Ask a head of reinsurance what worries them about automation on the ceded side and it is rarely the arithmetic. It is the email to a reinsurer that should not have gone, the chaser in the wrong tone to a lead who is already annoyed, the statement issued for a period that was not finished. Those are the acts that reach the panel, and they are the ones that cannot be taken back by a correcting entry.
So the design starts from the act, not from the model. Every agent in InsightCede prepares: it reads the ledger, writes a decision record with its evidence and a proposal, and stops. A person answers it. How much an agent may do without waiting for that answer is a setting per agent, per action and per line of business, and it moves only when the answers say it should.
Four levels, and the lowest one wins
Every action an agent can take sits at one of four levels. The level that actually applies
to a given run is not the one somebody set on the agent; it is the lowest of three things:
the level the checkpoint itself allows, the level set for that agent on that action and that
line, and the tenant ceiling, which is an environment setting
(CEDE_AGENTS_MAX_LEVEL) and defaults to L2. An agent whose kill switch is off
drafts only, on every action and every line, at once.
flowchart TD
R["An agent has prepared
a decision"] --> K{"Kill switch"}
K -->|"off"| D1["L1 Draft on every
action and line"]
K -->|"on"| M["Lowest of: the checkpoint rule,
the agent's level for this action and line,
the tenant ceiling (default L2)"]
M -->|"L1 or L2"| Q["Waits in the queue
any send stays held"]
M -->|"L3"| W["Owner told; released when
the pull-back window closes"]
M -->|"L4"| A["Released at once"]
Q --> P["A person answers:
Accept, Change, Reject or Ask"]
W -->|"pulled back"| Q
style D1 fill:#fdecec,stroke:#eab6b6
style Q fill:#fff4e6,stroke:#f0cb9a
style P fill:#e6f7f2,stroke:#9fd8c9
| Level | What the agent does | Who is told | How it is undone | Used in Cede on day one |
|---|---|---|---|---|
| L1 · Draft | Prepares a draft. Accepting it records agreement; nothing is applied unless the person asks the agent to act. | The queue | Nothing to undo | Proposals: programme gaps, renewal packs, slips, anomalies, exhaustion, reconciliation, credit, Schedule F, escalation |
| L2 · Ask first | Prepares the decision. Accepting applies it: a held send is released, a strike generates the bordereaux. | The queue | Reject cancels the held send | Everything that reaches the panel, and the cession explanations |
| L3 · Act and tell | Acts, inside a pull-back window (60 minutes by default). | The owner, at once | Pull back inside the window: the send is cancelled and the decision reopens at L2 | Nothing — above the default ceiling |
| L4 · Act | Releases at once. | — | Not by a window | Nothing |
Day one is deliberately conservative: L1 for anything that proposes, L2 for anything that would reach a reinsurer. Nothing in the catalogue starts at L3. Those defaults are the product's behaviour before anyone has answered anything, so turning the dial on does not change what happens until a person changes it.
What “held” means
Anything an agent would send — a large-loss notice, a cash call, a reinstatement premium notice, a statement, a chaser — is written to the communications outbox with the status held. The outbox worker only picks up pending or failed rows, so a held message cannot leave from any server by accident. There is exactly one way out, a release, and it happens in two places: when a person accepts the decision, or when an L3 pull-back window closes without anyone pulling it back. A reject or a pull-back cancels the message.
stateDiagram-v2
[*] --> Held: the agent writes the message
Held --> Released: accepted, or the L3 window closed
Held --> Cancelled: rejected, or pulled back in the window
Released --> Delivered: production only
Released --> DryRun: outside production
Delivered --> [*]
DryRun --> [*]
Cancelled --> [*]
Outside production nothing is delivered at all. The process switches the dry-run flag on
unless the environment says production or someone opts in with
CEDE_COMMS_LIVE=1. The send account an agent uses on a new install is a dry-run
account created for it, until an administrator adds a real one.
Grounded or blank: what a missing contact does
In the demo ledger the collections agent has prepared a chaser to Munich Reinsurance America for $15,730,529 across four recoverables, thirteen days late. Its evidence includes the line “rated A+, collateral $0, contact none on file”, and the proposal's recipients list is empty. With no addressee there is nothing to hold, so no outbox row was written at all. The agent did not guess an address from the reinsurer's name. The fix is to record the contact on the reinsurer; the next run prepares the chaser again and supersedes the old one because the proposal changed.
One flow, end to end
The chaser is the clearest example, because it is the agent with the most answers on a busy desk and the one carriers most often want to let run.
| Use case details | Collections chaser |
|---|---|
| Trigger | The scheduled settlement run finds a reinsurer with recoverables past their due date |
| Actor(s) | The collections agent; the ceded analyst who answers; a manager for an escalation |
| Agent | collections_agent |
| Grounded in | cede_recoverable (billed, outstanding, due), cede_reinsurer (contact, rating, collateral), Pulse news signals |
| Prepares | A chaser per reinsurer with its tone and the money by item; an escalation proposal where a reminder is not enough |
| Checkpoint & default level | chaser_send at L2 Ask first; collection_escalate at L1 Draft |
| What a person decides | Accept (released), Change (edited, then released), Reject (cancelled), or Ask (a question back, no feedback) |
| What is recorded | The decision row, the held message, the person's answer and any change, feedback against the agent and action, and the run row with model, prompt version and cost |
The evidence that moves the dial
A person's answer to a prepared decision is feedback, attributed to the agent and action behind the checkpoint and to the line the decision was about. Every fifteen minutes the housekeeping job rolls up the last thirty days of answers and does one of three things for each agent, action and line.
| Rule | Threshold | Minimum answers | What happens |
|---|---|---|---|
| Promotion | ≥ 90% agreement | ≥ 50 in 30 days | Recommended, one level up. A manager accepts it; nothing moves by itself. Above the ceiling, the recommendation says so and waits. |
| Demotion | < 70% agreement | ≥ 20 in 30 days | Applied at once, one level down, audited, managers notified. Not repeated automatically for 7 days. |
| Kill switch | — | — | L1 on every action and line, at once, with a reason recorded |
| Neither | anything between | — | A sentence saying where the agent stands and how many more agreed answers it needs |
Two details in how agreement is counted matter more than the thresholds. Agreement is accepts divided by accepts, changes and rejects — so a Change counts against the agent, even when the person only softened a sentence. And an Ask records nothing, because a question is not an answer. The effect is a dial that is slow to rise and quick to fall, which is the right shape for acts that reach a counterparty.
Promotion is a recommendation a manager accepts. Demotion is immediate. The asymmetry is the point.
Nothing in that sequence required anyone to trust the model. It required fifty answers, a manager's acceptance and a ceiling the carrier controls, and it unwound by itself when the answers stopped agreeing.
Where the demo stands today
Those figures are the demo programme's, read from the live API: a demo US property-casualty carrier, not a customer. The metrics endpoint reports 36 decisions prepared in the window and none accepted yet, so agreement reads as a dash rather than a number. No agent has evidence to move on, and none has ever been promoted.
What it does not do
- Agreement is not correctness. The dial measures whether the people answering agreed with the agent, not whether the agent was right. A desk that accepts everything will promote an agent that is wrong in ways nobody checks. Counting a Change against the agent makes that harder, not impossible; the review of what the agent proposes is still a person's job.
- The thresholds are not set on the page. 90% over 50, 70% over 20, a 30-day window and a 7-day cooldown are the platform's defaults, and Cede uses them as they are. A carrier that wants a stricter bar for one action changes configuration in code today, not a field on the Autonomy page.
- One window length for every send. The pull-back window is a single setting
(
CEDE_PULLBACK_MINUTES, 60 by default) for notices, cash calls, reinstatement notices, statements and chasers alike. - Nothing has run above L2. Every level above Ask first is built and tested; none has been used at a carrier, and in the demo every released message is a dry run.