Custom agents shift brokers from users to AI architects

At a glance

What this is: Cowbell argues that custom agents can turn underwriting and broking knowledge into configurable AI assistants, while keeping proposals tracked and subject to human approval.

Why it matters: This matters because identity and access governance for AI is shifting from simple user access to control over what an agent may recommend, draft, or execute on behalf of a practitioner.

Context

Custom agents are AI assistants trained or configured with a specific firm’s playbooks, documents and workflows so their outputs reflect local expertise rather than generic logic. In insurance, that raises a governance question for human identity and agentic AI together: who can shape the agent, what knowledge sources it can use, and which actions still require approval.

The article’s core claim is not about replacing brokers, but about preserving differentiating knowledge as AI becomes more common. That puts attention on access control, accountability, and review boundaries for AI-assisted decisioning, especially where the same logic may influence underwriting, renewal communications and pricing suggestions.

Key questions

Q: How should teams govern custom AI agents used in underwriting workflows?

A: Treat each agent as governed business logic, not a loose productivity aid. Limit its knowledge sources, define exactly which outputs are advisory, and require explicit approval before it can affect pricing, coverage wording or external communication. Ownership, review and change control should sit with the business team that depends on the agent, not just with the platform administrator.

Q: Why is human approval still necessary when an agent can draft decisions quickly?

A: Speed does not equal authority. A fast agent can still produce incorrect or overconfident recommendations, and the risk is amplified when its output influences client terms or pricing. Human approval keeps the decision accountable, creates a review point for exceptions and prevents the assistant from becoming an unreviewed proxy for expertise.

Q: What do organisations get wrong about custom agent accountability?

A: They often focus on logging outputs while ignoring who defined the agent’s instructions and source material. That misses the real control point. Accountability starts with configuration ownership, source approval and change tracking, because those are the elements that shape what the agent is allowed to infer and recommend.

Q: Should broker teams prefer generic AI or custom agents for specialist work?

A: Specialist work usually benefits from customisation because it preserves firm-specific judgment and language. The trade-off is governance complexity: the more tailored the agent becomes, the more carefully teams need to control its inputs, approval rules and output boundaries. The right choice is the one that matches the firm’s tolerance for delegated judgment, not the one with the broadest default capability.

Technical breakdown

How custom agents turn guidance into decision logic

A custom agent is not just a chatbot with uploaded documents. It uses curated knowledge sources, instructions and workflow context to shape how it classifies risk, drafts content or proposes next steps. That creates a narrow but important governance layer between the human expert and the model output. The technical risk is that the agent begins to behave like a policy interpreter, not a passive retrieval layer, so the quality of the source material and the permission to act become part of the control surface.

Practical implication: Define which knowledge sources an agent may use and separate draft generation from any decision authority.

Human-in-the-loop controls for agentic decision support

Human-in-the-loop means the system can propose actions, but a person must approve them before they are executed. In this context, that is more than a convenience setting. It is the mechanism that prevents an AI assistant from becoming a hidden decision-maker for underwriting, messaging or pricing. If tracking exists but approval is optional, accountability weakens. If approval is mandatory only for some actions, teams need clear thresholds for what the agent may do versus what it may merely suggest.

Practical implication: Set explicit approval gates for any action that affects client advice, coverage terms or pricing.

Accountability shifts from usage to configuration

When practitioners can design their own AI assistants, the governance problem moves upstream. The critical question is no longer only who used the tool, but who defined its instructions, what content it was allowed to learn from, and how its outputs are audited. That makes configuration itself a control point. In regulated or high-stakes workflows, the agent’s provenance and the human owner of its rule set matter as much as the final recommendation.

Practical implication: Assign named owners to each agent configuration and review them as controlled business logic, not informal prompts.

NHI Mgmt Group analysis

Custom agents create a new governance layer around embedded expertise. The article’s real contribution is the idea that AI can operationalise a firm’s specialist judgment, but only if the source material and action boundaries are controlled. For identity and governance teams, that means the agent configuration becomes a governed object, not a casual productivity feature. Practitioners should treat agent instruction sets like policy.

Human approval remains the line between assistance and delegated authority. The article correctly treats approval as non-negotiable unless explicitly waived. That matters because AI systems can generate plausible outputs faster than humans can review them, which tempts organisations to relax oversight. The safer model is to make the agent advisory by default and require deliberate authorisation for any client-facing or pricing-related action.

Agent accountability depends on provenance, not just audit logs. Tracking what an agent proposed is useful, but it does not answer who curated the knowledge sources or which business rule caused the output. That is where governance maturity is decided. In practice, organisations need named owners for agent configuration, source curation and approval policy, or the human-in-the-loop promise becomes ceremonial rather than operational.

Customisation is becoming the differentiator, but it also concentrates risk. If every firm can build its own assistant, the quality of the control plane becomes the real market distinction. The firms that will govern this well are the ones that can prove what the agent knows, what it can do and where its authority ends. The practitioner task is to make that boundary explicit before the assistant is trusted in production.

What this signals

Customisation is becoming the control problem, not just the feature request. When firms teach an agent their own underwriting logic, they also inherit responsibility for governing that logic as a living asset. The security and governance question is no longer whether AI can help, but whether the organisation can prove what the agent was allowed to learn and do.

Agent approval boundaries should be designed as part of the operating model. A broker assistant that drafts a message is one risk profile, while an assistant that can shape pricing or coverage language is another. The sharper the boundary between suggestion and execution, the easier it is to preserve accountability without blocking useful automation.

For practitioners

• Define agent permission boundaries Separate read, draft and execute capabilities so a custom agent can propose underwriting or client-facing outputs without being able to complete decisions on its own.
• Approve knowledge sources as controlled inputs Review underwriting guidelines, policy wordings and sales scripts before they become agent knowledge sources, and assign an owner for each source set.
• Require human approval for material actions Make human sign-off mandatory for pricing adjustments, coverage language changes and any external communication the agent drafts.
• Audit agent configurations as business logic Record who configured each agent, which instructions it received and when those instructions changed, then review them on a set governance cycle.

Key takeaways

• Custom agents move AI governance from generic usage controls to the supervision of firm-specific logic, knowledge sources and approval paths.
• Human approval is the control that keeps an agent advisory rather than delegated, especially in underwriting and client-facing workflows.
• The governance burden increases as customisation increases, because the organisation must prove what the agent knows, who owns it and what it may do.

Key terms

• Custom Agent: A custom agent is a security automation built from an organization’s own instructions, data, and triggers. It is used when a standard workflow does not fit local processes, control expectations, or audit needs, and it can be adapted from a template or created from scratch.
• Human-in-the-Loop (HITL): A governance pattern requiring human approval before an AI agent takes high-impact, irreversible, or out-of-scope actions. HITL is a critical control for agentic AI identity governance.
• Agent Configuration: The settings and instructions that define how an autonomous agent behaves, what tools it can use, and what commands it may run. In security terms, configuration often determines effective authority, so it must be reviewed and controlled like code rather than treated as simple metadata.
• Decision boundary: The point in a workflow where a machine may inform a decision but may not make it final. In security operations, this boundary is critical because it preserves accountability, auditability, and human challenge rights when AI output is uncertain or incomplete.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the course if your programme needs to govern machine identities, agent permissions and human approval boundaries with more discipline.