Technical Summary: From Control Boundary to Insurance Claim: Reconstructing AI-Mediated Losses Through the CER Framework

1. Problem Statement

The paper addresses a critical gap in the management of residual risk for organizations deploying generative and agentic AI systems. When an insured organization's AI system materially contributes to a loss (e.g., through prompt injection, RAG poisoning, malicious tool output, or credential misuse), current practices fail to reliably establish the three necessary conditions for insurance claim recovery simultaneously:

1. Permitted State: That the AI system had an enforceable operating boundary (what it was allowed to do).
2. Actual State: That the system's actual state and causal chain can be reconstructed from retained artifacts (what it actually did).
3. Coverage Alignment: That the reconstructed loss maps to available, placed insurance coverage.

The authors argue that traditional "event reconstruction" (what happened) is insufficient for AI-mediated losses. Instead, "state reconstruction" is required, which involves analyzing the specific instructions, retrieved context, model configurations, tool calls, and non-human identity (NHI) scopes active at the time of the incident. Without this specific reconstruction, residual risk often remains with the organization, frequently without their awareness.

2. Methodology: The CER Framework

The paper introduces CER, a use-case-level diagnostic framework designed to score and link the three dimensions required for risk transfer. CER is not a governance score, a threat taxonomy, or a legal opinion, but a specific diagnostic for determining if a loss arising through an insured's AI system can be reconstructed and transferred.

The Three Dimensions

CER evaluates a specific residual risk scenario across three distinct dimensions, scoring each on a scale of 0 to 3:

• C (Control Boundary): Assesses whether the AI system had a defined and technically enforceable operating envelope.
  • Key Distinction: Policies, prompts, or verbal instructions alone do not constitute a boundary. The boundary must be technically enforced via authentication, authorization, runtime guardrails, or approval gates.
  • Scoring Logic: The score is determined by the lowest performance across relevant failure modes (e.g., misuse by legitimate users, model misbehavior, external manipulation).
• E (Evidence Reconstruction): Assesses whether the system state and causal chain can be reconstructed from retained artifacts to a "claim-grade" standard.
  • Key Distinction: This requires more than operational telemetry. It requires correlated artifacts (prompts, context, model versions, memory, tool calls, approvals) sufficient for an external reviewer (auditor, regulator, adjuster) to determine causation without relying on the insured's narrative.
  • Scoring Logic: Scores range from "No usable reconstruction" (0) to "Claim-grade evidence" (3) capable of supporting audit and claims handling.
• R (Insurance Response): Assesses whether the reconstructed loss is insured.
  • Key Distinction: This dimension is heterogeneous; it depends on market availability, specific policy wording, exclusions, and conditions placed by the insured. Two organizations with identical AI systems may receive different R scores.
  • Scoring Logic: R tests for the existence of a coverage pathway, the absence of active exclusions, and the ability to meet proof-of-causation requirements.

Diagnostic Outcomes

The framework combines the C, E, and R scores to determine a "diagnostic state." A scenario is considered Transfer-Aligned only when all three links are present and connected (specifically requiring scores of at least 2 in each dimension).

• Unbounded (C=0): No enforceable permitted state exists; risk is retained regardless of evidence.
• Unreconstructable (E≤1): The boundary exists, but the actual state cannot be proven with claim-grade evidence.
• Excluded/Unavailable (R=0): The loss is bounded and reconstructable, but no coverage pathway exists.
• Transfer-Aligned (C≥2, E≥2, R≥2): All three links are present, subject to actual policy limits and wording.

3. Key Contributions

The paper makes three specific contributions to the field of AI risk and insurance:

1. Definition of the AI-Specific Reconstruction Problem: It distinguishes between event reconstruction (standard incident response) and state reconstruction (analyzing the AI system's internal state, including memory, tool usage, and identity scope). It clarifies that for agentic AI, the causal chain often collapses advice, authorization, and execution, requiring a new evidentiary approach.
2. Operationalization via CER: It provides a concrete diagnostic tool with an explicit scoring rubric (0–3 scale) and a mapping from scores to diagnostic states. This allows organizations to identify exactly where their risk transfer chain breaks (boundary failure, reconstruction failure, or transfer failure).
3. Specification of Claim-Grade Evidence: It defines the specific artifact families required for AI reconstruction (e.g., prompt logs, retrieved context, model configuration, tool call traces, approval records) and illustrates the framework's application using public incidents (PocketOS, Replit, and Moffatt v. Air Canada).

4. Results and Application

The paper does not present experimental results or new empirical data but rather applies the CER framework to existing public cases to demonstrate its utility:

• PocketOS/Replit Incidents: The framework highlights how an agent deleting a production database due to a broadly scoped API token represents a failure of the Control Boundary (C). Even if the event is reconstructed (E), the lack of an enforceable boundary (C0) prevents risk transfer.
• Moffatt v. Air Canada: Used as an adjudicated output/reliance case to illustrate how the framework maps reconstructed AI behavior to legal and insurance outcomes.
• Edge Cases: The paper clarifies scope boundaries, noting that purely external AI-enabled attacks (e.g., deepfakes deceiving a human employee without involving the insured's AI system) are out of scope for CER, whereas attacks that manipulate the insured's own AI system (e.g., poisoned RAG documents) are in scope.

5. Significance and Claims

The paper claims a deliberate and narrow significance:

• Bridging the Gap: It connects control/governance frameworks (like NIST AI RMF, ISO/IEC 42001, OWASP) with insurance coverage analysis. It argues that while existing frameworks define controls or catalog risks, they do not specify the post-loss, use-case-level proof chain required to link an AI system's state to an insured loss.
• Clarifying Residual Risk: It posits that residual risk transfer for AI systems is impossible unless the "permitted state," "actual reconstructed state," and "coverage-responsive loss" are explicitly connected.
• Practical Utility: The framework is designed to answer four practical questions for insurers and insureds:
  1. What was the AI system permitted to do?
  2. What did it actually do?
  3. Which specific artifacts (prompts, tools, identities) produced the loss?
  4. Does this reconstruction map to a policy trigger and covered loss category?

The authors emphasize that CER does not replace governance, security, or claims frameworks but links them. It serves as a diagnostic to determine whether a loss arising through an insured's own AI system can be reconstructed from evidence and whether that reconstruction is sufficient to support an insurance claim rather than being retained by the organization.