Don Billups, a church deacon and youth leader, was convicted of sexually abusing minors over the span of several years. He received two life sentences plus an additional term of 75 years in prison. One of the victims, A.H., filed this civil suit against (1) Don Billups; (2) his wife, Donna Billups; (3) the local church, Gospel Tabernacle Church of God in Christ ("Gospel Tabernacle"); and (4) the national denomination, Church of God in Christ, Inc. ("COGIC"). Among other allegations, A.H. claimed that the local church and the national denomination (collectively, the "church defendants") had known of a prior sexual-abuse allegation against Don Billups and had done nothing to warn or protect her.
The circuit court granted the church defendants' demurrers and dismissed A.H.'s amended complaint with prejudice. On appeal, A.H. contends that her factual allegations, if presumed true, state legally viable claims against the church defendants and, thus, that her case should not have been dismissed on demurrer. Finding two of her arguments persuasive, we reverse in part and affirm in part.
*465I.
A.
"Because this appeal arises from the grant of a demurrer, we accept as true all factual allegations expressly pleaded in the complaint and interpret those allegations in the light most favorable to the plaintiff." Coward v. Wellmont Health Sys. , 295 Va. 351, 358, 812 S.E.2d 766 (2018). "To survive a challenge by demurrer," however, factual allegations "must be made with 'sufficient definiteness to enable the court to find the existence of a legal basis for its judgment.' " Squire v. Virginia Hous. Dev. Auth. , 287 Va. 507, 514, 758 S.E.2d 55 (2014) (citation omitted).1 A plaintiff may rely upon inferences to satisfy this requirement, but only "to the extent that they are reasonable ." Coward , 295 Va. at 358-59, 812 S.E.2d 766 (emphasis in original). Distinguishing between reasonable and unreasonable inferences is "a context-specific task that requires the reviewing court to draw on its judicial experience and common sense," Ashcroft v. Iqbal , 556 U.S. 662, 679, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009), guided by the principle that "a well-pleaded complaint may proceed even if it strikes a savvy judge that actual proof of those facts is improbable," Bell Atl. Corp. v. Twombly , 550 U.S. 544, 556, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007).
B.
A.H. filed an initial complaint, and, with leave of court, an amended complaint against all four defendants. The circuit court granted the demurrers of Donna Billups and the church defendants and dismissed the claims against them with prejudice. In response, A.H. nonsuited her claims against Don Billups and appealed the circuit court's dismissal of her claims against the other defendants. We awarded A.H. an appeal only to address her claims against the church defendants. Our recitation of the facts, of course, restates only factual allegations that, even if plausibly pleaded, are as yet wholly untested by the adversarial process.
1. The Relationships Among the Parties
In her 35-page amended complaint, A.H. alleges that Gospel Tabernacle "at all times relevant to this action was owned, operated, managed, and/or otherwise controlled by" COGIC. J.A. at 45; see also id. at 46 (alleging that Gospel Tabernacle "has assumed the vows of membership in" COGIC); id. at 60 (alleging that COGIC "negligently supervised" Gospel Tabernacle). Gospel Tabernacle, "[a]s a local church," "is a part of the basic unit of the structural organization" of COGIC, with the former being "governed" by the latter's "Jurisdictional bishops" and "rules and regulations." Id. at 46. Gospel Tabernacle is "required to follow" COGIC's "Charter, Constitution, Laws and Doctrines." Id. Given this relationship, A.H. alleges, Gospel Tabernacle "was an agent" of COGIC. Id. at 47.
In his capacity as a church "Deacon, Youth Leader and Drill Team Coach," Don Billups2 served "as an employee and/or agent"3 of the *466church defendants. Id. at 50; see also id. at 48 (alleging that "Don Billups acted within the actual or apparent authority of" the church defendants, "who held out that [he] was a person appropriate to coach a drill team and work within the Youth Department and as a Deacon"); id. at 49 (alleging that, "[a]t all relevant times to this action, Defendant Don Billups was an agent or employee of" the church defendants and "was acting within the scope of his agency or employment").4
Donna Billups served as a "licensed missionary" for the church defendants and was responsible for, among other things, "child evangelism." Id. at 47-48 (emphasis omitted). As part of her child-evangelism responsibilities, she "assisted" her husband in coaching Gospel Tabernacle's drill team by "provid[ing] rides to children." Id. While serving in these capacities, Don and Donna Billups "were agents and/or employees acting within the scope of their agency or employment with" the church defendants. Id. at 48; see also id. at 49, 75.
Both church defendants "selected, hired, employed, retained and supervised" Don and Donna Billups. Id. at 48. "At all relevant times, the Drill Team and Youth Department were subject to the direct control and supervision of" Gospel Tabernacle "and/or" COGIC. Id. at 49. Both Don and Donna Billups "actively recruited" young people for the drill team "during church services" through announcements and other means. Id. at 50. The church defendants held Don and Donna Billups "out to their congregants and the community as their agents." Id. at 75.
2. The 2003 Sexual-Abuse Allegation
In 2003, a 13-year-old girl reported that Don Billups had sexually abused her in 2002. Testifying at Don Billups's criminal trial in 2012, Donna Billups "admitted ... that she was aware of accusations of the victim who came forward in 2003 and that she was 'aware of it when she [the victim] made it.' " Id. at 52 (alteration in original). Donna Billups testified at a bond hearing that, despite this knowledge, she had told her husband only that "he needs to ah, be more careful." Id. at 51. She "continued to allow children to be in [his] presence" and "admitted" that Don Billups had continued to "entertain[ ] children in her house on a regular basis, including on occasions when her daughters were not there." Id. She was aware that Don Billups had "made no change in his lifestyle and didn't try to stay away from young girls, be more careful, or not hang out with teenagers." Id. "Don was just being Don," she said, "Don was just doing Don." Id.
Prior to the sexual abuse of A.H. (which occurred from 2006 to 2010), Gospel Tabernacle "and/or" COGIC "became aware of" the "allegations of sexual abuse that Defendant Donald Billups committed in 2002 as the result of a criminal and/or social services investigation." Id. at 52. Despite this knowledge, the church defendants "took no action" and "continued to permit Donald Billups to have access to children as well [as] privileges and duties as a church member, Deacon, Youth Leader and Drill Team Coach, without any restrictions at all, thus sanctioning and ratifying his conduct." Id. at 53. The church defendants did nothing even though they "knew or should have known of Don Billups'[s]
*467propensities to commit harmful acts upon children," id. at 58.
3. The Sexual Abuse of A.H. and the Criminal Trial
"For the alleged purpose of furthering his assigned duties" on behalf of the church defendants, Don Billups "sought and gained the trust and friendship of Plaintiff A.H. and other children he similarly met through the church and their families." Id. at 53. The church defendants "knew or should have known that" A.H. visited the Billups residence "in conjunction with Drill Team activities and would otherwise engage in activities alone with Defendant Don Billups." Id. ; see also id. at 59 (alleging that "Don Billups gained access to Plaintiff A.H. due to the negligence and recklessness of" the church defendants). Having held Don Billups out as their agent, the church defendants "voluntarily took the custody of the minor plaintiff and subjected her to an association with Donald Billups, a person likely to harm her and therefore owed a duty to exercise reasonable care to plaintiff to prevent her from being exposed to an unreasonable risk of harm," id. at 53.
"Between 2006 and 2010," the amended complaint alleges, Don Billups sexually abused A.H. and other minors "at his home in the course of performing duties that were within the scope of his employment and/or agency with" the church defendants. Id. at 53-54. During this period, A.H. was between the ages of four and eight years old. Don Billups committed the abuse while "in execution of the services for which he was employed to perform by those same Defendants, namely as a Deacon, Youth Leader and/or Drill Team Coach." Id. at 54; see also id. at 48 ("At all relevant times to this action, [the church defendants] selected, hired, employed, retained and supervised Defendants [Don and Donna Billups] who were agents and/or employees acting within the scope of their agency or employment ...."); id. at 48-49 (alleging that Don and Donna Billups "acted within the actual or apparent authority" of the church defendants); id. at 76 (alleging that Don and Donna Billups committed tortious acts "during services that were within the ordinary course" of the church defendants' "business").
"In the Fall of 2011," the church defendants "once again became aware of additional allegations" of sexual abuse by Don Billups "of multiple other children he [had] met through the church." Id. at 56. The pastor of Gospel Tabernacle "and/or" COGIC met with one of the new victims and her family, along with Don and Donna Billups, to address the issue. Id. Following the meeting, neither of the church defendants reported the sexual-abuse allegations to law enforcement authorities, but instead they "continued to permit Donald Billups to have access to children and privileges and duties as a church member, Deacon, Youth Leader and Drill Team Coach, without restrictions at all, thus sanctioning and ratifying his conduct." Id. at 56-57.
In 2013, Don Billups was convicted "of sixteen (16) sex crimes involving minors, including Plaintiff A.H." Id. at 57. With respect to A.H., he "was charged and found guilty of object sexual penetration, aggravated sexual battery and taking indecent liberties." Id. The court imposed upon him two life sentences plus an additional term of 75 years in prison.
4. The Claims Against the Church Defendants
The amended complaint asserts various causes of action specifically against the church defendants. Count I alleges several theories of negligence liability. Count III asserts a claim for negligent infliction of emotional distress. Count VIII seeks to impose vicarious liability on the church defendants under the doctrine of respondeat superior. Finally, Count IX seeks an award of punitive damages. The circuit court dismissed each of these counts, and A.H. appealed.
II.
"The facts alleged," the circuit court held, "do not establish a cause of action against" the church defendants. Id. at 243. Because the court did not elaborate further, we will address each of A.H.'s theories of recovery separately and then determine, to the extent that any survive demurrer, whether they warrant a demand for punitive damages.
*468A. ASSUMED & SPECIAL-RELATIONSHIP DUTIES
Don Billups, not the church defendants, sexually abused A.H. The church defendants, therefore, can be directly (as opposed to vicariously) liable only if they owed a duty to protect A.H. from this abuse. "As a general rule, there is no duty to warn or protect against acts of criminal assault by third parties. This is so because under 'ordinary circumstances, acts of assaultive criminal behavior by third persons cannot reasonably be foreseen.' " Terry v. Irish Fleet, Inc. , 296 Va. 129, 135, 818 S.E.2d 788 (2018) (quoting A.H. v. Rockingham Publ'g Co. , 255 Va. 216, 222, 495 S.E.2d 482 (1998) ). "Indeed, 'in only rare circumstances has this Court determined that the duty to protect against harm from third party criminal acts exists.' " Id. (alteration omitted) (quoting Commonwealth v. Peterson , 286 Va. 349, 359, 749 S.E.2d 307 (2013) ).5
1. The Two "Rare Circumstances"
Two such rare circumstances exist that constitute exceptions to this general rule of non-liability. The first involves a defendant who expressly assumes a duty to protect another from criminal harm. See Burns v. Gagnon , 283 Va. 657, 672-73, 727 S.E.2d 634 (2012) ; Kellermann v. McDonough , 278 Va. 478, 488-90, 684 S.E.2d 786 (2009) ; Didato v. Strehler , 262 Va. 617, 627-29, 554 S.E.2d 42 (2001) ; Morris v. Peyton , 148 Va. 812, 823-24 (1927) ; Karabalis v. E.I. Dupont de Nemours & Co. , 129 Va. 151, 174, 105 S.E. 755 (1921).6 Such a duty is not inferred merely because the defendant " 'took precautions not required of it' to protect the safety of the plaintiff." Terry , 296 Va. at 137, 818 S.E.2d 788 (citation omitted) (quoting A.H. , 255 Va. at 223, 495 S.E.2d 482 ). The judicial "creation of a duty under these circumstances would discourage other parties from taking extra precautions to avoid being subjected to a liability which they otherwise would not have had." Id. at 138, 818 S.E.2d 788 (citation omitted). To find such an assumed duty to protect, an action greater than an "implied undertaking" based merely upon "voluntary conduct" is necessary. Id. at 138-40, 818 S.E.2d 788. Instead, an action tantamount to an "express communication" of a "specifically described undertaking" is required to conclude that a defendant has assumed a legal duty to protect another from a criminal assault. Id. at 140, 818 S.E.2d 788.
The second rare exception to the general rule involves a duty not assumed but *469imposed. The common law recognizes a duty to protect when a special relationship exists "(1) between the defendant and the third person which imposes a duty upon the defendant to control the third person's conduct, or (2) between the defendant and the plaintiff which gives a right to protection to the plaintiff." Brown v. Jacobs , 289 Va. 209, 215, 768 S.E.2d 421 (2015) (alteration and citation omitted); Burns , 283 Va. at 668-69, 727 S.E.2d 634 (citation omitted); Commonwealth v. Burns , 273 Va. 14, 18, 639 S.E.2d 276 (2007) (citation omitted); Burdette v. Marks , 244 Va. 309, 312, 421 S.E.2d 419 (1992).7 The duty is not absolute, however. It only exists when the defendant could have foreseen the need "to take affirmative action to protect [the plaintiff] from harm." Burns , 283 Va. at 669, 727 S.E.2d 634 (citation omitted).
The degree of foreseeability required "depends on the nature of the special relationship" because "[w]e have recognized two levels of foreseeable harm." Peterson , 286 Va. at 357, 749 S.E.2d 307 ; see, e.g. , Wright v. Webb , 234 Va. 527, 532, 362 S.E.2d 919 (1987) ("[A] business invitee does not entrust his safety to a business invitor to the same extent a passenger does to a common carrier."). See generally K.L. ex rel. Lawson v. Jenkins , Record No. 130786, 2014 WL 11398624, at *1 n.1 (Va. May 9, 2014) (unpublished) (describing the two levels of foreseeability); Sinclair, supra note 6, § 25-8, at 25-62 to -63 (same).
For example, a special relationship exists between a business owner and an invitee. See Terry , 296 Va. at 136 n.3, 818 S.E.2d 788.8 In that scenario, the duty to protect exists "only when there [is] an imminent probability of injury from a third party act." Id. (citing Wright , 234 Va. at 533, 362 S.E.2d 919 ); see 2 Dobbs et al., supra note 6, § 416, at 711 & n.11 (2d ed. 2011) (placing Virginia among jurisdictions that "continue to limit liability to such cases of imminent harm, and to those in which the defendant's method of doing business attracts crime").
On the other hand, a special relationship also exists between an innkeeper and a guest, a common carrier and a passenger, and an employer and an employee. See Terry , 296 Va. at 136 n.3, 818 S.E.2d 788. The duty to protect in these contexts arises if the danger is either "known or reasonably foreseeable" to the defendant. Id. (citing Taboada v. Daly Seven, Inc. , 271 Va. 313, 325-26, 626 S.E.2d 428 (2006) (innkeeper-guest), aff'd on reh'g , 273 Va. 269, 641 S.E.2d 68 (2007) ; A.H. , 255 Va. at 220, 495 S.E.2d 482 (employer-employee); Connell v. Chesapeake & Ohio Ry. , 93 Va. 44, 62, 24 S.E. 467 (1896) (common carrier-passenger)); see 2 Dobbs et al., supra note 6, § 416, at 712 & n.19 (2d ed. 2011). In no scenario, however, does the special-relationship *470doctrine impose anything akin to strict liability, and thus, even when applicable, the doctrine "does not make the defendant an insurer of the plaintiff's safety," Taboada , 271 Va. at 323, 626 S.E.2d 428.9
The employer-employee relationship involves additional qualifications. In A.H. , we recognized a special relationship between an employer and an employee "with regard to the employer's potential duty of protecting or warning an employee." 255 Va. at 220, 495 S.E.2d 482 (citing Restatement (Second) of Torts § 302B cmt. e(B) (1965)). Focusing our analysis on the facts of that case, we addressed this duty only in the context of protecting an employee from a third party's intentional or criminal acts, not from a third party's negligence - as our reliance on a Restatement provision with this limited scope implies. See Restatement (Second) of Torts § 302B & cmt. e(B) (applying the duty to protect an employee only in the context of intentional or criminal conduct of a third party).
Though we have recognized a limited, special-relationship duty on the part of an employer to protect an employee against a third party's intentional or criminal conduct, we have not to date recognized the inverse: a special-relationship duty on the part of the employer to control his employee so as to prevent the employee from harming third parties. We are aware that Restatement (Second) of Torts § 317 describes a duty on the part of an employer to control his employee "to prevent him from intentionally harming others or from so conducting himself as to create an unreasonable risk of bodily harm to them." Our precedent, however, has held that an employer has no general duty to supervise one employee to protect another employee from intentional or negligent acts. See infra at 475 (citing, inter alia, Chesapeake & Potomac Tel. Co. of Va. v. Dowdy , 235 Va. 55, 61, 365 S.E.2d 751 (1988) ). It seems incongruent that an employer would owe a duty to third parties that he does not owe to his own employees - particularly given that the interests of third parties are protected under Virginia law by traditional respondeat superior principles and the torts of negligent hiring and negligent retention, see infra at 473-75, 477.
Virginia law does recognize, however, that a special relationship exists between a vulnerable individual in a custodial relationship and his or her custodian. That relationship, if proven, imposes a duty of reasonable care upon the custodian to protect the vulnerable individual in his custody. See Delk v. Columbia/HCA Healthcare Corp. , 259 Va. 125, 132-36, 523 S.E.2d 826 (2000) (reversing a trial court's decision to sustain demurrers when the plaintiff had alleged that she required 24-hour supervision from a psychiatric hospital and that the hospital had also taken charge of and exercised control over her assailant);10
*471Doe v. Bruton Parish Church , 42 Va. Cir. 467, 472-73 (1997) (Lemons, J.) (recognizing that a special relationship exists when a minor is placed in the custody of a church childcare provider).11 See generally Restatement (Second) of Torts § 320 & cmts. a-b & d (describing the duties arising when one individual "takes the custody of another"); Restatement of Torts § 320 & cmts. a-b & d (1934) (same); 2 Dobbs et al., supra note 6, § 418, at 727-34 (2d ed. 2011 & Supp. 2019) (discussing the duties attendant upon a custodial relationship); 3 Fowler V. Harper et al., Harper, James and Gray on Torts § 18.7, at 915-16 (3d ed. 2007) (same); Prosser & Keeton, supra note 5, § 56, at 376-77, 383 (describing the application of the special-relationship doctrine).12
2. The Church Defendants & The Assumed Duty to Protect
A.H.'s amended complaint asserts that the church defendants "expressly assumed a duty of supervision of church workers and activities in its sexual harassment/misconduct policy." J.A. at 47. In reviewing this assertion, however, we must "distinguish allegations of historical fact from conclusions of law. We assume the former to be true arguendo , but we assume nothing about the correctness of the latter because 'we do not accept the veracity of conclusions of law camouflaged as factual allegations or inferences.' " Sweely Holdings, LLC v. SunTrust Bank , 296 Va. 367, 371, 820 S.E.2d 596 (2018) (emphasis in original) (citation omitted). The point is particularly important here because the ultimate question "[w]hether a legal duty in tort exists is a pure question of law to be reviewed de novo," Brown , 289 Va. at 215, 768 S.E.2d 421 (citation omitted).
We cannot accept A.H.'s conclusion of law - that the church defendants assumed a legal duty to protect her - because her factual allegations do not assert that these defendants made any clear communication to her of a "specifically described undertaking" to do so, Terry , 296 Va. at 140, 818 S.E.2d 788. At best, A.H. merely alleges that these defendants " 'took precautions not required of [them]' to protect the safety of the plaintiff." Id. at 137, 818 S.E.2d 788 (quoting A.H. , 255 Va. at 223, 495 S.E.2d 482 ). And the sole precaution identified in the amended complaint is the church defendants' internal "sexual harassment/misconduct policy," J.A. at 47, which A.H. further alleges was never "disseminate[d] ... to the membership family of COGIC," id. at 63.
An assumed duty to protect cannot be predicated solely upon an uncommunicated "implied undertaking" that is itself based entirely upon "voluntary conduct." Terry , 296 Va. at 138-40, 818 S.E.2d 788. Instead, there must be a clear expression of intent by a *472defendant to take on a legal duty to protect a plaintiff who is justifiably relying upon that clearly expressed intent. It is not reasonable to infer such intent merely from a defendant's adoption of an internal, sexual-harassment and misconduct policy. If merely creating such a policy were enough, standing alone, to impose legal liability where none previously existed, the law would provide a disincentive for employers to adopt and implement such policies.
3. The Church Defendants & The Special-Relationship Doctrine
A.H. claims that the church defendants "voluntarily took the custody of the minor plaintiff and subjected her to an association with Donald Billups, a person likely to harm her, and therefore owed a duty to exercise reasonable care to plaintiff to prevent her from being exposed to an unreasonable risk of harm." J.A. at 53. According to A.H., it was while she was in the custody of the church defendants that Don Billups sexually abused her - an outcome that the church defendants knew or should have known might occur based upon the earlier 2003 allegation of sexual abuse against him.
The sexual abuse occurred, A.H. alleges, at the Billups residence over the course of four years while A.H. was between the ages of four and eight years old. According to the amended complaint, the church defendants "knew or should have known that Plaintiff A.H. visited the Billups's residence in Covington, Virginia in conjunction with Drill Team activities and would otherwise engage in activities alone with Defendant Don Billups." Id. The amended complaint adds:
• The church defendants "actively recruited members and participants for Drill Team during church services and through bulletins, mass announcements, and other similar means." Id. at 50.
• The church defendants "held out that Donald Billups was a person appropriate to coach a drill team and work within the Youth Department and as a Deacon." Id. at 48.
• The church defendants "held Defendants Donna Billups and Don Billups out to their congregants and the community as their agents." Id . at 75.
• "At all relevant times, the Drill Team and Youth Department were subject to the direct control and supervision" of the church defendants. Id. at 49.
• "At all relevant times to this action, Defendant Don Billups was an agent or employee" of the church defendants and "at all relevant times, was acting within the scope of his agency or employment with" the church defendants. Id.
• "Defendants voluntarily took the custody of the minor plaintiff and subjected her to an association with Donald Billups, a person likely to harm her and therefore owed a duty to exercise reasonable care to plaintiff ...." Id. at 53.
• "Between 2006 and 2010, when Plaintiff A.H. was a minor, Defendant Don Billups sexually abused her and others at his home in the course of performing duties that were within the scope of his employment and/or agency with [the church defendants] and in execution of the services for which he was employed to perform by those same Defendants, namely as a Deacon, Youth Leader and/or Drill Team Coach." Id. at 53-54.
• "Defendant Don Billups sexually abused children, including Plaintiff A.H., he had come into contact with and gained the trust and friendship of through his position as [the church defendants'] Deacon, Youth Leader and/or Drill Team coach." Id. at 54.
Based upon these allegations, A.H. claims that the church defendants breached their duty to her
by failing to exercise reasonable care in the protection of Plaintiff A.H. from Defendant Don Billups whom Defendants knew or should have known was likely to cause bodily harm to others if not controlled, after having voluntarily undertaken custody and/or control of the child as part of the Drill Team and/or Youth Department.
We find these allegations sufficient to state a claim for negligence based upon a special-relationship duty of the church defendants to protect A.H., a minor, from sexual abuse by their alleged employee and agent, Don Billups, while she was in their custody.14 The circuit court thus erred in finding these allegations insufficient to survive the church defendants' demurrers regarding the special-relationship theory of tort liability.
B. NEGLIGENT HIRING, RETENTION, & SUPERVISION
A.H. also alleges that the church defendants negligently hired, retained, and supervised Don Billups as a deacon, youth leader, and drill team coach after receiving actual or constructive knowledge "of his propensities for improper sexual activity involving children and unfitness to have continued access to children." Id. at 60. "This Court has recognized the independent tort of negligent hiring" and "also has recognized the independent tort of negligent retention." Southeast Apts. Mgmt., Inc. v. Jackman , 257 Va. 256, 260, 513 S.E.2d 395 (1999). See generally Friend, supra note 6, §§ 26.1-.3, at 669-71 (3d ed. 2003); Sinclair, supra note 6, § 26-1, at 26-1 to -13. These torts involve claims of direct, not indirect, liability and are separate from respondeat superior claims. See Parker v. Carilion Clinic , 296 Va. 319, 348 n.15, 819 S.E.2d 809 (2018) (collecting cases and treatises); J. v. Victory Tabernacle Baptist Church , 236 Va. 206, 211, 372 S.E.2d 391 (1988).
1. Negligent Hiring
Liability for negligent hiring "is based on the principle that one who conducts an activity through employees is subject to liability for harm resulting from the employer's conduct if the employer is negligent in the hiring of an improper person in work involving an unreasonable risk of harm to others" and on the employer's negligence "in placing a person with known propensities, or propensities which should have been discovered by reasonable investigation, in an employment position in which, because of the circumstances of the employment, it should have been foreseeable that the hired individual posed a threat of injury to others." Jackman , 257 Va. at 260, 513 S.E.2d 395 (citation omitted); see also Interim Pers. of Cent. Va., Inc. v. Messer , 263 Va. 435, 440, 559 S.E.2d 704 (2002). "[T]he plaintiff must show that an employee's propensity to cause injury to others was either known or should have been discovered by reasonable investigation." Majorana v. Crown Cent. Petroleum Corp. , 260 Va. 521, 531, 539 S.E.2d 426 (2000) ; see also Friend, supra note 6, § 26.2, at 670 (3d ed. 2003); Sinclair, supra note 6, § 26-1[B], at 26-5.
In the present case, even assuming that A.H.'s allegations of Don Billups's employment and/or agency on behalf of the church defendants are true, A.H. does not allege that the church defendants knew or should have known of his alleged propensities to *474engage in sexual activity with minors when they hired him as a deacon, youth leader, and drill team coach. A.H. only alleges that the church defendants "knew or should have known of Don Billups'[s] propensities to commit harmful acts upon children," J.A. at 58, without alleging that the church defendants knew or should have known of such propensities when they employed Don Billups.
A.H. further alleges that Don Billups had been a deacon "[f]or at least fifteen (15) years" prior to her amended complaint (filed in 2015) and that Don Billups started the drill team "[s]ometime after becoming a deacon." Id. at 49. Her only specific allegation regarding the timing of the church defendants' actual or constructive knowledge is that, "[u]pon information and belief, prior to Defendant Donald Billups'[s] abuse of plaintiff A.H.," the church defendants, along with Donna Billups, "became aware of" the 2003 allegation through "a criminal and/or social services investigation." Id. at 52.
In other words, A.H.'s only allegation regarding the timing of the church defendants' knowledge is that the church defendants became aware of an allegation of sexual abuse that had occurred in 2002 sometime before the abuse of A.H. began in 2006. The amended complaint contains no allegations that, at the time the church defendants hired Don Billups as a deacon and later as a drill team coach, they knew or had any reason to know of any of his dangerous propensities. Cf. Victory Tabernacle Baptist Church , 236 Va. at 211, 372 S.E.2d 391 (reversing a grant of a demurrer in a "negligent hiring" case involving a church that hired a sex offender who later sexually abused a 10-year-old parishioner). The allegations fail to assert facts sufficient to state a claim for negligent hiring.
2. Negligent Retention
In Virginia, a claim for negligent retention exists "for harm resulting from the employer's negligence in retaining a dangerous employee who the employer knew or should have known was dangerous and likely to harm [others]." Jackman , 257 Va. at 260-61, 513 S.E.2d 395 ; see also Barrett v. Applied Radiant Energy Corp. , 240 F.3d 262, 269 (4th Cir. 2001) (applying Virginia law). The allegations and eventual proof must show that the employer was "negligent in failing to terminate," Philip Morris Inc. v. Emerson , 235 Va. 380, 401, 368 S.E.2d 268 (1988), the "dangerous employee," Jackman , 257 Va. at 260-61, 513 S.E.2d 395.15
The negligent-retention tort differs from the special-relationship theory of recovery because the former requires a showing that the risk of future harm was so grave that discharging the dangerous employee would have been the only reasonable response. The special-relationship duty to protect, if the facts were egregious enough, could warrant the same conclusion. But the duty to protect could also be satisfied upon a showing that lesser measures were equally reasonable in mitigating the risk of future harm.16 Unlike the special-relationship theory of recovery, however, a prima facie case of negligent retention requires an amplified showing that both the nature and gravity of the risk render unreasonable any mitigating response short of termination.
We agree with the circuit court that the allegations in the amended complaint do not support the legal conclusion that the church defendants negligently retained Don Billups. The church defendants, according to A.H., knew of the 2003 sexual-abuse allegation against Don Billups. But the amended complaint *475does not assert any specifics about the allegation or how, if at all, any social services or law enforcement authorities resolved it. We do not believe that this prior allegation, given its vague description in the amended complaint and the absence of any assertion that the responsible authorities had verified it, was enough, standing alone, to trigger a legal duty to terminate Don Billups from any employment or agency relationship that he had with the church defendants. Because of this lack of specificity in the allegations, we hold that the circuit court correctly sustained the church defendants' demurrers with respect to the claim for negligent retention.
3. Negligent Supervision
The circuit court also correctly held that A.H.'s claim for negligent supervision, as a free-standing cause of action, could not survive demurrer. "In Virginia, there is no duty of reasonable care imposed upon an employer in the supervision of its employees under these circumstances and we will not create one here." Dowdy , 235 Va. at 61, 365 S.E.2d 751 ; see also Williams v. Shall , Record No. 120889, 2013 Va. Unpub. LEXIS 1, at *3 (June 6, 2013) ("Virginia does not recognize a claim for negligent supervision."); Eley v. Evans , 476 F. Supp. 2d 531, 532 n.3 (E.D. Va. 2007) ("[F]ederal and Virginia courts have held that Virginia does not recognize negligent supervision as a valid cause of action."). A.H.'s allegations of negligence, therefore, cannot be predicated upon a stand-alone theory that the church defendants owed her a duty to supervise Don Billups.
C. NEGLIGENCE PER SE
A.H. also alleges that the church defendants are liable for "negligence per se for violating Virginia's mandated reporting laws of child abuse" because they "fail[ed] to report suspected abuse after [they] knew and/or had reason to suspect, by and through their employees and/or agents, including Defendant Donna Billups, a licensed missionary, that Defendant Don Billups sexually assaulted children prior to his abuse of Plaintiff A.H." J.A. at 63. See generally Code §§ 63.2-100, -1508 to -1511. The circuit court correctly held that these allegations do not state a claim for negligence per se.
As we explained in Parker , negligence per se only exists "where there is a common-law cause of action . The doctrine of negligence per se does not create a cause of action where one did not exist at common law." 296 Va. at 345, 819 S.E.2d 809 (emphases in original) (citation omitted). Put another way, the negligence per se "doctrine does not create a duty of care" but "merely sets a standard of care by which the defendant may be judged in the common-law action," and thus, "[t]he absence of an underlying common-law duty renders the presence of a statutory standard of care irrelevant." Id. See generally Sinclair, supra note 6, § 25-4[A], at 25-25 to -26.
A.H. alleges no common-law duty to report suspected child abuse. Instead, she relies exclusively upon the Virginia reporting statutes as both creating the duty and setting the standard of care. We have expressly rejected the proposition "that a statute setting a standard of care also creates the duty of care." Parker , 296 Va. at 346, 819 S.E.2d 809 (citation omitted). Without a common-law antecedent to the duty to report suspected child abuse, A.H.'s negligence per se claim against the church defendants cannot survive demurrer.
D. NEGLIGENT INFLICTION OF EMOTIONAL DISTRESS
In this case, A.H.'s allegations of emotional injuries are subsumed within her special-relationship claim, see supra at 472-73, and her respondeat superior claim, see infra at 477, that we hold have been properly asserted. A.H. may recover damages for emotional distress only in relation to these claims. A negligence cause of action for emotional distress does not exist in the abstract:
If everyone was allowed damages for injuries to his feelings caused by someone else, the chief business of mankind might be fighting each other in the courts. Damages for mental suffering open into a field without boundaries, and there is no principle by which the court can limit the amount of damages.
Ruth v. Fletcher , 237 Va. 366, 372-73, 377 S.E.2d 412 (1989) (quoting *476Bowles v. May , 159 Va. 419, 433-34, 166 S.E. 550 (1932) ). While "a duty to exercise reasonable care when the actor's conduct creates a risk of physical harm" has a long history in the common law, "no equivalent proposition ever has been adopted with respect to emotional harm. Nor, given the ubiquity of emotional harms, is it likely to be." 2 Dobbs et al., supra note 6, § 390, at 571 (2d ed. 2011) (citation omitted).
It is thus with considerable caution that, on this subject, we "keep one eye on the theoretical, and the other on the practical." Bowles , 159 Va. at 434, 166 S.E. 550 (citation omitted). Both of these views require a showing of an underlying tort duty as the predicate for making a claim for the negligent infliction of emotional distress. See Gray v. INOVA Health Care Servs. , 257 Va. 597, 599-600, 514 S.E.2d 355 (1999) (rejecting a claim for negligent infliction of emotional distress absent a showing that the defendant "owed a duty of care" to the plaintiff); Chizmar v. Mackie , 896 P.2d 196, 203 (Alaska 1995) ("[W]e believe that a plaintiff's right to recover emotional damages caused by mere negligence should be limited to those cases where the defendant owes the plaintiff a preexisting duty.").17 See generally Sinclair, supra note 6, § 16-3, at 16-15 to -16.18
This principle tracks the ancient concept, deeply embedded in Virginia law, that "[a]n action for negligence only lies where there has been a failure to perform some legal duty which the defendant owes to the party injured." Balderson v. Robertson , 203 Va. 484, 487, 125 S.E.2d 180 (1962) (quoting Williamson v. Southern Ry. , 104 Va. 146, 149, 51 S.E. 195 (1905) ). "[T]here is no such thing as negligence in the abstract, or in general, or as sometimes is said, in vacuo." Kent v. Miller , 167 Va. 422, 425-26, 189 S.E. 332 (1937). This statement is true for negligent infliction of emotional distress no less than it is for negligent infliction of physical injury or death. To be sure, "[t]he question of liability for negligence cannot arise at all until it is established that the [person] who has been negligent owed some duty to the person who seeks to make him liable for his negligence."
*477Dudley v. Offender Aid & Restoration of Richmond, Inc. , 241 Va. 270, 277, 401 S.E.2d 878 (1991) (quoting Le Lievre v. Gould [1893] 1 Q.B. 491 at 497 (Eng.) (opinion of Esher, M.R.)).
In this case, A.H. may recover emotional-distress damages at trial only upon a showing that the defendants were negligent - which necessarily requires a showing of a breach of an underlying tort duty of care. In this case, we recognize that the amended complaint plausibly alleges facts supporting two such duties: the duty of care arising out of the special relationship of custodian and child, see supra at 472-73, and the duty of care vicariously imposed by the doctrine of respondeat superior, see infra at 477. A.H. may recover emotional-distress damages, if at all, only upon proof that the defendants breached one of these two duties.
E. VICARIOUS TORT LIABILITY : RESPONDEAT SUPERIOR
A.H. argues that her amended complaint states a prima facie case of vicarious liability against the church defendants under the doctrine of respondeat superior. We recently surveyed the law on this subject and reaffirmed that a rebuttable presumption that an employee was acting within the scope of his employment arises when the plaintiff alleges an employment relationship. See Parker , 296 Va. at 332-33, 819 S.E.2d 809. "This presumption shifts the burden of production to the employer to present facts sufficient to permit the factfinder to conclude that the employee was not acting within the scope of his employment at the time of his tortious conduct" even though "[t]he burden of persuasion stays with the employee from the start." Id. at 333 n.6, 819 S.E.2d 809. This presumption applies at the outset of the case, "begin[ning] with the complaint, not the presentation of evidence at trial." Id. at 334, 819 S.E.2d 809.
We held in Parker that the plaintiff was entitled to this presumption because of her allegation of an employment relationship, but we reiterated that "the service itself , in which the tortious act was done," must be "within the ordinary course of the employer's business." Id. at 336, 819 S.E.2d 809 (emphasis in original) (alteration and citation omitted). Thus, the tortious act must occur "while the employee was in fact performing a specific job-related service for the employer" and must be "within the scope of the duties of the employment and in the execution of the service for which the employee was engaged." Id. at 338-39, 819 S.E.2d 809 (emphases in original) (citation omitted).
We reach the same conclusion here. A.H. alleges that Don Billups was an employee or agent of the church defendants. She is therefore entitled to the rebuttable presumption that he was acting within the scope of his employment when he sexually abused her. A.H. enhances that presumption by specifically alleging that Don Billups abused her "in the course of performing duties that were within the scope of his employment and/or agency with [the church defendants] and in execution of the services for which he was employed to perform by those same Defendants, namely as a Deacon, Youth Leader and/or Drill Team Coach." J.A. at 53-54; see also id. at 76 (alleging that the church defendants are vicariously liable for Don and Donna Billups's actions "committed during services that were within the ordinary course of [the church defendants'] business and Defendants Donna and Don Billups'[s] agency and/or employment"); supra at 465-67 (detailing other allegations that Don and Donna Billups were, at all relevant times, acting as employees or agents of the church defendants). We conclude that these allegations, which we assume to be true, are sufficient to survive demurrer.19
*478F. PUNITIVE DAMAGES
A.H. seeks punitive damages from the church defendants based upon all of her theories of liability. We agree with the circuit court that the amended complaint lacks sufficient factual allegations to justify a claim for punitive damages under any of these theories.
1. Vicarious Tort Liability - Respondeat Superior
In the respondeat superior context, "punitive damages cannot be awarded against a master or principal for the wrongful act of his servant or agent in which he did not participate, and which he did not authorize or ratify." Egan v. Butler , 290 Va. 62, 74, 772 S.E.2d 765 (2015) (citation omitted). In other words, "punitive damages may be awarded against a corporate employer only if either (1) that employer participated in the wrongful acts giving rise to the punitive damages, or (2) that employer authorized or ratified the wrongful acts giving rise to the punitive damages." Id. ; 1 Friend & Sinclair, supra note 7, § 23.05[2], at 23-40; Sinclair, supra note 6, § 3-4[B], at 3-47 to -48; Kent Sinclair & Leigh B. Middleditch, Jr., Virginia Civil Procedure § 3.2[F], at 40 (6th ed. Supp. 2018-2019).
A.H. does not allege that the church defendants participated in or authorized the sexual abuse that she endured. She does, however, allege that the church defendants "ratified" Don Billups's conduct. J.A. at 59, 65, 77. She draws this conclusion from the allegation that the church defendants
took no action against Donald Billups to report [the prior sexual-abuse] allegations to legal authorities and they continued to permit Donald Billups to have access to children as well [as] privileges and duties as a church member, Deacon, Youth Leader and Drill Team Coach, without any restrictions at all, thus sanctioning and ratifying his conduct.
Id. at 53. She further alleges that the church defendants "acted wantonly, oppressively, or with such recklessness or negligence as evinced a conscious disregard of [her] rights ... and/or with such malice as implied a spirt of mischief, or criminal indifference to civil obligations." Id. at 64.
Like the circuit court, we find these conclusory allegations to be lacking in "sufficient definiteness," see supra at 465 & n.1, to justify a claim for punitive damages. At best, A.H. alleges that the church defendants knew or should have known that Don Billups was likely to abuse her just as he had allegedly abused another child in 2002. Based upon that knowledge, A.H. concludes, the church defendants should have done something to protect her. As observed earlier, see supra at 472-73, that factual sequence may support A.H.'s claim that the church defendants breached a special-relationship duty to protect her. However, it is implausible to infer from her factual allegations that the church defendants acted in such a manner as to ratify the alleged sexual abuse. See Black's Law Dictionary 1513 (11th ed. 2019) (defining "ratification" as "[c]onfirmation and acceptance of a previous act, thereby making the act valid from the moment it was done," or, "[t]he affirmance of someone's prior act, whereby the act is given the same effect as if it had been done by an agent acting with actual authority").20 Ratification implies approval, confirmation, and acceptance. No factual *479allegations in the amended complaint permit such an unreasonable inference.
2. Direct Tort Liability - Special-Relationship Negligence
We reach the same conclusion regarding A.H.'s request for punitive damages for the church defendants' alleged breach of their direct tort duties associated with her special-relationship theory of recovery. Under the common law, "[p]unitive or exemplary damages are allowable only where there is misconduct or actual malice, or such recklessness or negligence as to evince a conscious disregard of the rights of others." Xspedius Mgmt. Co. of Va., L.L.C. v. Stephan , 269 Va. 421, 425, 611 S.E.2d 385 (2005) (quoting Giant of Va., Inc. v. Pigg , 207 Va. 679, 685, 152 S.E.2d 271 (1967) ). "We have repeatedly stated that an award of punitive damages is not favored generally because punitive damages are in the nature of a penalty and should be awarded only in cases involving the most egregious conduct." Bowers v. Westvaco Corp. , 244 Va. 139, 150, 419 S.E.2d 661 (1992).21 For this reason, "[w]here the act or omission complained of is free from fraud, malice, oppression, or other special motives of aggravation, damages by way of punishment cannot be awarded, and compensatory damages only are permissible." Stephan , 269 Va. at 425, 611 S.E.2d 385 (quoting Wright v. Everett , 197 Va. 608, 615, 90 S.E.2d 855 (1956) ).22
The amended complaint sufficiently pleads a negligence claim arising out of the special relationship between the church defendants and A.H., a minor in their custody. But the factual allegations supporting this claim do not support a reasonable inference that the church defendants' acts or omissions were "so willful or wanton as to evince a conscious disregard of the rights of others" or that the church defendants "consciously and intentionally did some wrongful act or omitted some known duty which produced the injurious result," Bowers , 244 Va. at 150, 419 S.E.2d 661 (citations omitted). Any conclusory allegations that the church defendants acted wantonly, oppressively, or with criminal indifference have no factual support, and we find them to be "strained, forced, [and] contrary to reason," Sweely Holdings, LLC , 296 Va. at 371, 820 S.E.2d 596 (citation omitted).
III.
In sum, we reverse the circuit court's dismissal of A.H.'s claim asserting negligence based upon a special relationship between her and the church defendants. We also reverse the court's grant of the church defendants' demurrers to A.H.'s respondeat superior claim. If successful on either of these claims, A.H. may recover compensatory damages (including damages for emotional distress) but not punitive damages. We further hold that the circuit court properly dismissed A.H.'s claims for negligent hiring, retention, and supervision, as well her claim for negligent infliction of emotional distress as a stand-alone tort. Finally, we hold that the circuit court correctly dismissed her claims for punitive damages. We remand this case to the circuit court for further proceedings consistent with this opinion.23
*480Reversed in part, affirmed in part, and remanded.