Map surveillance coverage against the spaces the statute names, hold each incident with the footage covering it, and keep the annual confirmation ready for the company security officer who gives it.
An incident is reported, and 46 U.S.C. 3507(g)(1) wants it in a log book law enforcement can reach.
02
An incident is reportable, and 3507(g)(3)(A)(i) says telephone the FBI as soon as possible, on no clock.
Reason
03
A camera drops out, and coverage the 3507(b)(1) surveillance plan promised stops matching the decks.
04
Footage ages, and 3507(b)(4) holds it twenty days, or four years once the FBI calls it relevant.
05
A crewmember opens a stateroom, and 3507(f) wants date, time and identity on an electronic record.
Decide
06
An arrival nears, and 42 CFR 71.21 wants illness reported twenty-four hours out, then four hours out.
07
A year turns, and the company security officer confirms the systems operational under 3507(b)(1)(E)(ii).
Out
08
A rule is looked for, and 83 FR 12086 reserved 33 CFR Parts 120 and 128, leaving the CVSSA bare.
09
Execute write actions only inside the approval boundaries agreed during implementation.
→Product statement
The agent maps coverage and tracks the clocks. A classification society attests installation under 3507(b)(1)(E)(i); the company security officer gives the annual confirmation at (E)(ii).
Example workflow
One incident, footage to confirmation
AgentHuman
1Incident evidence receivedLog book entries, camera health feeds, stateroom access records or ship medical logs
2Incident context assembledThe incident, the deck it happened on, the cameras covering it and the clock it started
3Security record draftedThe incident, the footage held against it, the gaps and completeness
Stages 1 to 4 run unaided, and nothing is confirmed at any of them — the agent is assembling, and the security lane opens at the completeness gate.
5DecisionSplits at the completeness gate
Evidence sufficient
Goes to the company security officer to confirm.
Anything thin
Adds a fleet security read first.
Security review
The record is held with its incident, its footage and the report feeding the quarterly compilation under 3507(g)(4)(A).
Confirm · Append evidence · Send to security review
Confirmed — by the company security officer▼
6Incident and camera records updatedOnly where write access and records policy allow it
7Outcome evaluatedCoverage accuracy, retention holds, reviewer corrections and what the read found
Corrections
Each security correction is counted in the evaluation.
What should not run autonomously
Human approval stays in control
Outside the boundary — human approval required8 items
Confirming the surveillance systems are operational.
Telephoning the FBI under 3507(g)(3)(A)(i).
Signing examination findings under 3507(d).
Filing the written report under 3507(g)(3)(A)(ii).
Automation boundaryAgent acts unaided
✓Map the coverage to each space the statute names.
✓Hold each reported incident together with the footage.
✓Mark the footage nearing the end of the period 3507(b)(4) sets.
✓Track the two pre-arrival illness clocks that 42 CFR 71.21 sets.
Nothing is confirmed or reported except by a named person, inside the agreed boundaries.
Judging whether coverage in fact met the statute.
Telling the Coast Guard the vessel is compliant.
Deciding that an incident is not reportable.
Changes to footage, log books or access records.
Example output
One incident, annotated
The CDC Vessel Sanitation Program is statutory under 42 U.S.C. 264 and 42 CFR 71.41, with unannounced inspections twice a year; this record is one incident.
Security record · single incidentIllustrative example
Incident
Recorded as
Coverage
Evidence of record
Confidence
Held for
Reportable incident, 3507(g)(1)
Logged and matched to covering footage
Promenade deck, camera out
Log book entry, 3 August 2026
Held unconfirmed
The company security officer, by name
As receivedTaken from the log book entry and the camera health feed — it reaches as far as those sources do.
What the record holdsLog book entryCamera health feedRetention hold
Why no confirmation hereWhether the systems are operational is reserved to 3507(b)(1)(E)(ii).
ActionConfirmAppend evidenceSend to security review
What the score decidesBelow the configured threshold the record picks up a security read before the officer sees it.
Value
Where AI adds value
The same four claims, placed at the point in the workflow where each one applies.
Where the value landsValue 01 – 04
Every incidentFrom the system that logged it
03Evidence
Where the evidence is used
The shipped transportation/vessel-emissions-compliance-agent answers to EU and IMO instruments through an accredited verifier; this answers to the Coast Guard, the FBI, DOT and CDC on incidents and illness — different regulator, trigger, evidence and clock.
01Approved path
A statute with no rulebook
The 2018 rule at 83 FR 12086 reserved 33 CFR Parts 120 and 128 and excludes the CVSSA, so rails, peepholes, latches on keels laid after 27 July 2010 and overboard detection answer to 3507(a) alone.
02Human review
What was checked, and not found
The VSP special-report threshold, the inspection score, VSP headcount now, a fixed-hour FBI clock, a signature in 46 U.S.C. 3508, the Coast Guard form signature block and the latest quarter published under 3507(g)(4)(A) were checked, and none was confirmed.
04Build an evidence trail
The incident, the footage covering it and the officer who confirmed stay on the record.
Integrations
Typical integrations
Five system groups connect to the same agent. Which of them are in scope is decided in discovery.
Surveillance and camerasCCTV · camera health Coverage and retention
Incident and log bookLog book entries Incident reports
Access and personnelStateroom access records Crew training certificates
Agent
Cruise vessel security
Reads the incidents Assembles the record Holds for the officer
Medical and public healthShip medical log Pre-arrival illness reports
Integration availability depends on the client's existing systems and API access.
Agent controls
Six angles between the model and the officer
Six angles taken on one incident, each less forgiving than the last. What holds up is mapped out below.
L6 · Outermost — last line of defenceInward → L1 · closest to the model
L6Rollback / safe modeNarrow the agent to footage assembly when evaluation or production signals degrade.Roll back
L5Version monitoringTrack model, prompt and retention rules; about half the CDC Vessel Sanitation Program staff went in the April 2025 reduction in force, with no change to the duty.Track
L4TraceabilityRecord each incident, the footage behind it and every read of the record; Pub. L. 119-60 amended 3507(f) on 18 December 2025 and is in force.Record
L3Officer releaseHold the record for the company security officer; the hold governs release, not the plan cycle at 3507(b)(1)(D) to (F).Gate
L2Scope guardrailsTest the evidence against 46 U.S.C. 3507, the 3508 crime-scene training and the 3509 medical standards, in force since 1 January 2021.Restrict
L1Confidence thresholdsRoute a thin record to a security read first; the acoustic hailing device and the FBI-reviewed guide at 3507(c) have no rule construing them.Require review
Model coreEvidence assembled — the incident, the footage, the coverage and completeness
L1 – L2Test whether a record may stand
L3Puts the confirmation in a person's hands
L4 – L5Keep the incident and the footage behind it
L6Drops back to footage assembly when signals degrade
How Nestack evaluates it
Evaluate the whole assembly — not only the security record that comes out.
Coverage runs the whole depth of the workflow, and every layer is cut by slice.
Surface — the record an investigator reads
Depth of coverage ▼
E1Final-output evaluationDid the record hold the footage each incident actually needed?
E2Step-level evaluationDid the agent read the right vessel, the right deck and the live camera state?
E3Tool evaluationDid it read and write the correct incident and the correct retention hold?
E4Confidence calibrationDo low-confidence records actually attract more security corrections?
E5Slice evaluationHow does performance change across specific incident classes?
E6Business outcomeHow many records needed a correction before the officer confirmed?
Floor — the vessel the owner answers for
Failure modes
Where each failure originates in the agent
Seven failure modes, each placed at the stage that first shows it.
Agent lifecycleDirection of processing →
01 · Retrieval1 mode
KB-03
Stale coverage read
The camera state read is not the one now in service.
Stage gathersThe vessels, the decks, the cameras and the dates
02 · Reasoning2 modes
KB-04
Coverage asserted, not shown
An incident is called covered without its footage.
KB-06
Absent rule read as written
A missing regulation is worked as though issued.
Stage proposesIncidents, their footage and completeness
03 · Tool / write2 modes
KB-02
Thin record passed forward
A record moves on without the security read.
KB-05
Bound to the wrong voyage
Footage is filed against the wrong voyage.
Stage writesOnly where write access and approval policy allow it
04 · Output1 mode
KB-01
Confirmed, footage unrecorded
The record shows a confirmation but not what covered it.
Stage returnsThe record an officer confirms and the FBI reads
05 · Change / Version1 mode
KB-07
Silent retention regression
A configuration change moves the hold, not the record.
Stage tracksModel, prompt, retention rules and record fields
Sev-1 · a confirmation given on no footageSev-2 · wrong footage reaches the recordSev-3 · source degrades, record unconfirmed
A voyage-level coverage figure can read clean while reportable crime incidents carry most of the rework. Nestack reports the correction rate by incident class, not only in total.
Slice performance — reported separately, not only in aggregateIllustrative example
Slice
Failure rate
Lift
Lift vs. threshold
Status
Reportable crime incidents
8.3%
3.6×
Review
Stateroom access exceptions
5.9%
2.6×
Review
Overboard detection alerts
3.7%
1.6×
Watch
Routine camera health faults
2.1%
0.9×
Normal
Bar: correction-rate lift vs. camera-fault baseline · scale 0–4.0× · tick marks the 2.0× review threshold2 of 4 slices over threshold
Evidence-linked improvement
What overwritten footage costs
A loop ends when the overwritten footage has become a case the next release must pass. That suite is what the next confirmation given is measured against.
Improvement cycle · five stagesSwitchback — the path turns at Improve and returns at Learn
01Detect
Correction rate rises on reportable crime incidents.
02Diagnose
The twenty days that ran out before anyone asked for the recording are read back until one cause remains.
03Improve
Number the change; the incidents that drove it are filed underneath it.
04Verify
Each touched voyage case is run once more, and one red holds it back.
05Learn
It stays on as a standing test, and the notification rules move with it.
Learn → DetectThe return edge. The next sailing season is measured against a suite one case longer.
Typical build scope
Twelve workstreams across six weeks
The build scope read against the delivery timeline. Week structure follows the six-week plan — discovery, sources, record assembly, evaluation, integration, then production validation and handover.
WorkstreamWeek 1Week 2Week 3Week 4Week 5Week 6
01Reportable-incident discovery and boundary work.
02Camera, log book and access sources.
03Incident-to-footage and retention-clock mapping.
04Incident and footage ingestion.
05Incident, vessel and record binding.
06Completeness scoring and review routing.
07Security officer confirmation workflow.
08Camera and access-system integration.
09Coverage and retention cases.
10Guardrails and confirmation controls.
11Incident-trail instrumentation.
12Deployment, documentation and Agent Care handover.
12 workstreams · 6 weeks · bar shows the weeks a workstream is active — several run in parallelFinal scope and sequence confirmed in discovery
Engagement tiers
What each tier includes
Rows are the capabilities named in each tier's scope. Higher tiers include everything below them.
Capability✓ in scope · — not at this tierPilotOne vessel, one seasonProductionProduction security workflowAdvancedMultiple vessels / fleets
Introduced at Pilot
Record assembly to your incidents✓✓✓
Company security officer release✓✓✓
Surveillance-coverage baseline✓✓✓
Introduced at Production
Reporting by voyage—✓✓
Confirmation workflow in your systems—✓✓
Approved write-back—✓✓
Access-record integration—✓✓
Introduced at Advanced
Multi-vessel fleets——✓
Cross-voyage evidence packs——✓
Large camera estates——✓
Multi-authority notification controls——✓
Build priceFrom $5,000From $8,000Custom quote
Final build priceConfirmed after discovery based on integrations, workflow complexity, incident volume, approval controls and deployment requirements.
Separate from buildBuild pricing is separate from recurring Agent Care, which covers managed monitoring, evaluations, incidents and verified improvements after launch.
What we need from you
What you bring, and what we build with it
Each input maps to a piece of build scope and a week in the delivery timeline.
You bringWe build with it
01Your vessels and the decks each camera covers→Camera inventory mapping and coverage captureWeek 1
02Representative log book, camera and access records→Record binding, retention logic and the coverage baselineWeek 2
03Your reading of the 3507(a) fittings and the 3507(c) guide→Incident mapping, footage binding and the automation boundaryWeek 1
04Access to relevant APIs, feeds or exports→Camera, log book and access-source assessment, then integration setupWeek 2
05Voyages you would not want examined→Coverage cases and failure testingWeek 4
06What no security record may prove→Completeness scoring, review routing, guardrails and release controlsWeek 3
07A company security officer to confirm→Confirmation workflow, then pilot and production validationWeeks 5–6
Nothing else is requiredDeployment, documentation and Agent Care handover are ours.
Delivery timeline
Four phases across six weeks
What you see is time actually worked rather than spacing, so the fifth band has to hold two phases.
PhaseW1W2W3W4W5W6
DiscoveryW1
BuildW2 – W3
EvaluateW4 – W5
Pilot & LaunchW5 – W6
Week focusW1Security workflow discovery, incident mapping and the automation boundaryW2Source integration and the surveillance-coverage baselineW3Record assembly, retention logic and release controlsW4Evaluation suite, coverage cases and failure-mode testingW5Camera integration, pilot incidents and targeted correctionsW6One sailing season run under the company security officer, then Agent Care handover
Reading the bandEach bar covers only the weeks its own work is named for. The fifth holds a pair because the work does.
At the end of W6When the incident record validates, Agent Care takes the agent on.
DurationSix-week plan shown · typical delivery 4–6 weeks depending on scope confirmed in discovery.
Next step · Travel & Hospitality AI agent
Build a cruise security agent around the confirmation an officer gives each year.
One incident and the footage that covered it is where this starts. Show us your camera map and the decks 46 U.S.C. 3507(a) names, because no implementing regulation stands under the statute and your own procedure is the whole of it. Illness reporting is a separate clock.
