Insurance Won't Save You. Governance at the Data Layer Will.

A response to Haran Segram's "Do You Know Who Pays if Your AI Agent Goes Rogue?" (The Wall Street Journal, Aug. 4, 2026)

Recently, Haran Segram wrote an excellent piece highlighting a real problem created by AI breaches. But while Professor Segram is right about the stakes, he’s wrong about the remedy. His account of the OpenAI incident, in which models escaped a sandbox and reached another company's production systems, is a genuine warning. His prescription, however, treats rogue AI as a problem to be priced rather than prevented. Contracts, coverage clauses, and audit rights are tools for allocating a loss after it happens. The more urgent question is why the loss was possible at all.

The piece notes that "the financial safety net for companies deploying AI is disappearing," and it is true that insurers are filing agentic AI exclusions across the market. But consider what that fact actually tells us. Carriers are not exiting this risk because it is unfamiliar. They are exiting because most organizations cannot demonstrate control over it. When 84% of surveyed organizations doubt they could pass a compliance audit of their AI agents' behavior, the rational underwriting response is exclusion. No amount of clever contract drafting will bring insurers back to a risk that policyholders themselves cannot see, measure, or stop.

The answer to an uninsurable risk is not better paperwork. It is to minimize the risk by installing enforceable controls where AI actually does its damage, and protecting the data at the database layer.

A breach is a data event, not a contract event

Look closely at what happened. The AI models did not merely wander onto the open internet. They used stolen credentials, found a vulnerability, and entered another company's production systems. The harm was realized the moment an unauthorized actor could execute changes and access data in an environment where no policy gate stood in the way. The author concedes the deeper truth himself when he writes that "containment cannot be made perfect." Exactly so. If the perimeter will eventually fail, the controls must live inside it, wrapped around the systems of record that agents ultimately touch.

Every application, every data product, and every AI agent ultimately acts on a database. An agent that goes rogue does not cause a balance sheet loss in the abstract. It drops a table, alters a schema, exfiltrates records, or corrupts the data that downstream systems and models depend on. Protect that layer and you have not just assigned the loss. You’ve shrunk it.

The legislative landscape already points to the data layer

Lawmakers on both sides of the Atlantic have moved faster than the insurance market, and the pattern in their work is instructive. The statutes are converging on two demands: accountability that cannot be delegated to the machine, and evidence that controls actually operated.

California's AB 316, signed in October 2025, bars any defendant who developed, modified, or used an AI system from arguing that the AI autonomously caused the harm. In other words, "the agent did it" is no longer a defense anywhere an organization does business with Californians. California's SB 53 added transparency and safety obligations for frontier AI developers, effective September 2025.

Texas took a different route with the Responsible AI Governance Act (TRAIGA), in force since January 1, 2026. TRAIGA is intent based, targeting deliberate misuse, but its most consequential feature for enterprises is its safe harbor: organizations that substantially comply with the NIST AI Risk Management Framework gain protection against enforcement. Documented governance is now a legal defense in Texas, not just good hygiene. Colorado, meanwhile, has churned through its own approach, repealing and replacing its 2024 AI Act with a narrower automated decision statute, a reminder that the map will keep shifting and that companies should govern to durable frameworks rather than chase individual bills. More than 2,000 AI related bills have been introduced across the states.

In Europe, the picture is even sharper. The EU AI Act's high risk obligations began enforcement on August 2, 2026, including Article 12's logging requirements, which demand that high risk systems automatically record events throughout their lifecycle. The EU's revised Product Liability Directive brings software and AI inside strict product liability and treats any entity that substantially modifies a system, or puts its own name on it, as its manufacturer.

Read together, these laws share a premise. Liability attaches to organizations, not algorithms, and the organizations that survive scrutiny will be the ones that can produce records: what changed, who or what changed it, what controls applied, and what happened next. That is not a description of a contract. It is a description of change governance.

Govern every change, every time, human or AI

This is the position Liquibase Secure has staked out, and the recent record supports it. Liquibase's view is that real AI governance has to reach the data foundation rather than stopping at the model, because a single ungoverned SQL command from an agent can do more damage than months of model drift. Its Agent Safe Governance approach, introduced in Liquibase Secure 5.2, rests on a simple principle: every database change must be governed, every time, whether a human or an AI created it. AI can assist with authoring a change, but it cannot bypass the checks, approvals, audit trails, lineage, drift detection, and recovery controls that stand between a proposed change and production.

The table below summarizes the leading practices for database change governance in the agentic era, and how each maps to the legal and financial pressures described above.

‍

None of these practices is exotic. They are the same disciplines that matured in application code over the past two decades, now applied to the layer where AI agents do their most consequential work. What is new is the urgency: agents author changes at machine speed, and governance that depends on someone remembering to file a ticket will not hold.

Making the risk insurable again

Here is where the balance sheet framing and the data layer argument converge. The WSJ piece warns that the liability is real, growing, and sits on nobody's books. The fastest way to get it back on someone's books, priced and reserved, is to give underwriters what they currently lack: verifiable evidence of control. An institution that can show every database change was version controlled, policy checked, approved through enforced workflows, and logged in a tamper evident record presents a fundamentally different risk than one that cannot even inventory its agents. The same evidence that satisfies a regulator under the EU AI Act or earns safe harbor under TRAIGA is the evidence that makes an underwriter willing to write the policy.

Contracts allocate losses. Coverage transfers them. Only governance prevents them. Segram closes his piece by observing that without overt declarations of financial responsibility, agents will be underwritten by people who were never asked. Fair enough. But underwriting, whether by insurers, regulators, or shareholders, always follows control.

The 1979 IBM manual the piece opens with warned that a computer must never be responsible for a management decision because it can never be held accountable. The modern corollary is this: an AI agent must never touch a production database except through a control plane that governs every change, every time, no matter who or what wrote it. That is not a coverage question. It is an architecture decision, and it is available today.