Insuring Agentic Processes: Measurement, Pooling, and Attestation for AI-Agent Risk

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Insurance-oriented evidence for AI systems requires measurements, cross-organizational aggregation, and records whose integrity can be checked. We study these as three separate components rather than an evaluated end-to-end insurance system. A twelve-category, single-turn prompt suite yields 3,600 trials across five hosted models, of which 2,989 are classifiable. On these observed responses, financial-domain hallucination and in-context injection have elicitation rates of 85.1% and 43.1%, compared with 0.7% for jailbreak prompts. These are prompt-suite outcomes, not estimates of deployment incident frequency or insured loss. Two LLM judges agree with Cohen’s kappa = 0.77 on 359 valid paired labels; the secondary judge shares a vendor family with one tested model. In synthetic portfolios of 100–5,000 organizations, suppression-only k-anonymity at k = 5 discards every record, while hierarchical generalization retains industry-ranking correlations of at least 0.95 for n ≥ 500. Distinct l-diversity eliminates the measured homogeneity attack at a suppression cost. A Laplace-noise ablation is evaluated for utility, without claiming differential privacy for the complete data-dependent release. Finally, an Ed25519–Merkle implementation processes 1.75 million records/s in million-record signing batches, with measured single-record verification times of 39–54 microseconds. Attestation authenticates committed content, not incident completeness, truth, or time. Public artifacts expose the component measurements and their limits as a basis for subsequent deployment and actuarial studies.