How InsightCede works, end to end

How it fits together

InsightCede is the outwards side of the carrier: what it buys, from whom, what it ceded and what the panel owes it. It sits beside the policy system and the claims system, takes their transactions in, and decides what each one means for the reinsurance programme.

Three layers do the work, and they never trade places:

• The engine decides which contracts respond to a transaction, in what order, and how much is ceded. It is deterministic, append-only and idempotent, and writes a note on every outcome — including “nothing ceded”, with the reason.
• The agents read what the engine committed and prepare the work that follows: an explanation, a notice, a cash call, a statement, a chaser, a credit proposal. Each piece is a decision record.
• People answer those decisions — Accept, Change, Reject or Ask — and their answers are what moves the autonomy dial.

Step	What happens	Agents
1 Programme & placement	Treaties, layers and panel shares; renewal; gaps in cover	Renewal prep · Placement intake · Programme gap
2 Intake & cession	Policy and claim transactions arrive and are ceded, or kept with a reason	Cession decision · Anomaly explainer · Contract mismatch
3 Erosion & notices	Large losses erode layers; the panel is told and billed	Large loss notice · Cash call · Reinstatement · Exhaustion watch
4 Statements & settlement	Periods close, bordereaux are struck and sent, recoverables are collected	Statement · Collections · Reconciliation
5 Credit & reporting	Exposure to each reinsurer is watched; Schedule F is drafted	Counterparty watch · Schedule F

Home and the queue

Home opens on Waiting on you: every open decision the agents prepared, ordered by money then age, with a badge per lifecycle step. Each row names the agent, the action, the subject, its level (Draft or Ask first), its deadline, how long it has waited and the amount at stake. Clicking a row opens the decision in place. Beside it, Overnight lists the agents’ recent runs with their outcome; below, the personal home every Insight product draws — the Today line, the book in figures, insights and signals.

My work holds the same queue in full, and a second tab for tasks (the collections queue, statements due, programme-gap tasks) with claim, hold and complete and an SLA clock.

The decision record

One record per thing an agent prepared. It says what the agent recommends and the money at stake; the evidence, grouped by where it came from, each item a link into the ledger; what accepting does; and for a message, the draft itself, held in the outbox. The four answers are Accept, Change, Reject and Ask:

• Accept and Change apply the proposal through the same services a person would call — a held send is released, a strike generates the bordereaux — and record the answer as feedback.
• Reject cancels the held send and records feedback. Ask records the question and no feedback.

A send that has no addressee on file is shown as such — the agent never guesses one. When the model could not be reached, the record says its explanation was not written by the model, and the evidence stands on its own. A clean cession is explained and noted on its event rather than queued: only what needs a person waits.

Agent activity

Every run, newest first: the agent, what it did in one line, its outcome (prepared, nothing to do, failed), the decision it prepared with the person’s answer once given, and a pull-back banner for any action still inside its window. Counts at the top say what is running now, waiting on a person, completed and acted today; filters narrow to an agent or a status.

Inbound

Every policy and claim transaction the workbenches reported, and what happened to it: ceded, nothing ceded (and why), error or pending. Selecting an event shows its outcome, the cessions it wrote by treaty and layer, and the cession decision agent’s record behind it — the contracts it considered in inuring order and what each said. The claim register tab lists the claims the ledger knows.

Assist

A copilot over the ledger: ask about the programme, a treaty, a reinsurer or a claim in plain words. Answers cite the ledger tool they came from; the copilot can also work over connected data or the web when asked to. It reads; it does not answer decisions or write to the ledger.

Position

Gross to net in one read: ceded premium, ceding commission back, the net cost of reinsurance, ceded loss and the ceded loss ratio, reinstatement premium, what the panel owes and what it has paid. Alerts at the top say when a loss had no cover left and when transactions found no outwards protection at all. Recoverables ageing and capacity erosion follow; the counterparty watch agent sits in the rail. Every figure is derived from the cession ledger, so it moves when a claim or a policy moves.

Programme and treaties

The treaties by name and underwriting year — type, basis (risks-attaching or losses-occurring), status, lines covered, terms — with ceded premium, ceded loss and the capacity left. The programme gap agent’s proposals sit in the rail. Opening a treaty year gives its workspace: capacity layer by layer (limit, attachment, eroded, reinstatements used), the panel and its shares, the ledger, the statements and the work open on it, with the inuring order drawn.

Cessions and bordereaux

The two ledgers — loss cessions and premium cessions — and the statements that report them. Loss cessions show the claim, loss date, transaction, contract, basis (paid or outstanding), ground-up and ceded amounts, and anything uncovered. Ceded by accounting period and by contract are charted above. The Statements tab lists the bordereaux per period and reinsurer, in draft or issued, with a preview of each; the statement agent’s period-close checklist is in the rail.

Recoverables

What the panel owes on paid cessions, and whether anyone has asked for it: unbilled, outstanding, overdue and disputed at the top; ageing by band and concentration by reinsurer; then every recoverable with its claim, treaty, share and status. The collections agent drafts one chaser per reinsurer with money past due; the drafts wait in the rail for review and release. Billing and recording a collection are a person’s acts, each behind a confirmation that states the amount — recording a payment is the one ledger write no agent makes.

Reinsurers

The panel master: each reinsurer’s AM Best rating, whether it is authorised, the collateral held, the treaties it sits on and what it owes now, with the concentration chart beside. Opening one shows the collections agent’s chaser for it, the counterparty watch, and the notes thread.

The agent catalogue

Fifteen agents, each declared once — code, name, step, trigger, actions with their checkpoints and defaults, what it is grounded in and what it must never invent — and read from there by the dial, the API, the screens and this guide. One agent’s page shows its recent runs with level, model calls and cost, a run’s trace, and the prompt version it read.

Agent	Grounded in	Must not invent
Placement intake	The slip’s text; known reinsurers	A term the slip does not state — every field cites its passage or is blank
Cession decision	The event, the engine’s note, the cessions it wrote, the candidates and why they were skipped	A cession amount
Large loss notice	Claim register, loss cessions, panel contacts	A recipient or a figure — no contact means no addressee
Reinstatement	Reinstatement premium rows, the layer’s reinstatements	A premium — the engine raised it
Collections	Recoverables, reinsurer contacts and rating, Pulse news	A payment — a person records the collection
Reconciliation	Our recoverables, the counterparty’s statement	A match below the tolerance
Counterparty watch	Reinsurer standing, exposure by reinsurer, Pulse signals, the concentration limit	A rating; a news item is cited, not turned into a fact
Schedule F	Cessions and recoverables by reinsurer and panel share, reinsurer standing	An identifier — a missing NAIC code is a flag

The autonomy dial

Every agent action has a level, set per line of business:

Level	What it means
L1 Draft	The agent prepares a draft; a person does the work
L2 Ask first	The agent prepares the decision and asks a person before it acts
L3 Act and tell	The agent acts, tells the person, and a pull-back window lets them reverse it (60 minutes by default)
L4 Act	The agent acts on its own

Day one is L1 for proposals and L2 for anything that would reach the panel. The tenant ceiling (CEDE_AGENTS_MAX_LEVEL, default L2) caps every agent. An hourly roll-up recommends a promotion at 90% or more agreement over at least 50 answers — a manager accepts it — and demotes at once below 70% over at least 20, with managers told and a seven-day cooldown. The kill switch drops an agent to L1 on every action and line, at once, and asks why.

Each agent has a daily model budget (CEDE_AGENT_BUDGET_USD_DAILY, 25 by default); over it the model is skipped and the run says so. Prompts are versioned and the version read is on the run and the decision.

Integrations

The flows in and out, with health per flow: InsightUW → Cede policy transactions, InsightCW → Cede claim transactions, the signed intake door, the data API reads by UW, CW and Pulse, and the daily pull of Pulse news on the panel and the treaty brokers. A flow’s page shows its contract and recent failures with replay; the exchange log and inbound webhooks are alongside.

What UW and CW send

Both workbenches write each event to an outbox in the same transaction as the business change, so if the cheque commits, the event exists; a publisher ships it afterwards and retries freely, because intake is idempotent on event_id. Intake is signed with an HMAC header.

• insightuw.policy_events v1 — bound, endorsed, audited, cancelled, reinstated. The premium is the delta the transaction added: the whole premium at bind, only what an endorsement added, a negative delta on cancellation. A balance would re-cede the policy on every change.
• insightcw.claim_events v1 — reserve movements, payments, recoveries, reopenings, large-loss and cat events. Every amount is the claim’s cumulative position after the event, because an excess layer attaches on the size of the loss. policy_inception travels with every claim event: a risks-attaching treaty is matched on it.

Events that cede nothing are kept with the reason — “why was nothing ceded on this claim?” is the question the ceded team asks most.

The data API

Net is derived here and published as a read; InsightCede never writes back into underwriting or claims. Three governed contracts carry it, each a named SQL read with typed, labelled columns:

cede.net_position

Net position — gross to net on the ceded programme. One row per treaty and underwriting year, one for facultative certificates, and one for the programme totals — the same sums as the Position screen.

scope treaty_code underwriting_year treaty_type cession_pct subject_premium ceded_premium ceding_commission reinstatement_premium net_cost_of_reinsurance ceded_loss ceded_outstanding ceded_paid ceded_loss_ratio uncovered_retained recoverable_billed recoverable_outstanding recoverable_collected

cede.claim_net

Claim net of reinsurance. For a claim InsightCW reported: its gross position, what Cede ceded on it and to which treaties, what the panel was billed, has paid and still owes, and the net the carrier keeps.

Parameter: claim_number narrows to one.

claim_number policy_number lob loss_date is_large_loss gross_incurred gross_paid ceded_outstanding ceded_paid ceded_incurred uncovered_retained treaties recoverable_billed recoverable_collected recoverable_outstanding net_incurred net_paid

cede.recoverable_aging

Recoverables ageing by reinsurer. What each reinsurer owes and how late: outstanding by age band (not yet due, 1–30, 31–90, over 90 days past due), unbilled, disputed, the oldest due date.

Parameter: reinsurer_code narrows to one.

reinsurer_code legal_name am_best_rating is_authorised open_items billed collected outstanding unbilled not_yet_due late_1_30 late_31_90 late_over_90 disputed oldest_due_date

Deployment

InsightCede is deployed into the carrier’s own cloud account. One container image runs in three roles chosen by the task’s command:

• API — the HTTP service the workbench and the data API read.
• Worker — the background jobs and the scheduled agents (ageing, period close, collections, credit, Pulse news), under a lease so only one runs them.
• Migrate — a one-off before each deploy that brings the schema up to date. Nothing migrates or seeds on container start in production.

The ledger and the platform tables (identity, connections, workforce, home) share one cede schema on Postgres. Every money column is Numeric(18,2) and the engine computes in decimal. No secret is baked into the image: the database URL and secret, the signing key reference and the intake secret come from the task definition and the carrier’s secret store. Sign-in is the carrier’s identity provider. The agents reason with Claude through Amazon Bedrock in the carrier’s account — a fast model for the agents, a larger one for the Assist copilot — and a call that cannot be made degrades to a labelled stand-in that the decision record admits to.

What it does not do

• It does not compute with a model. No agent produces a cession, a recoverable, a balance or a premium; if the engine did not write it, it is not in the record.
• It does not receive exposure. Limits profiles, aggregates and market pricing are not in the ledger, so the renewal pack carries experience, not exposure.
• Retrocession, aggregate deductibles and stop-loss are named in the contract vocabulary and not implemented.
• Facultative placement stays in underwriting. It is an underwriting act; certificates are not yet pushed to Cede automatically.
• It does not record payments for you. Recording a reinsurer’s payment is a person’s act, through the ledger.