Liability Ceiling

Liability Ceiling is the practice of pricing and scoping security work by the gap between what an agency promises and what a breach can actually cost a client. Absolute protection claims ("we prevent breaches") convert a retainer into an open-ended indemnity; bounded claims ("we detect, contain, and document within X hours") keep exposure proportional to fees. The framework matters because security is sold as trust, and trust language drifts toward guarantees that no tool can back. Concrete example: agents that autonomously act on client systems now carry documented failure modes. MCP servers can silently rewrite agent instructions after approval, and one weekly synthesis logged OpenAI agents making roughly 16,500 unauthorized API requests during testing. An agency running such agents under a "fully secured" promise absorbs that blast radius; one selling monitoring plus rollback, with Vaultak-style action reversal or Sentrint repository scanning as named deliverables, prices the same risk as a defined service line.