Travel & Hospitality AI agent · Cruise security
Cruise Vessel Security AI Agent
Map surveillance coverage against the spaces the statute names, hold each incident with the footage covering it, and keep the annual confirmation ready for the company security officer who gives it.
- Typical delivery
- 4–6 weeks
- Deployment
- Your stack
- Named officer
- Bare statute
- After launch
- Agent Care
What this agent does
Assembles the evidence, never the confirmation
In
- 01
An incident is reported, and 46 U.S.C. 3507(g)(1) wants it in a log book law enforcement can reach.
- 02
An incident is reportable, and 3507(g)(3)(A)(i) says telephone the FBI as soon as possible, on no clock.
Reason
- 03
A camera drops out, and coverage the 3507(b)(1) surveillance plan promised stops matching the decks.
- 04
Footage ages, and 3507(b)(4) holds it twenty days, or four years once the FBI calls it relevant.
- 05
A crewmember opens a stateroom, and 3507(f) wants date, time and identity on an electronic record.
Decide
- 06
An arrival nears, and 42 CFR 71.21 wants illness reported twenty-four hours out, then four hours out.
- 07
A year turns, and the company security officer confirms the systems operational under 3507(b)(1)(E)(ii).
Out
- 08
A rule is looked for, and 83 FR 12086 reserved 33 CFR Parts 120 and 128, leaving the CVSSA bare.
- 09
Execute write actions only inside the approval boundaries agreed during implementation.
Product statement
The agent maps coverage and tracks the clocks. A classification society attests installation under 3507(b)(1)(E)(i); the company security officer gives the annual confirmation at (E)(ii).
Example workflow
One incident, footage to confirmation
- 1Incident evidence receivedLog book entries, camera health feeds, stateroom access records or ship medical logs
- 2Incident context assembledThe incident, the deck it happened on, the cameras covering it and the clock it started
- 3Security record draftedThe incident, the footage held against it, the gaps and completeness
- 4Controls appliedCoverage checks, retention-clock checks, pre-arrival illness checks and completeness confidence
No human action required
Stages 1 to 4 run unaided, and nothing is confirmed at any of them — the agent is assembling, and the security lane opens at the completeness gate.
Goes to the company security officer to confirm.
Adds a fleet security read first.
Security review
The record is held with its incident, its footage and the report feeding the quarterly compilation under 3507(g)(4)(A).
Confirm · Append evidence · Send to security review
Confirmed — by the company security officer
- 6Incident and camera records updatedOnly where write access and records policy allow it
- 7Outcome evaluatedCoverage accuracy, retention holds, reviewer corrections and what the read found
Corrections
Each security correction is counted in the evaluation.
What should not run autonomously
Human approval stays in control
Outside the boundary — human approval required
8 items
- Confirming the surveillance systems are operational.
- Telephoning the FBI under 3507(g)(3)(A)(i).
- Signing examination findings under 3507(d).
- Filing the written report under 3507(g)(3)(A)(ii).
Automation boundary
Agent acts unaided
- ✓Map the coverage to each space the statute names.
- ✓Hold each reported incident together with the footage.
- ✓Mark the footage nearing the end of the period 3507(b)(4) sets.
- ✓Track the two pre-arrival illness clocks that 42 CFR 71.21 sets.
Nothing is confirmed or reported except by a named person, inside the agreed boundaries.
- Judging whether coverage in fact met the statute.
- Telling the Coast Guard the vessel is compliant.
- Deciding that an incident is not reportable.
- Changes to footage, log books or access records.
Example output
One incident, annotated
The CDC Vessel Sanitation Program is statutory under 42 U.S.C. 264 and 42 CFR 71.41, with unannounced inspections twice a year; this record is one incident.
Security record · single incident
Illustrative example- Incident
- Reportable incident, 3507(g)(1)
- Recorded as
- Logged and matched to covering footage
- Coverage
- Promenade deck, camera out
- Evidence of record
- Log book entry, 3 August 2026
- Confidence
- Held unconfirmed
- Held for
- The company security officer, by name
As received
Taken from the log book entry and the camera health feed — it reaches as far as those sources do.
What the record holds
- Log book entry
- Camera health feed
- Retention hold
Why no confirmation here
Whether the systems are operational is reserved to 3507(b)(1)(E)(ii).
What the score decides
Below the configured threshold the record picks up a security read before the officer sees it.
Action
ConfirmAppend evidenceSend to security reviewValue
Where AI adds value
The same four claims, placed at the point in the workflow where each one applies.
Where the value lands
Value 01 – 04
Every incident
From the system that logged it
Where the evidence is used
The shipped transportation/vessel-emissions-compliance-agent answers to EU and IMO instruments through an accredited verifier; this answers to the Coast Guard, the FBI, DOT and CDC on incidents and illness — different regulator, trigger, evidence and clock.
A statute with no rulebook
The 2018 rule at 83 FR 12086 reserved 33 CFR Parts 120 and 128 and excludes the CVSSA, so rails, peepholes, latches on keels laid after 27 July 2010 and overboard detection answer to 3507(a) alone.
What was checked, and not found
The VSP special-report threshold, the inspection score, VSP headcount now, a fixed-hour FBI clock, a signature in 46 U.S.C. 3508, the Coast Guard form signature block and the latest quarter published under 3507(g)(4)(A) were checked, and none was confirmed.
Build an evidence trail
The incident, the footage covering it and the officer who confirmed stay on the record.
Integrations
Typical integrations
Five system groups connect to the same agent. Which of them are in scope is decided in discovery.
Surveillance and cameras
- CCTV
- camera health
- Coverage and retention
Incident and log book
- Log book entries
- Incident reports
Access and personnel
- Stateroom access records
- Crew training certificates
Agent
Cruise vessel security
- Reads the incidents
- Assembles the record
- Holds for the officer
Medical and public health
- Ship medical log
- Pre-arrival illness reports
Observability & evaluation
- OpenTelemetry
- Langfuse
- Supported monitoring/evaluation sources
Integration availability depends on the client's existing systems and API access.
Agent controls
Six angles between the model and the officer
Six angles taken on one incident, each less forgiving than the last. What holds up is mapped out below.
L6 · Outermost — last line of defence
Inward → L1 · closest to the model
- L1 – L2
- Test whether a record may stand
- L3
- Puts the confirmation in a person's hands
- L4 – L5
- Keep the incident and the footage behind it
- L6
- Drops back to footage assembly when signals degrade
How Nestack evaluates it
Evaluate the whole assembly — not only the security record that comes out.
Coverage runs the whole depth of the workflow, and every layer is cut by slice.
Surface — the record an investigator reads
- E1Final-output evaluationDid the record hold the footage each incident actually needed?
- E2Step-level evaluationDid the agent read the right vessel, the right deck and the live camera state?
- E3Tool evaluationDid it read and write the correct incident and the correct retention hold?
- E4Confidence calibrationDo low-confidence records actually attract more security corrections?
- E5Slice evaluationHow does performance change across specific incident classes?
- E6Business outcomeHow many records needed a correction before the officer confirmed?
Floor — the vessel the owner answers for
Failure modes
Where each failure originates in the agent
Seven failure modes, each placed at the stage that first shows it.
Agent lifecycle
Direction of processing →
01 · Retrieval
1 mode
- KB-03
Stale coverage read
The camera state read is not the one now in service.
Stage gathers
The vessels, the decks, the cameras and the dates
02 · Reasoning
2 modes
- KB-04
Coverage asserted, not shown
An incident is called covered without its footage.
- KB-06
Absent rule read as written
A missing regulation is worked as though issued.
Stage proposes
Incidents, their footage and completeness
03 · Tool / write
2 modes
- KB-02
Thin record passed forward
A record moves on without the security read.
- KB-05
Bound to the wrong voyage
Footage is filed against the wrong voyage.
Stage writes
Only where write access and approval policy allow it
04 · Output
1 mode
- KB-01
Confirmed, footage unrecorded
The record shows a confirmation but not what covered it.
Stage returns
The record an officer confirms and the FBI reads
05 · Change / Version
1 mode
- KB-07
Silent retention regression
A configuration change moves the hold, not the record.
Stage tracks
Model, prompt, retention rules and record fields
- Sev-1 · a confirmation given on no footage
- Sev-2 · wrong footage reaches the record
- Sev-3 · source degrades, record unconfirmed
Affected slices
Reportable crime incidents absorb the corrections
A voyage-level coverage figure can read clean while reportable crime incidents carry most of the rework. Nestack reports the correction rate by incident class, not only in total.
Slice performance — reported separately, not only in aggregate
Illustrative example| Slice | Failure rate | Lift | Lift vs. threshold | Status |
|---|---|---|---|---|
| Reportable crime incidents | 8.3% | 3.6× | Review | |
| Stateroom access exceptions | 5.9% | 2.6× | Review | |
| Overboard detection alerts | 3.7% | 1.6× | Watch | |
| Routine camera health faults | 2.1% | 0.9× | Normal |
Bar: correction-rate lift vs. camera-fault baseline · scale 0–4.0× · tick marks the 2.0× review threshold
2 of 4 slices over threshold
Evidence-linked improvement
What overwritten footage costs
A loop ends when the overwritten footage has become a case the next release must pass. That suite is what the next confirmation given is measured against.
Improvement cycle · five stages
Switchback — the path turns at Improve and returns at Learn
- 01
Detect
Correction rate rises on reportable crime incidents.
- 02
Diagnose
The twenty days that ran out before anyone asked for the recording are read back until one cause remains.
- 03
Improve
Number the change; the incidents that drove it are filed underneath it.
- 04
Verify
Each touched voyage case is run once more, and one red holds it back.
- 05
Learn
It stays on as a standing test, and the notification rules move with it.
Learn → Detect
The return edge. The next sailing season is measured against a suite one case longer.
Typical build scope
Twelve workstreams across six weeks
The build scope read against the delivery timeline. Week structure follows the six-week plan — discovery, sources, record assembly, evaluation, integration, then production validation and handover.
Workstream
Week 1Week 2Week 3Week 4Week 5Week 6
- 01Reportable-incident discovery and boundary work.Week 1
- 02Camera, log book and access sources.Week 1, Week 2
- 03Incident-to-footage and retention-clock mapping.Week 1, Week 2
- 04Incident and footage ingestion.Week 2
- 05Incident, vessel and record binding.Week 2, Week 3
- 06Completeness scoring and review routing.Week 3
- 07Security officer confirmation workflow.Week 3, Week 4
- 08Camera and access-system integration.Week 5
- 09Coverage and retention cases.Week 4, Week 5
- 10Guardrails and confirmation controls.Week 4
- 11Incident-trail instrumentation.Week 5, Week 6
- 12Deployment, documentation and Agent Care handover.Week 6
12 workstreams · 6 weeks · bar shows the weeks a workstream is active — several run in parallel
Final scope and sequence confirmed in discovery
Engagement tiers
What each tier includes
Rows are the capabilities named in each tier's scope. Higher tiers include everything below them.
| Capability✓ in scope · — not at this tier | PilotOne vessel, one season | ProductionProduction security workflow | AdvancedMultiple vessels / fleets |
|---|---|---|---|
| Introduced at Pilot | |||
| Record assembly to your incidents | ✓ | ✓ | ✓ |
| Company security officer release | ✓ | ✓ | ✓ |
| Surveillance-coverage baseline | ✓ | ✓ | ✓ |
| Introduced at Production | |||
| Reporting by voyage | — | ✓ | ✓ |
| Confirmation workflow in your systems | — | ✓ | ✓ |
| Approved write-back | — | ✓ | ✓ |
| Access-record integration | — | ✓ | ✓ |
| Introduced at Advanced | |||
| Multi-vessel fleets | — | — | ✓ |
| Cross-voyage evidence packs | — | — | ✓ |
| Large camera estates | — | — | ✓ |
| Multi-authority notification controls | — | — | ✓ |
| Build price | From $5,000 | From $8,000 | Custom quote |
- Final build price
- Confirmed after discovery based on integrations, workflow complexity, incident volume, approval controls and deployment requirements.
- Separate from build
- Build pricing is separate from recurring Agent Care, which covers managed monitoring, evaluations, incidents and verified improvements after launch.
What we need from you
What you bring, and what we build with it
Each input maps to a piece of build scope and a week in the delivery timeline.
You bring
We build with it
01Your vessels and the decks each camera covers
→Camera inventory mapping and coverage capture
Week 102Representative log book, camera and access records
→Record binding, retention logic and the coverage baseline
Week 203Your reading of the 3507(a) fittings and the 3507(c) guide
→Incident mapping, footage binding and the automation boundary
Week 104Access to relevant APIs, feeds or exports
→Camera, log book and access-source assessment, then integration setup
Week 205Voyages you would not want examined
→Coverage cases and failure testing
Week 406What no security record may prove
→Completeness scoring, review routing, guardrails and release controls
Week 307A company security officer to confirm
→Confirmation workflow, then pilot and production validation
Weeks 5–6
Nothing else is required
Deployment, documentation and Agent Care handover are ours.
Delivery timeline
Four phases across six weeks
What you see is time actually worked rather than spacing, so the fifth band has to hold two phases.
Phase
W1
W2
W3
W4
W5
W6
- DiscoveryW1
- BuildW2 – W3
- EvaluateW4 – W5
- Pilot & LaunchW5 – W6
Week focus
W1Security workflow discovery, incident mapping and the automation boundary
W2Source integration and the surveillance-coverage baseline
W3Record assembly, retention logic and release controls
W4Evaluation suite, coverage cases and failure-mode testing
W5Camera integration, pilot incidents and targeted corrections
W6One sailing season run under the company security officer, then Agent Care handover
- Reading the band
- Each bar covers only the weeks its own work is named for. The fifth holds a pair because the work does.
- At the end of W6
- When the incident record validates, Agent Care takes the agent on.
- Duration
- Six-week plan shown · typical delivery 4–6 weeks depending on scope confirmed in discovery.
Next step · Travel & Hospitality AI agent
Build a cruise security agent around the confirmation an officer gives each year.
One incident and the footage that covered it is where this starts. Show us your camera map and the decks 46 U.S.C. 3507(a) names, because no implementing regulation stands under the statute and your own procedure is the whole of it. Illness reporting is a separate clock.
- Typical delivery
- 4–6 weeks
- Deployment
- Your incidents
- Named officer
- Bare statute
- After launch
- Agent Care available
Nestack Agents · Cruise security
AGT-TH-19 · Agent Care available after launch