AEGIS

A parametric policy whose wording froze at sale and whose reserve is escrow, not a promise.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Parametric insurer or MGA. The wording froze at sale; the trigger is a signed oracle reading.
• Agricultural cooperative. Hail cover that pays before the growers wake up.
• Reinsurance. A reserve you can watch all season instead of audit once.
• Travel and event cover. Delay triggers from oracle feeds, with disputes that have teeth.

The problem

Claims are slow because the policy wording, the trigger data, and the payment live in three systems and a human reconciles them under adversarial conditions. Every party has an incentive to remember the terms differently, and the terms are a PDF.

The system

AEGIS writes parametric weather cover for 2,400 greenhouse operators. A policy is an instantiated template version: the wording froze when it was published, the sale copied it, and neither side can rewrite what was bought. The reserve behind each cohort is not a balance-sheet assertion but escrow on the ledger, funded at binding, visible to the regulator’s read-only agent all season.

On the night of 14 June, hail crosses Emsland. The oracle agents report it with signed attestations; the trigger gate compares the readings to the frozen terms and releases the milestone. 61 payouts land before the growers wake up, each one carved and logged by the same rail. The 62nd is contested, so it does what contested money does here: it stops, holds in escrow through a four-phase dispute, and moves exactly once when the ruling lands.

The cast and their ceilings

The flow, step by step

1. The wording froze at publish. The sale copied it. The reserve is escrow.
2. 02:12. Hail crosses Emsland, and the oracles sign what they saw.
3. Readings against frozen terms. The trigger is satisfied.
4. The reserve funds the payout.
5. 61 payouts before sunrise, each carved and logged by the same rail.

Each need, mapped to a live primitive

The attack this chamber refuses: The post-storm rewrite

The attack. After the hail, the insurer tries to soften clause 9 of the bound policy.

Why it fails. Publishing is an irreversible freeze and instantiation copies rather than references. The bound policy carries the text it was sold with, and there is no reference for a rewrite to travel through.

What actually happens. The insurer can publish version 5 for next season. Version 4, and everyone who bought it, is beyond reach.

Deep architecture

AEGIS deployed: the insurer’s frame holds the frozen templates, the reserve escrow and the trigger gate; the regulator and the reinsurer read a signed replica on their own side; the weather arrives raw underneath and leaves the oracles as signed attestations. Nothing in this drawing is a report anyone files afterwards. The trace replays one season, publish to payout to the three readers.

The deployment, traced

1. The underwriter publishes wording v4. Publishing is an irreversible freeze.
2. A policy binds: the sale copies the frozen text, and the reserve funds as escrow at binding, on the ledger.
3. The trigger gate holds the frozen terms. Nobody argues with a PDF, because there is no PDF.
4. All season, the weather arrives raw.
5. The oracles sign what they saw. An attestation has an identity, not just a value.
6. 02:12, 14 June. Hail crosses Emsland. Readings satisfy the frozen terms; the gate releases from the reserve.
7. 61 payouts land before the growers wake up. The 62nd is contested, so it stops in escrow and waits for the four-phase ruling.
8. The back office receives evidence, not spreadsheets to reconcile.
9. The season mirrors out as signed events.
10. The replica carries the same reserve, the same payouts, the same refusals.
11. The regulator reads all season. Solvency is observed continuously, not audited once.
12. The reinsurer watches the same replica. One ledger, three readers, zero bordereaux.

Adoption, phase by phase

Discover: Your wording, re-read as a schema.

• Runs. Nothing. One parametric product redrawn as a template, a trigger table and a reserve rule.
• Agents. None. The actuaries argue about the trigger table, and that argument is the deliverable.
• Integrates. Nothing. Policy admin and the weather licenses stay as they are.
• Deliberately not yet. Nothing is published, so nothing is frozen.
• Proof that gates the next phase. One historic claim season replayed against the drafted terms reproduces every payout decision, including the contested one.

Pilot: One cohort, real triggers, pocket reserve.

• Runs. A hosted registry seat, or a single-VM frame if the reserve must sit inside your walls from day one.
• Agents. underwriter-desk, two oracle agents with their own identities, claims-gate. The regulator is not connected yet.
• Integrates. Licensed weather feeds into the oracles; binding flows in from policy admin via the SDK.
• Deliberately not yet. Pocket limits. One product. Disputes are drilled, not yet real.
• Proof that gates the next phase. A staged trigger event pays a pilot cohort from escrow with no human in the release path, and the ledger shows every carve.

Production: The reserve becomes a fact the regulator watches.

• Runs. A sovereign frame in the insurer’s estate; the reserve escrow and the season ledger live under your law.
• Agents. The full cast, plus regulator-watch with read-only ceilings. The oracles attest under SPIFFE identities.
• Integrates. Policy admin binds continuously; the evidence chain exports to the back office instead of month-end reconciliation.
• Deliberately not yet. The reinsurer still reads reports. The next phase makes it a peer.
• Proof that gates the next phase. The regulator’s agent reads the reserve all season and its view never disagrees with the books, because both are the same ledger.

Federation: The treaty reads the replica, not a bordereau.

• Runs. Unchanged. The reinsurer connects its own registry, or a seat.
• Agents. reinsurer-watch reads the signed replica of the treaty book, all season.
• Integrates. Each new reader is a signed card and a license. Nothing is exported by hand.
• Deliberately not yet. Nothing structural. New products are template versions.
• Proof that gates the next phase. A treaty season closes with the reinsurer citing the replica rather than a bordereau, and no reconciliation audit is scheduled.

Sizing

One trigger, weather to payout

sequenceDiagram
  participant WX as weather feed
  participant Ora as oracle agents
  participant Gate as trigger gate
  participant TEG as reserve escrow
  participant ES as event ledger
  participant Rep as signed replica
  WX->>Ora: raw readings, all season
  Ora->>Gate: signed attestations (SPIFFE identity)
  Gate->>Gate: readings vs frozen terms (v4)
  Gate->>TEG: release milestone, per policy
  TEG-->>ES: payout carved + logged, append-only
  ES-->>Rep: signed mirror update
  Rep-->>Rep: regulator + reinsurer read, cannot write
  Note over TEG: the contested payout stops in escrow, four-phase dispute

Topology, as declared

flowchart LR
  T["policy template<br/>publish = freeze"] -->|"instantiate copies"| P["bound policy<br/>terms_schema"]
  P -->|"reserve at binding"| TEG["TEG escrow"]
  O["oracle agents<br/>SPIFFE identities"] -->|"signed attestations"| G{"trigger gate"}
  G -->|"terms satisfied"| TEG
  TEG -->|"milestone release"| ES[("event store")]
  DIS["dispute, 4 phases"] -->|"ruling drives split, once"| TEG

Standing it up

• Infrastructure. A hosted registry, or the insurer’s own. 9 containers, about two minutes.
• Agents. 4 roles. The oracles are the interesting ones.
• Integration. Weather data licensing and the policy admin system. The actuarial model stays yours.

What this does not claim

• AEGIS is not an insurer and not a claims administrator, and holds no regulatory authorisation.
• The protocol carries the wording, the reserve and the settlement. Underwriting risk remains where the law puts it.