is the finding | | 6 | A long list alone is an inventory, and the elicited mandate is what turns it into a finding | | 7 | The ABP describes and does not judge, so it carries no score, because the same document is dangerous in one deployment and harmless in another, and the score lives on the risk product | | 8 | The only insurer underwriting autonomous agents by name requires a scoping document listing capabilities, autonomy level, data access, callable tools and deployment context, which is this document | | 9 | The estate has a tested vault mapping that insurer's standard, which certifies nobody and makes no underwriting decision | | 10 | The draft and correction motion needs no access, no data and no packet, and is the only form producible in a room | | 11 | The ABP is the name for what tiers one and three already deliver, and no tier is added | | 12 | The regulatory citation is the consumer guidance of 9 March 2026, not the deployer article, which was deferred to December 2027 | ## Sources All read 11 September 2026. **Inside the estate.** The licence to operate demonstration at https://sgit.ai/demos/vaults/licence-to-operate/index.html, which defines the grant, the mandate and the delta and describes its policy object as an insurance policy for an agent, simulated. The conformance vault at https://sgit.ai/demos/vaults/aiuc-1-conformance/index.html, with its test counts and its disclaimer. The games site at https://games.sgit.ai/llms.txt. The 10 September briefs on the policy document, the wedge, the payment rail and the catalogue. **The insurer and its standard.** The standard's scoping page at https://www.aiuc-1.com/scoping and its second quarter update at https://www.aiuc-1.com/research/2026-q2-standard-update, dated 15 April 2026. The launch at https://www.reinsurancene.ws/artificial-intelligence-underwriting-company-launches-with-15m-seed-round/, 23 July 2025. The first agent insurance announcement at https://www.prnewswire.com/news-releases/elevenlabs-secures-first-of-its-kind-ai-agent-insurance-302684587.html, 11 February 2026. The reported limit at https://www.fastcompany.com/91550776/rajiv-dattani-is-bringing-insurance-to-the-ai-agent-boom, 18 June 2026. **The incumbent and the entrants.** The template offer at https://agentguru.co/. The conformance vendor's announcement at https://drata.com/about/news/drata-extends-trust-management-platform-to-continuously-monitor-and-govern-ai-agents, 4 August 2026. The guarantee backed startup at https://www.klaimee.ai/ and its round at https://fintech.global/2026/07/22/klaimee-lands-5-5m-to-insure-autonomous-ai-agents/, 22 July 2026. The academic use of the phrase at https://arxiv.org/html/2508.14415v1. **The regulatory citations.** The consumer guidance at https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents, 9 March 2026. The omnibus regulation and its deferrals at https://www.whitecase.com/insight-alert/eu-ai-omnibus-enters-force-amending-ai-act. The agentic application risk list at https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/, published 9 December 2025, whose full text was not fetched. The management standard's annex control titles from a secondary listing, with no standard text reproduced. This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0). --- *[Site index for agents](../../../llms.txt) · [HTML version](https://abp.sgit.ai/docs/briefs/v0.33.70__strategy-brief__the-behaviour-policy-is-the-document-the-only-agent-insurer-already-requires-sell-the-correction-and-not-the-draft/index.html)*