Who Pays When the Agent Is Wrong: Liability as Product Strategy

The agent-safety debate has a tell. Every serious paper, every conference panel, every VC memo about autonomous agents eventually asks the same engineering question: can the user safely stop watching? Better evals, tighter sandboxes, human-in-the-loop checkpoints. The assumption underneath all of it is that the problem is observability — if we can see what the agent is doing, we can catch it before it does something expensive.

That framing misses the commercial question entirely. The commercial question is not whether you can catch the agent. It is who absorbs the loss when you don't.

That is a different question, and it has a different answer. The answer is a product decision, and most teams building agent infrastructure have not made it yet.

Why buyers are shopping for someone to blame

When an agent operates in a domain where mistakes cost real money — a wrong API call that spends $800 in USDC, a negotiation that settles a dispute for $200 less than the customer would have accepted, a checkout intervention that surfaces the wrong discount and trains a customer to expect it forever — the buyer is not evaluating your accuracy numbers. They are asking a simpler question: if this goes wrong, what happens to me?

Software licenses have a standard answer to that question. It is buried in section 12 of your terms of service and it says, roughly, "nothing happens to us, good luck." That answer worked when software was a tool and the human operator was the agent. It stops working when the software is the agent and the human is asleep.

George Akerlof's 1970 paper on information asymmetry in used car markets described what happens when buyers cannot verify quality before purchase: the market collapses toward lemons because sellers of good products cannot credibly signal their quality, so buyers price everything as if it might be bad. The agent market is in exactly this phase. Every vendor claims high accuracy. Nobody can verify it before deployment. The rational buyer discounts all claims equally and either delays purchase or demands a contractual backstop.

A guarantee is not just a feature. It is the signal that breaks the information asymmetry. When you say "if the agent gets it wrong, we pay," you are doing something no benchmark score can do: you are putting your balance sheet behind your accuracy claim. That is a credibility signal buyers can act on, and it is the one signal that cannot be faked cheaply.

What underwriting an outcome actually builds

The obvious cost of absorbing losses is the losses. The less obvious payoff is what absorbing losses builds over time, and it is three things that compound together.

First, an actuarial dataset. Every claim you pay is a labeled failure case with a dollar amount attached. You know which task types fail, at what rate, under what conditions, and what the average loss looks like. After a few thousand transactions, you have underwriting data that your competitors do not have because they never took on the risk. That data lets you price the guarantee more accurately over time, which lets you extend it further, which attracts more volume, which generates more data. The flywheel is real.

Second, a capital requirement that gates entrants. Underwriting outcomes requires reserves. If you guarantee resolution on a $500 dispute and your failure rate is 8%, you need roughly $40 in expected loss coverage per transaction before you even think about catastrophic tail events. At 10,000 monthly transactions, that is $400,000 in expected annual payouts, plus a reserve buffer for variance. A new entrant cannot copy your pricing model without also copying your capital structure, and they cannot copy your capital structure without your loss history to justify it to investors. The moat is financial, not technical.

Third, structural protection from model providers. OpenAI, Anthropic, Google — none of them will underwrite outcomes in your vertical. They cannot. Their surface area is too broad, their liability exposure would be unbounded, and their business model depends on selling capability, not absorbing downstream risk. A model provider can copy your prompts and your fine-tune. They cannot copy your loss ratio. The moment you take on outcome risk, you have a position that a foundation model cannot replicate by releasing a better base model.

The four pricing structures and what they actually cost

There are four ways to structure outcome-based risk transfer, and they are not equivalent. Each one signals something different to buyers and costs something different to honor.

Pay-per-resolution is the cleanest structure. The buyer pays only when the agent succeeds. Freebot runs on this model: it fights corporate customer service on your behalf and charges only when it wins. The signal to buyers is unambiguous — the vendor has no incentive to claim a resolution that didn't happen. The cost to honor is that you are running a business with zero revenue on failures, which means your unit economics depend entirely on your success rate and your cost per attempt. At a 60% resolution rate and a $15 average fee, you need your cost per attempt (across successes and failures) to be under $9. Every failed attempt is a cost center with no revenue offset.

Outcome-based fees are a softer version. The buyer pays a base rate plus a success bonus, or a percentage of recovered value. Freway's commission-only model for recovered Shopify carts works this way. The signal is weaker than pure pay-per-resolution because the buyer still pays something on failure, but it aligns incentives more clearly than a flat subscription. The cost to honor is that your revenue is variable in a way that makes financial planning harder — you are forecasting a conversion rate, not a headcount.

Explicit guarantees are a contractual commitment to a specific outcome or a refund. "If the agent doesn't recover at least $X in disputed charges within 30 days, you pay nothing." The signal is strong. The cost to honor is that you are now an insurance product and need to think like one: what is the maximum claim per customer, what is your aggregate exposure, and what does your reserve requirement look like under a bad-month scenario?

Indemnity clauses go furthest. You agree to cover the buyer's losses if the agent causes them. This is rare in current agent products because the tail risk is genuinely hard to bound. An agent that sends the wrong email to 10,000 customers does not just cost the fee — it costs the downstream customer relationship damage, the legal exposure, the brand repair. Most agent vendors will not touch this structure, which is why the few that do have an enormous competitive signal to exploit.

Adverse selection is the failure mode

Every guarantee attracts the customers most likely to claim it. This is not a cynical observation — it is a structural feature of any insurance market. Buyers who know their situation is hard, their disputes are contested, their customers are likely to abandon carts at the last second — those buyers will disproportionately seek out outcome-based pricing. The customers with easy wins will take the flat subscription because the math is better for them.

If you do not build underwriting discipline into your intake process, the guarantee becomes a slow bleed. You attract the hardest cases, your loss ratio climbs, you raise prices to compensate, which drives away the easier cases, which makes your pool harder on average, which pushes the loss ratio higher. This is adverse selection in a textbook spiral.

The solution is not to avoid guarantees. It is to treat intake as underwriting. Before you extend a guarantee, you need to know: what is the task type, what is the expected difficulty, what is the maximum loss exposure, and what does your historical loss rate look like on similar tasks? OneShot's API instruments every tool call with enough metadata to start building this picture — which tools fired, how many retries, where the call chain terminated. That data is your underwriting signal, and you should be logging it from day one even if you are not yet pricing on it.

Agent misspend is the cleanest AI risk to insure

Most AI risk is hard to insure because the loss is hard to measure. A bad recommendation that damages a customer relationship, a generated summary that misses a key clause — these produce real harm but the harm is diffuse, delayed, and contested. Causation is hard to establish. Loss amount is hard to agree on. Insurers hate this.

Agent misspend is different. When an autonomous agent spends USDC via the x402 protocol, the loss is already denominated in money, timestamped, and attached to a specific tool call in a specific session. If the agent calls the wrong endpoint and spends $12 when it should have spent $0, that is a clean loss event: known amount, known cause, known time. It is the kind of event that actuarial tables are built for.

This makes agent commerce unusually well-suited to outcome-based pricing. The verification problem that makes most AI guarantees hard to honor is largely solved by the fact that money moved or it didn't. The OneShot tool layer records every spend event with enough context to reconstruct what the agent was trying to do and whether it succeeded. That is your claims record, and it exists whether or not you have decided to build a guarantee product on top of it.

How to start without blowing up your loss ratio

The practical path to outcome-based pricing is not to launch a blanket guarantee on day one. It is to cap exposure per transaction, instrument every failure, and let your observed loss ratio tell you how far to extend the guarantee over time.

Here is a concrete starting structure. Cap your per-transaction guarantee at $50. Log every session with task type, tool calls fired, time-to-resolution, and outcome. After 500 sessions, compute your loss ratio by task type. You will almost certainly find that some task types have a loss ratio under 5% and others are over 20%. Extend the guarantee aggressively on the low-loss types. Raise prices or require manual review on the high-loss types. Reinvest the margin from the low-loss types into improving the high-loss types until their ratio comes down.

This is not a novel idea — it is how every insurance product in history has been built. The novelty is that agent sessions generate the underwriting data automatically, at a granularity that traditional insurers would find extraordinary. A property insurer gets a claims event once every several years per customer. An agent platform gets a session-level outcome signal multiple times per day per customer. The data velocity is orders of magnitude higher, which means the loss ratio converges to a reliable estimate much faster.

// Minimal session instrumentation for underwriting
const session = await oneshot.sessions.create({
  task_type: "dispute_resolution",
  max_spend_usd: 50,          // hard cap for guarantee exposure
  metadata: {
    dispute_amount: 340,
    channel: "voice",
    customer_tier: "standard"
  }
});

// After session completes, log outcome
await oneshot.sessions.record_outcome({
  session_id: session.id,
  resolved: true,
  resolution_value: 340,
  agent_spend_usd: 8.40,
  tool_calls: session.tool_call_log,
  failure_point: null          // or "voice_timeout" / "escalation_required" / etc.
});

// This record is your underwriting data.
// Aggregate by task_type, failure_point, customer_tier
// to compute loss ratios before extending guarantees.

The OneShot SDK gives you the tool call log and spend data out of the box. The outcome recording and aggregation is yours to build, but it is not complicated — it is a database table and a weekly query. The teams that build this instrumentation now will have 18 months of loss history by the time the agent market matures enough for outcome-based pricing to become the default expectation. That history is the underwriting moat, and it cannot be acquired any other way.

The prediction

By Q2 2027, outcome-based pricing with explicit loss caps will be the table-stakes requirement for enterprise agent contracts in any domain where the agent touches money directly. Vendors still offering flat subscriptions with standard liability disclaimers will be confined to internal tooling and low-stakes automation. The split will not happen because buyers suddenly became sophisticated — it will happen because one or two well-publicized agent misspend events will make the liability question impossible to avoid in procurement conversations.

The vendors who will win that procurement conversation are not the ones with the best accuracy benchmarks. They are the ones who have been absorbing losses, logging failures, and building a loss ratio for long enough to price a guarantee that doesn't kill their margin. That work starts now, at low exposure, with capped transactions and careful instrumentation. The teams treating liability as a legal problem to minimize are building toward the wrong outcome. The teams treating it as a product strategy are building the moat.