AI Agents Know the Policy, Not the Risk

AI Agents Step In

Consider an AI agent supporting commercial property underwriting. It might have access to the policy wording, underwriting guidelines, claims history, property information, pricing models, and customer records, and could retrieve more information more quickly than any individual underwriter.

But access to information is not the same as understanding it. The agent might know that a warehouse is covered against particular events. It might know its location, construction type, and claims history. It might know the insured has been a customer for 10 years and has historically represented a relatively low loss risk.

Yet the actual risk may depend on considerably more information. Perhaps the customer has recently changed what is stored at the facility. Severe weather might be developing in the area. Equipment installed at the site might be subject to a safety warning. The building's occupancy might have changed, or a regulation might have been updated. Possibly, the insurer's aggregate exposure to that geography might have changed materially since the policy was originally underwritten.

Each piece of information may exist somewhere; knowing where to find it all can be difficult. But the harder question is whether the agent understands how those pieces of information relate to one another, what is relevant to the decision being made, how current they are, whether they can be trusted, and what rules govern their use. That is the difference between having information about a risk and understanding the risk in context.

Risk Does Not Stand Still

The distinction between risk information and risk-in-context matters in insurance because risk exists over time. A policy might remain in force for 12 months, but the circumstances surrounding that risk certainly don't stay static for 12 months: customers, assets, businesses, supply chains, weather, behavior, regulations, external events, and even an insurer's accumulated exposure. All of it—and more—can change, and it often does. The risk assessed when a policy is written is, therefore, not necessarily the same as the risk that exists when a claim occurs, when coverage is reviewed, or when an intervention is required.

This creates a significant challenge for agentic AI. Traditional enterprise systems contain important information about what the organization already knows: policies, customers, premiums, claims, assets, and transactions. But understanding the situation may also require information from partners, external services, application programming interfaces (APIs), and other ecosystem sources, together with real-time or transient signals that may matter intensely for a short period and then disappear.

An AI agent cannot understand the current risk simply by understanding what was true when the policy was written. Increasingly, it needs to understand what is true now.

Context Is More Than Connecting Data

This is where discussions about AI context can become misleading. Context is sometimes treated as another data integration problem: connect enough sources, retrieve enough information, and provide it to the model.

But more information does not automatically create more understanding. For an insurer, useful risk context has at least four dimensions.

1. Facts. What is known about the customer, policy, asset, claim, or event.
2. Relationships. How those facts connect and what they mean together.
3. Circumstances. What is happening now that may change their significance.
4. Rules. What the insurer, regulator, policy, or individual user's authority permits or requires to happen next.

An AI agent may need all four, which means enterprise context cannot simply be a large collection of retrieved data and needs business meaning, relationships, freshness, provenance, governance, and appropriate access controls. The agent doesn't need to know where every piece of data physically lives; it needs to understand what the data means.

From Answers to Actions

This distinction becomes much more consequential as AI moves from generating answers to initiating actions. A generative AI assistant might retrieve information, summarize a claim, or suggest an appropriate next step, but an agentic AI system could potentially progress much further.

Retrieve. Interpret. Recommend. Decide. Act.

At every stage, the consequences of incomplete understanding increase. A missing piece of information in a generated summary may inconvenience an employee. A missing piece of context behind an automated claims decision, underwriting recommendation, or customer intervention can have significantly greater consequences. This suggests an important principle for insurers considering agentic AI: The more authority an AI agent has, the deeper the context it needs.

Giving an AI agent additional autonomy without increasing its understanding creates a dangerous imbalance: The technology may become more capable of acting at precisely the point when the organization becomes less certain that it understands the basis for those actions. The challenge is, therefore, not simply to govern the model; insurers increasingly need to govern the relationship between context, authority, and action.

For a consequential decision, they may need to establish what the agent knew, what it was permitted to know, what it inferred, what information was current at the time, what it was authorized to do, what it actually did, and whether the decision can be reconstructed and explained. Governance does not disappear in an agentic world; it moves closer to the decision itself.

The Architecture Behind Understanding

This has implications for the way that insurers think about their data architecture. Most insurers operate across highly distributed information environments: Policy administration, claims, billing, customer relationship management, document repositories, data warehouses, lakehouses, and cloud platforms coexist with third-party data, partner ecosystems, external services, and—increasingly—real-time information.

Physically consolidating every piece of information that an AI agent may conceivably need is neither always practical nor necessarily desirable. What matters is the ability to provide a trusted, governed, and current representation of the information relevant to the decision, irrespective of where that information physically resides.

This is where an AI data layer, established between all applicable data sources and all AI consumers, makes a world of difference. An AI data layer can separate the business representation of information from its underlying physical implementation. Instead of requiring an AI agent to understand dozens of databases, applications, APIs, and platforms, the organization can expose governed business concepts and relationships: customer, policy, claim, property, coverage, event, and exposure.

Combined with active metadata, semantics, lineage, policy, and real-time information, an AI data layer can provide something increasingly important to AI: active business context. The objective is not simply to give an agent access to more data; it is to give the agent enough trusted context to interpret the situation appropriately.

The Real Agentic AI Race

Insurers will undoubtedly face pressure to deploy more AI agents. We will hear about how many workflows are automated, how many claims are processed, how many underwriting tasks are completed, and how many hours of human effort are saved, and those metrics matter. However, they risk obscuring the more fundamental challenge: The competitive advantage in agentic insurance may not come from having the most AI agents or even the most sophisticated models. It may come from better providing those agents with the trusted business context they need to make useful recommendations and take appropriate action, while preserving an important role for human expertise.

Insurance has never been about knowing everything; it has been about understanding enough to make a sound judgment about risk. Experienced underwriters and claims professionals do this by combining information with relationships, circumstances, rules, and experience. Agentic AI does not change that principle. Instead, it changes who—or what—needs to understand.

Before insurers ask how much authority they can give an AI agent, they should, therefore, ask a more fundamental question: Does it understand the risk well enough to exercise it?