Chapter 4: Prior Assurance Regimes

Three formations

A single control compresses an incident class; an entire assurance regime compresses a disaster class. The book calls the result the control layer: the standards, inspection, insurance, and audit layer that forms around a new capability after its incidents.

No control layer yet exists for work performed by AI agents. To read what one will look like, this chapter uses prior regimes for two different things. The first is how a control layer forms, and for that the clearest records belong to three formations in full public view, around steam pressure, rail transport, and electric current, dated, citable, and in close agreement about the process. They yield four regularities that have held across three technologies and roughly a century and a half. But steam, rail, and electricity share a feature agent work does not: their central hazard was, in the end, largely engineered out. A boiler built to the code does not explode. Chapter 1 established that part of the risk in agent work cannot be engineered out: an action that reaches the world cannot be recalled, and the model's own builders say the exposure to hostile instructions cannot be fully closed. So this chapter reads a second set of regimes for a second thing: what a control layer becomes when the hazard is permanent. Financial audit, aviation safety, clinical medicine, and cybersecurity have each managed a risk that never closes, and they show the shape agent assurance is forming toward.

Steam

The steam boiler was the first hazard in America that could kill on a massive scale.¹ Before 1852, boiler explosions accounted for half of the roughly 7,000 steamboat deaths in the United States, and two-thirds of total casualties.¹ In 1838, the worst year for steamboat explosions relative to the tonnage in service, 342 people died in twelve explosions.² Through the 1850s, boiler explosions in the United States occurred at an estimated rate of once every four days.³ The technology at the center of industrial life carried a standing risk of detonation, and the risk was realized on a schedule.

The worst of them came at the end of the Civil War. At three in the morning on April 27, 1865, about seven miles north of Memphis, three of the four boilers powering the steamboat Sultana exploded. More than 1,500 people died, and the event remains the worst maritime disaster in United States history. The cause of the explosion was never determined.⁴ There was no institution whose job it was to produce one.

Government moved first. Congress enacted legislation in 1838 and again in 1852 in response to public outcry over the explosions, and the two acts together established the first federal agency responsible for the regulation of a private industry.⁵

Measured per mile traveled, boiler explosions and deaths on western river steamboats declined throughout the period from 1825 to 1860, which means safety was already improving before the 1852 act took effect.⁶ The control layer did not arrive to a field standing still; practice improves while the layer forms. What the layer adds is the institutionalization, the part that no longer depends on any one person choosing to be careful.

The commercial half of the formation began as a discussion group. In 1857, several Hartford entrepreneurs formed the Polytechnic Club as a means to discuss practical changes to boilers.⁷ Nine years later, in 1866, that circle produced the Hartford Steam Boiler Inspection and Insurance Company, founded on the premise that quality boiler inspections would enhance industrial safety, with insurance providing the financial incentive.⁸ The fusion is in the corporate name: inspection and insurance, one company, the standard of inspection set by the party that pays when the inspection is wrong.

The standard itself came last, and it came from practitioners. The American Society of Mechanical Engineers was established on February 16, 1880, its first meeting chaired by the steel engineer Alexander Lyman Holley; in that same year, 159 boiler explosions occurred in the United States.⁹ The proximate trigger for a code arrived a quarter century later. Boiler explosions at two Massachusetts shoe factories, at Brockton in 1905 and Lynn in 1906, prompted the state governor to use his inaugural address to demand prompt action for improved public safety.¹⁰ In 1911 the society's president, Colonel Edward D. Meier, himself the president of a boiler company, proposed that the society write a boiler code.¹¹ The society's council minutes of September 15, 1911 record the appointment of a committee "to formulate standard specification for the construction of steam boilers and other pressure vessels" and name its seven members: John A. Stevens, chairman, E. F. Miller, C. L. Huston, H. C. Meinholz, Richard Hammond, R. C. Carpenter, and W. H. Boehm.¹² Stevens was a consulting engineer and a past member of the Massachusetts Board of Boiler Rules.¹³ The first edition of the Boiler and Pressure Vessel Code was issued in 1914 and published in 1915, the first comprehensive standard for the design, construction, inspection, and testing of boilers and pressure vessels.¹⁴

The dates in a row: thousands of deaths before 1852; federal statute in 1838 and 1852; the inspection-insurance fusion in 1866; the practitioner society in 1880; the code in 1914. A century of documented disaster preceded the document, and every stage of the response was written in the language of specific incidents: the acts answered the explosion rate, the Hartford answered the inspection gap, the code committee answered two named shoe factories.

Rail

Rail ran the same sequence and contributed a different part of the modern control vocabulary: management structure and accident investigation.

In 1841, a collision of two trains on the Western Railroad in Massachusetts killed a conductor and a passenger and injured seventeen others. The railroad's response was not a mechanical fix but an organizational document, the Report on Avoiding Collisions and Governing Employees, which called for a system of clearly defined responsibilities and lines of communication.¹⁵ The elements a reader now meets in every organization chart and every audit interview, who is responsible for what, who reports to whom, were set down as collision avoidance. Management practice of this kind is a control, and like the controls of chapter 3 it has an incident in its ancestry, in this case one with a date, a railroad, and two deaths.

The state's contribution on rail was the inspectorate, and Britain built it first. In 1840, through the Railway Regulation Act, the Board of Trade appointed the first Railway Inspector to inspect the construction and equipment of new railways.¹⁶ The Regulation of Railways Act 1871 is generally regarded as the founding legislation of the modern railway inspectorate, and it provided formal powers to investigate accidents.¹⁷ The 1871 act institutionalized the thing the Sultana never got: a standing body whose job is to determine cause. Accident investigation as a profession, the discipline that today takes apart air crashes and publishes what it finds, descends from this stratum.

The newly formed Interstate Commerce Commission published its first railroad accident statistics in 1889 and 1890, and the numbers demonstrated the extraordinary risks to trainmen from coupling cars and riding freight cars.¹⁸ In 1893, Congress responded with the Safety Appliance Act, mandating automatic couplers and air brakes on railroad freight cars.¹⁹ The regulation did not create the knowledge; the statistics did. Counting the casualties made the failure class undeniable, and the mandate followed the count.

Rail also produced its own commercial fusions. The industry's Bureau of Explosives, formed in 1908, wrote inspection rules that became the basis of all modern regulation of hazardous shipments.²⁰ The pressure was not always governmental. In Britain, railway worker deaths and injuries rose from over 16,000 in 1900 to over 30,000 in 1913. The Great Western Railway launched its Safety Movement in August 1913 under pressure from trade unions and the threat of new safety legislation.²¹ A casualty curve, organized labor, and the prospect of statute: the company built the program before the state compelled it.

Rail built one more control layer. The boom of the 1840s produced enterprises larger and faster-moving than any owner could see whole, and their stated position drifted from their actual one. Parliament's answer was the one chapter 3 would recognize, a mandated periodic reconciliation of the stated position against the actual one. The Joint Stock Companies Act 1844 followed a select committee's inquiry into fraud and mismanagement in such companies. It required a company's directors to have a full and fair balance sheet drawn up, and its shareholders to appoint auditors to examine it. That was the first statutory audit.²² The failure class it answered was the broad one chapter 3 named in the segregation of duties: the figure that no independent party is positioned to check, whether it is wrong by design or by honest error. The era's most notorious case of the deliberate kind came a few years later, when George Hudson, the "Railway King," was found to have paid shareholder dividends out of capital while the traffic accounts were doctored to make the payments look earned. Shareholder inquiries dug into the books in 1849 and exposed it.²³ A profession formed around the requirement: the Society of Accountants in Edinburgh took a royal charter in 1854, the world's first professional body of accountants, and the Institute of Chartered Accountants in England and Wales followed in 1880.²⁴ Unlike the collision or the boiler burst, the failure this layer answered never closes. An account can always be made to say what did not happen, so the audit is never finished, only repeated, and the century that engineered the collision out of rail travel also built the profession that manages a hazard it cannot end. That profession is the nearest ancestor of the one this book is about.

Electricity

Electricity compressed the sequence, because by the 1890s the insurance industry had learned the Hartford pattern and applied it at the start of the technology's life instead of decades in.

The occasion was an exhibition. The 1893 World's Columbian Exposition in Chicago was wired with novel and unproven electrical installations that posed serious risks of shock and fire, and a young electrical investigator named William Henry Merrill Jr. carried out the safety inspection work.²⁵ What Merrill did next is the founding of the modern testing laboratory. With support from two regional fire insurance underwriters' organizations, two employees, and 350 dollars of equipment, he started a small independent testing laboratory, and on March 24, 1894 he conducted the first test of his Underwriters' Electrical Bureau.²⁵ The backers were the Chicago Fire Underwriters' Association and the Western Insurance Union: insurance-industry sponsorship, not a government mandate.²⁶ The laboratory incorporated as Underwriters' Laboratories in 1901.²⁷

The underwriters of fire insurance paid for a laboratory because electrical fires were their losses, and a mark certifying that a product had been tested was worth more to them than the cost of the testing. Electricity got its control layer faster than steam did, and the acceleration came from the commercial side: the insurers did not wait for a disaster on the Sultana's scale.

Four regularities

Three technologies, three formations, one pattern. Stated as regularities, with the receipts above:

*The control layer lags the capability it governs, and is written in the language of incidents, not principles.* Steamboats were killing thousands for decades before the 1852 act. The boiler code arrived in 1914, a century after the capability and half a century after the worst single disaster.⁵¹⁴ Rail's couplers were mandated in 1893, after the ICC's 1889 statistics made the toll countable.¹⁹ The lag is not a nineteenth-century artifact: a 2024 study in Policy and Society reports that the lag between the introduction of new technology and federal regulation in the United States averages decades.²⁸ Nor is the lag a period of stasis; as the steamboat record shows, practice improves while the layer forms, and what lags is the institutionalization, not the improvement.⁶ When the layer does arrive, its documents point at events, not at abstractions. The code committee of 1911 was convened over two exploded shoe factories; the Safety Appliance Act was written from a casualty table.¹⁰¹⁸ A control layer is the disaster class, codified, which is chapter 3's mechanism operating at industry scale.

*The control layer is built by practitioner-adjacent commercial actors who fuse technical knowledge with financial accountability, not by regulators acting alone.* The state appears in all three histories, and its contributions are real: the first federal regulatory agency, the inspectorates, the mandates.⁵¹⁶ But the durable standards, the documents practitioners actually built to, came from bodies that combined knowing with paying. The Hartford put the inspector's judgment inside the insurer's balance sheet.⁸ Merrill's laboratory was an insurance instrument from its first day.²⁵ The Bureau of Explosives was an industry body whose rules became the basis of a whole regulatory field.²⁰ The boiler code was written by an engineering society, proposed by a society president who ran a boiler company, and chaired by a man who had served on the state board that regulated boilers.¹¹¹³ The Great Western Railway's 1913 safety program, built by the employer under union pressure and the threat of statute, shows the same economics from another seat.²¹ The oldest instance predates steam and states the mechanism most plainly. Lloyd's Register began in 1760 as a society that classed merchant ships so underwriters and merchants could judge the vessels they insured and chartered, grading the best "A1."²⁹ Owners bought the survey not for its own sake but because the market would not deal without it: a ship built outside the rules was rated "experimental," a status that alarmed insurers and raised what they charged.³⁰ The recurring figure is not the legislator; it is the practitioner with an economic stake in being right, and standing behind that figure is a counterparty who will not transact without the assurance.

*Durable work forms around the standard; whether it hardens into a chartered profession is contingent, not guaranteed.* In steam, rail, and electricity durable institutions formed and held. The founding of the Hartford Steam Boiler Inspection and Insurance Company is cited here from the Congressional Record of 2016, where the company's history was read out one hundred and fifty years after its charter. The account of the 1911 code committee is taken from the institutional history ASME still maintains. The account of Merrill's 350 dollars is from the history page UL still publishes about itself.⁸¹⁴²⁵ Institutions that formed around nineteenth-century disaster classes are alive, solvent, and narrating their own foundings on their own websites. A review of the engineering-studies literature finds that post-disaster studies and hearings shaped not just the codes but the occupations that maintain them.³¹ But chartering of that kind is not automatic, and the condition that produces it is specific. Audit and medicine consolidated into licensed professions because a legal mandate made their assurance a required purchase, attached to a concentrated and attributable harm. An unlicensed physician commits a crime; a public company must buy an auditor's signature, the statutory mandate the rail section recorded. Where the harm is diffuse and the field moves too fast to fix, the work is durable but the charter does not come. Cybersecurity built a workforce in the millions without one. The next section reads it, alongside audit, aviation, and medicine, as the second set of precedents this field needs. Which ending a new field reaches turns on those conditions, not on the mere fact that its risk is irreducible.

*Founding names are selected by publication, not by merit.* The seven members of the 1911 boiler code committee are recoverable today, by name, because a council secretary minuted them on September 15, 1911.¹² Nothing in the record establishes that Stevens, Miller, Huston, Meinholz, Hammond, Carpenter, and Boehm were the seven most capable boiler engineers of their era, and the question is not answerable now. What the record establishes is that they were the seven who were appointed to write the document, and that the document survived, carrying their names with it. The same selection ran at the founding of the national measurement infrastructure. The law establishing the National Bureau of Standards passed in March 1901, and Samuel Wesley Stratton was its driving force and first director; in later years, two senior officials each separately claimed the credit for having brought Stratton to Washington.³² Attribution follows the written record, the record is written by participants, and where the record admits more than one telling, the tellings multiply.

Three cases are only three cases. The regularities above are drawn from the formations whose public records are most complete, and a regularity is not a law; the next formation is under no obligation to repeat the last three. What the pattern supplies is a reading position. Given a new capability with a growing incident record and no control layer, the prior formations say what to watch for: the fusion of inspection with financial accountability and the arrival of a practitioner-written code.

Risk that is managed, not closed

Steam, rail, and electricity share an ending that flatters the pattern. In each, the central hazard was, over time, largely engineered out. A boiler built and inspected to the code does not explode; a coupler that locks automatically does not crush a brakeman; a tested appliance does not start the fire. The control layer arrived, did its work, and the risk it governed became, for practical purposes, closed. Chapter 1 established that agent work does not offer that ending; part of its risk is irreducible. For that part, the useful precedents are not the regimes where the hazard was solved. They are the domains that have spent a century managing a risk that never closes.

Financial audit, the profession the rail boom built, is the closest of them, and the word assurance comes from it. An audit does not certify that accounts are correct. It provides, in the language of the international standard, reasonable assurance, defined there as high but not absolute, because the auditor cannot reduce audit risk to zero. The inherent limitations of an audit mean some misstatement may escape even a properly conducted one.³³ A profession built on that stated limit has been accountable, insured, and durable for more than a century. Reasonable assurance is enough, formalized and defended in law, and it is the posture agent assurance takes toward a risk it cannot drive to zero.

Aviation's safety is built first on mechanical closure: redundant systems, certified parts, fail-safes, the boiler-code discipline applied to airframes. What remained after the machinery was made as safe as engineering could make it was the human residual, the crew, and that residual was managed rather than removed. Modern Crew Resource Management began formally with a safety board's recommendation from the investigation of a 1978 crash in which a fuelled aircraft was lost while its captain worked a landing-gear problem and did not act on the warnings of two junior officers who had watched the fuel run down. A workshop the next year named the discipline, and the first airline program followed in 1981.³⁴ Aviation closed what engineering could close, and managed what it could not, in that order.

Medicine manages a risk it has never claimed to close. A surgeon set out the idea of tracking outcomes, complications and deaths included, at the start of the twentieth century, and the morbidity and mortality conference that grew from it is a permanent review of what went wrong, now a century old.³⁵ The failures it examines have not stopped: in 2002 a national body published a consensus list of serious reportable events, the never-events that recur despite being classed as preventable, and the profession carries malpractice liability because the residual is real. None of this is a control layer waiting to close a hazard. It is the shape a discipline takes when the hazard is permanent.

Cybersecurity is the youngest of the four, and it settles a question the mechanical formations leave open: whether an irreducible, adversarial risk must consolidate into a chartered profession. It need not. The workforce is measured in millions, put at roughly 5.5 million people worldwide in one 2024 industry study.³⁶ Yet after decades the chartering has barely begun: the United Kingdom's Cyber Security Council, chartered in 2022, announced a first cohort of only about a hundred registered practitioners across all its tiers and sixteen specialisms.³⁷ A national academies review judged broad licensure premature because the field is too broad, too dynamic, and too fast-moving to fix into a single profession.³⁸ Those are the properties agent work has in the strongest form. Cybersecurity became a large, lasting, valuable market of competing standards, certifications, and practices, not a chartered institution, and it did so for reasons agent assurance shares.

Where agent assurance sits

The incident record has started and is thin. Chapters 1 and 2 cited the early entries: fabricated authorities reaching courts, an impaired system charging fees for three years, the improvised-systems findings of regulators. These are this formation's version of the 1841 collision: incidents with dates and inquiry documents, individually expensive and collectively small. Nothing in the agent record yet resembles the Sultana or the casualty tables of 1889, and the systems that would produce failures at that scale, agent workforces operating inside critical processes, are being built now. The formative disaster class of this field, the one whose specifics will be written into its eventual code the way two shoe factories were written into the boiler code, has not yet occurred, or has not yet surfaced.

Standards documents exist, and they precede the incident record rather than following it. NIST released its AI Risk Management Framework on January 26, 2023, developed through a consensus process; the framework describes itself as voluntary, non-sector-specific, and use-case agnostic.³⁹ A generative-AI companion profile followed in July 2024, directed by executive order.⁴⁰ ISO 42001, published in 2023, specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system within an organization.⁴¹ These are serious documents, and their existence this early is a departure from the historical sequence, where the standard came last. But their self-descriptions mark the difference between them and a boiler code. Voluntary, non-sector-specific, and use-case agnostic is the language of principle, drafted in advance of the incidents; the 1914 code was the language of named failures, drafted after them. The current documents are frames awaiting an incident record, and they say so in their own terms.

The early arrival admits two readings. One is that the standards bodies have studied exactly the history this chapter compresses and have chosen to write their documents before the disasters instead of after them. The other is that a framework written before the incident record is a different kind of document from a code written after it, whatever its intentions, because the specificity that made the boiler code buildable came from the incidents themselves. The readings are not exclusive, and the record that would settle them does not exist yet.

Adoption of the frames is not yet measurable from the public record. NIST publishes no quantitative adoption statistics for its framework; its official hub points to a qualitative page of use-case examples.⁴² Certification against ISO 42001 exists and is new, and even its largest holders describe it unevenly. Microsoft lists eight of its AI services as in scope for certification, while the prose of the same page describes the company's "progress towards" certification, against page metadata asserting the certification outright.⁴³ This is what the earliest stage of a certification regime looks like from outside: real documents, small numbers, and descriptions that have not yet settled.

The commercial fusion has begun. An underwriting company has published a certification standard for AI agents, organized in six categories and refreshed quarterly.⁴⁴ In February 2026 an audit firm became its first authorized auditor.⁴⁵ In the same month a voice-agent vendor became the first company insured against the certificate, after more than 5,000 adversarial simulations. An enterprise automation platform was certified in March, audited across more than 2,000 technical evaluations.⁴⁶ Other carriers are writing agent cover on their own terms. One offers dedicated limits of twenty-five million dollars or more per organization, backed at Lloyd's, covering losses from model errors and agent actions.⁴⁷ Another sells cover with no audit and no access to the buyer's code, priced from a dataset of real AI litigation.⁴⁸

So the market now has a standard, an auditor, and insurers, but they are three separate businesses. Among them, no single company inspects agent work and pays when the inspection is wrong, the way the Hartford did for boilers. The insurers buy inspection from outside, the way the fire underwriters bought Merrill's testing. And whether the inspection decides the cover is not yet clear from outside: one policy requires an audit, and another does not.

The certificate also covers one thing only: the vendor's agent system. Nothing in the public record yet certifies the practitioner, or agent work as a particular firm runs it. What ends an absence like that is demand. A shipowner bought classification because without it he could not get insurance or charters. That demand has now arrived for the product. It has not yet arrived for the practice. It will, when an insurer, a bank, or a client makes that assurance a condition of the deal. The reconciliation layer is then bought rather than argued for.

A reader who recognized their own firm in chapters 1 and 2 is doing business inside the interval the pattern names: after the capability arrives, before its control layer forms. Each history above is partly a record of who carried the risk while that interval lasted: the passengers of the Sultana, the trainmen in the ICC's tables, the policyholders of the fire underwriters.

And the practitioners have no adopted code: no document that a client, an insurer, or a bank can require by name, stating in the language of recorded incidents how such work is controlled, inspected, and signed for. On the practitioner's side of the formation, the stage this field occupies most resembles the earliest one in the steam record. In 1857, before the company, before the code, a few Hartford entrepreneurs formed a club to discuss practical changes to boilers.⁷ The capability is deployed and the incidents have begun; what the public record shows of a practitioners' layer is discussion, not a document. That much of the pattern agent assurance shares.

What it does not share is the boiler's ending. The four regularities describe how a control layer forms; they do not promise that the hazard closes or that a chartered profession follows, and for agent work neither is likely. The layer that forms will manage that risk in the manner of audit, aviation, and medicine rather than close it in the manner of the boiler code. On the conditions the third regularity named, the field's likelier shape is cybersecurity's, an ending the final chapter examines in full. The pattern does not establish that agent assurance will become a profession. It establishes that the work is real and that it is forming now. The pattern leaves one question it cannot answer: whether the work it describes stays valuable once the technology settles, or fades with the conditions that created it. That question belongs to economics, and it is chapter 5's.