Capability deep-dive · exposure and hazard
Your exposure sits in someone else’s format, and the hazard score arrives after the quote is bound.
The peril view is a batch job that lands next week, in a schema only one vendor reads, and the underwriter who needed it made the call on Tuesday. Two things have to change: the schema has to be one anybody can read, and the score has to happen inside the decision rather than beside it.
Import on the industry’s own schema, not on ours
The neutral schema is the commitment. The importer that reads a book into it is designed and not built, and this page does not describe it in the present tense.
Scored inside the decision, logged into the record it justified
The run belongs to the decision
A per-location hazard score computed at quote time is written into the decision record it justified — not into a separate analytics store that nobody can join back six months later. The engine version, the feed snapshot identifiers and the seed travel with it, which is what makes “what did we know when we priced this?” a query rather than an archaeology project.
The map is a rendering, not a second data path
The console map is a client of the same tile and feed endpoints the ingest plane already serves. There is no separate pipeline behind the picture, so what you see on the map and what a decision consumed cannot drift apart by construction.
route peril over terrain(shipped)manifest-driven ingest, dispatched through the orchestrator(shipped)observation feeds with no silent fallback(shipped)the exposure importer and the portfolio object(designed, not built)
The hard part is the join, and it is not compute
It would be convenient to claim the gap between a hazard field and a book is processing power. It is not. Published physics has crossed the operational threshold. The gap is the join: a portfolio object with locations, values, taxonomy and terms, geocoded to a point that is not the address, then sampled against the field.
THE TERM EVERYBODY FORGETS
Geocoding is a measurement with an error distribution, and the quality class — rooftop, parcel, street, postcode, locality — dominates the answer for gradient perils. On a floodplain edge the depth gradient is steep enough that a postcode-centroid geocode carries an intensity uncertainty of the same order as the depth itself, at which point the damage ratio is essentially unconstrained. That is why the join has to refuse rather than default when the class falls below the per-peril floor, and why our own geocode classes and their positional error are a projection rather than a figure.
Downstream of the join is the layer that will not fall to compute at all. Mapping a metre of water or a gust speed to a paid-claims damage ratio, by construction class and policy term, is learned from decades of proprietary claims history. No simulation produces it. So we do not author vulnerability curves and do not claim to: the admissible postures are your own curves registered and version-governed, a licensed vendor’s curves under your own licence on the same neutral rails, or a refusal.
The nearest incumbent shape, drawn without a caricature
Property-level peril enrichment already exists in the market, it is fast, and it is genuinely useful. What it is, structurally, is static data: there is no gate around it, no ledger under it, and the largest such dataset is regional rather than global. The argument here is not that the enrichment is worse. It is that an enrichment which cannot say who consumed it, under which version, inside which decision, is not evidence — and evidence is the part a regulator, a reinsurer and a validation committee are all actually asking for.
Where exposure work fails closed
REFUSED
SCOPE_REFUSED
A portfolio read was requested that the caller’s scope cannot express — a business unit whose exposure is separately governed, on a token that carries no unit axis. The read was refused rather than widened to the whole book.
Isolation runs on three axes — tenant, owner and optionally business unit — and all three are resolved from the authenticated request and nowhere else. A surface that cannot express the predicate refuses with a machine code; it never widens to an estate-wide read and never substitutes a placeholder identifier. The measured reason this is a mechanism rather than a convention: in this estate’s own history, an identity remap that ran before any query served one organisation another organisation’s records. The middleware carrying the predicate is production; threading the unit axis through every analytical repository is named, unfinished work.
The honest limit
WHAT THIS DOES NOT DO YET
- The catastrophe financial chain — the exposure object, vulnerability and damage curves, deductible and limit application, exceedance-probability curves and any stochastic event catalogue. What exists is peril physics and the analytics shell, not a catastrophe model.
- The UNO→simulator dispatch seam. The simulator is deployed and the orchestrator is deployed; the executor that lets one drive the other does not yet do so.
- Exposure sums are not modelled losses. An accumulation total inside a footprint says what is exposed; it does not say what will be paid, and the two are not interchangeable in a board pack, a treaty submission or a quote.
- Portfolio geocoding at book scale, with quality classes and their positional error, is [P: to be calibrated]. So is disaggregation, which needs a building-footprint prior we do not hold.
- There is no observed transport between the peril engines and the distributional engines that would turn a deterministic footprint into a distribution. That break is drawn as a break rather than a line.
What this connects to
Peril simulation
What produces the hazard field, and the quarantine that keeps a what-if out of live state.
Stress testing
What a book-level answer would have to become on the other side of the join: a distribution with its tail support, not a scalar.
Event-time readiness
What all of this is for, on the day an event is three days out.