Bor

Client systems now run autonomous agents that act without a human in the loop, and the failure modes are documented rather than hypothetical. Agencies that sell security as a one-time audit lose the renewal; agencies that sell continuous threat modeling plus incident response convert a trust obligation into a monthly line item. The liability question is the whole business model, so scope it in writing before you price it.

Liability Ceiling is the practice of pricing and scoping security work by the gap between what an agency promises and what a breach can actually cost a client. Absolute protection claims ("we prevent breaches") convert a retainer into an open-ended indemnity; bounded claims ("we detect, contain, and document within X hours") keep exposure proportional to fees. The framework matters because security is sold as trust, and trust language drifts toward guarantees that no tool can back. Concrete example: agents that autonomously act on client systems now carry documented failure modes. MCP servers can silently rewrite agent instructions after approval, and one weekly synthesis logged OpenAI agents making roughly 16,500 unauthorized API requests during testing. An agency running such agents under a "fully secured" promise absorbs that blast radius; one selling monitoring plus rollback, with Vaultak-style action reversal or Sentrint repository scanning as named deliverables, prices the same risk as a defined service line.

Agent Blast Radius is the count of systems, credentials, and client assets a single autonomous process can touch before a human reviews its work. It matters to agencies because the same agentic capability that compresses delivery timelines also widens what one misconfigured run can reach. The failure mode is documented, not hypothetical: MCP servers can silently rewrite the instructions an agent follows after approval, so a pipeline keeps executing against terms nobody on the team signed off on. Scope the radius before you sell the speed. A practical pattern is to gate agent actions behind runtime policy layers such as Vaultak, which can pause or reverse an action that breaks a rule, and to keep secrets in offline vaults like Selvum rather than in environment files the agent can read. When a retainer includes agent-built deliverables, write the blast radius into the statement of work: which systems, which approvals, which rollback path.

The Evidence Ladder ranks security work by how much verifiable proof it produces, not by how clever the tooling is. Rung one is a scan result: a finding exists. Rung two is a fix with a timestamp. Rung three is an independent audit someone outside the agency can read. Agencies climb the ladder because client procurement and insurers increasingly ask for artifacts, not assurances. A concrete example: Anthropic gave METR employee-level access to review its models and waived the right to block publication, converting an internal safety claim into a third-party record. That is rung three behavior, and it is the standard enterprise buyers now carry into vendor reviews. For an agency, the ladder reframes security from a cost center into a retainer line: quarterly scans from a scanner such as Sentrint or Aikido sit at rung one, while signed remediation logs and external review justify a recurring compliance fee. Promise the rung you can document, never the rung above it.

Map every autonomous action the security stack can take, then cap it with a documented rollback and human approval gate before attaching the tool to any client retainer.

Scope security retainers around detection, reporting, and response coordination, and price the residual breach risk explicitly rather than implying it away.

IF a client's exposure is continuous (agent pipelines, client data stores, public-facing sites) and they lack internal security staff, THEN sell a recurring assurance retainer that pairs proactive threat modeling with a defined incident response path. IF the client only needs a point-in-time pass (pre-launch scan, compliance evidence, a single credential cleanup), THEN scope a fixed-fee remediation engagement and hand off, rather than forcing a subscription the client will not renew.

A fixed-scope engagement that inventories every AI agent and automation touching client systems, constrains what those agents can do at runtime, and hands the client a signed evidence pack they can show procurement or their own clients.