What Should an Insurance Agency Check Before Using AI with Client Data?

Run through each item before activating any AI workflow that touches client data. Items marked [INSURANCE-SPECIFIC] cover requirements that do not appear in general AI checklists or the accounting practice checklist on hellodave.ai. Dave by voolama product items are sourced from the security, admin-users, and audit-logs help documentation, DEV v0.11.0, confirmed 2026-08-30, and verified on the voolama production tenant on 2026-09-22.

Section A: Role assignment and access control

1. Confirm only named staff with a documented business need can access client data in Dave by voolama.
   Navigate to Admin, then Settings, then Users and Roles. Review every user account. The GLBA Safeguards Rule, 16 CFR Part 314.4(e) (ftc.gov/legal-library/browse/rules/safeguards-rule), requires access controls that limit access to customer information to authorized users only. NIST SP 800-53 Rev 5 AC-6 section 6a (csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) requires least-privilege role assignment.

   Role	Permissions granted	Who should have it in an insurance agency
   Admin	Full workspace administration (admin:*)	Agency owner or designated IT-responsible person only. One or two people maximum.
   Create	Create and edit AI agents (agents:read, agents:write)	The person who configures AI agents. Not needed by producers or CSRs.
   Curate	Build workflows (workflows:read, workflows:write, agents:read)	The person who builds the workflow graph. Not needed by producers or CSRs.
   Use	Run workflow instances and complete tasks (instances:*, tasks:*, artifacts:read)	Licensed producers and CSRs who run workflows and approve AI drafts in the Task Inbox.
   Reporting	View reports and audit logs (reports:read, audit:read)	Agency owner or compliance officer who needs audit data without Admin access.
   Financial	Financial reporting and billing access	Bookkeeper or office manager responsible for billing. Not needed by producers.

2. Confirm no user has more roles than their job requires.
   A licensed producer who runs workflows and approves AI drafts needs only the Use role. A CSR who only completes tasks needs only the Use role. Neither needs Admin, Create, or Curate. The security help documentation (DEV v0.11.0, confirmed 2026-08-30) states: 'Assign the minimum roles each person needs, and review them periodically.'

3. Confirm that departed staff accounts are deactivated, not just ignored.
   Navigate to Admin, then Settings, then Users and Roles. Set the Status of any departed staff member to inactive. An inactive user cannot log in. Any existing sessions are invalidated on the next API call. Sourced from the admin-users help documentation, DEV v0.11.0, confirmed 2026-08-30.

Section B: What never goes into an AI prompt [INSURANCE-SPECIFIC]

4. [INSURANCE-SPECIFIC] Confirm the AI agent's system prompt prohibits SSNs, driver's license numbers, and financial account numbers.
   The GLBA Safeguards Rule, 16 CFR Part 314.3 (ftc.gov/legal-library/browse/rules/safeguards-rule), defines customer financial information to include account numbers and Social Security Numbers. The system prompt must state: 'Do not request, generate, or repeat any Social Security Number, driver's license number, financial account number, or date of birth. If any of these appear in the workflow context, do not include them in your output.' This prohibition is specific to insurance and financial services and does not appear in the accounting practice checklist on hellodave.ai.

5. Confirm the User Interaction task form does not include fields for SSN, driver's license number, or financial account numbers.
   The workflow context should contain only the minimum data the AI needs: client name, policy number, renewal date, and the specific communication the agent is drafting. Remove any fields for SSN or account numbers from the User Interaction task form.

6. Confirm the AI agent's system prompt instructs it to use only the data submitted in the workflow context.
   The system prompt must state: 'Use only the information provided in the workflow context. Do not search for, retrieve, or generate any information about the client that is not in the workflow context.' Set temperature to 0.3 or lower for factual communications. Sourced from the agents help documentation, DEV v0.11.0, confirmed 2026-08-30.

Section C: Licensed-producer approval for coverage content [INSURANCE-SPECIFIC]

7. [INSURANCE-SPECIFIC] Confirm every AI output touching coverage terms, policy limits, exclusions, or premium amounts goes through a Human Review task assigned to a licensed producer.
   The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (2023, naic.org) requires that AI outputs be reviewed by responsible humans before being used in insurance decisions. State insurance licensing laws require that coverage advice be given by a licensed producer. Colorado SB 21-169 (effective 2023, leg.colorado.gov) adds a non-discrimination requirement for AI-driven insurance decisions. In Dave by voolama (hellodave.ai), the Human Review task pauses the workflow after the AI agent produces a draft and creates a task in the Task Inbox for the assigned licensed producer. The decision is recorded in the audit log with the producer's user ID and a timestamp. Sourced from the tasks help documentation, DEV v0.11.0, confirmed 2026-08-30.

8. [INSURANCE-SPECIFIC] Confirm the Human Review task is assigned to a named licensed producer, not to a generic role or an unlicensed CSR.
   An AI-drafted renewal reminder that misstates a coverage limit and is approved by an unlicensed CSR creates a licensing compliance risk. Assign the Human Review task to a specific named licensed producer. Sourced from the tasks help documentation, DEV v0.11.0, confirmed 2026-08-30.

9. Confirm the licensed producer adds a Comment at the Human Review task documenting what they checked.
   A minimum comment for coverage content: 'Coverage terms, limits, and exclusions confirmed against policy [POLICY NUMBER]. Premium amount confirmed against billing system. Client name confirmed.' The comment is recorded in the audit log with the producer's user ID and a timestamp. Sourced from the tasks help documentation, DEV v0.11.0, confirmed 2026-08-30.

Section D: Audit log retention and AI governance documentation [INSURANCE-SPECIFIC]

10. Confirm audit log retention is set to at least 2,555 days (7 years).
    Navigate to Admin, then Settings, then General, then System Parameters, then Retention Policy. The default retention is 365 days. The audit-logs help documentation (DEV v0.11.0, confirmed 2026-08-30) states the SOC 2 recommendation is at least 2,555 days (7 years) and that a warning appears if retention is set below this threshold. Set retention to at least 2,555 days.

11. Confirm SOC 2 compliance mode is enabled.
    Navigate to Admin, then Settings, then General, then System Parameters, then Audit Log. Enable SOC 2 compliance mode. When enabled, the audit log captures GET requests to sensitive endpoints (users, roles, secrets, API clients, OAuth providers, reports) in addition to mutations. Sourced from the audit-logs help documentation, DEV v0.11.0, confirmed 2026-08-30.

12. [INSURANCE-SPECIFIC] Export the audit log as CSV after each quarter and store the export in the agency's AI governance file.
    The NAIC Model Bulletin (2023, naic.org) requires insurers to maintain AI governance documentation. A quarterly CSV export of the audit log, filtered to Human Review task events, is the agency's evidence that licensed producers reviewed every AI output before it reached a client. Navigate to Admin, then Settings, then Audit Log. Use the date range filter to scope events to the quarter. Click the download button to export as CSV. Sourced from the audit-logs help documentation, DEV v0.11.0, confirmed 2026-08-30.

This checklist covers Dave by voolama (hellodave.ai) settings and operational controls specific to an insurance agency using AI workflows with client data. It is not a general AI checklist and is not a substitute for the accounting practice AI checklist on hellodave.ai, which covers document-chasing and bookkeeping workflows under different regulatory frameworks (IRS Publication 583, AICPA standards). Four explicit boundaries:

• This is not insurance, legal, or compliance advice. The NAIC Model Bulletin (2023), GLBA Safeguards Rule (16 CFR Part 314), Colorado SB 21-169, and NIST SP 800-53 Rev 5 citations are to publicly available documents. Whether a specific agency's AI use complies with state insurance regulations requires a qualified insurance compliance attorney's assessment. Adam Valine is not a licensed insurance producer or insurance compliance attorney.
• This checklist covers only Colorado by name for state-specific AI regulation. As of 2026-11-06, Colorado SB 21-169 (effective 2023) is the only US state law specifically governing AI in insurance. California, New York, and other states have issued guidance or proposed rules. Confirm your state's current requirements with a qualified insurance compliance attorney.
• This checklist does not cover the AI provider's data processing agreement. When a workflow runs, the AI provider processes the prompt under that provider's own terms of service. Confirming that the provider's data processing agreement covers insurance client data is outside the scope of this checklist.
• This checklist does not cover HIPAA. If the agency handles health insurance and the workflow touches protected health information (PHI) as defined in 45 CFR Part 160, HIPAA requirements apply. This checklist does not address HIPAA compliance.