For the General Counsel
Was this loss inside the wording? Part of that question is decidable — and nothing tells you which part.
The rest is judgement, and you are asked to stand behind coverage positions produced at machine speed. The uncomfortable part is not that a model answered; it is that the answer arrives with the same flat confidence whether it turned on an arithmetic sub-limit or on what a court will one day decide “reasonable precautions” means. Those two answers deserve different levels of trust, and nobody is separating them for you.
A certificate that says which lane it used, and where that lane stops
Lane A — formal proofdesigned, not built(designed, not built)
The wording, the endorsements and a binder’s delegated authority compiled into a formal encoding, so decidable questions — is this inside the pen, does this sub-limit bind, does this notification deadline fall inside the period — return an answer with a justification tree a machine can re-check.
Lane B — the cross-model gateshipped(shipped)
Everywhere lane A does not reach — which today is everywhere — heterogeneous models re-derive the answer and a computed predicate has to pass before anything is released. It is a weaker guarantee than a proof, and it is the one that is actually running.
- question
- is the loss inside the insuring clause as endorsed?
- lane used
- B — cross-model agreement
- lane A status
- not attempted: the wording is not formally encoded
- what is proved
- nothing is proved; two independent derivations agreed
- what is not proved
- the meaning of “gradual deterioration” in this forum
- open-textured terms
- listed, not silently resolved — each is a human input
- scope
- tenant · owner · business unit
- seal
- sha256:1d80be3c…77af (illustrative)
THE SCOPE LINE IS THE POINT
A certificate that does not name what it failed to cover is worse than no certificate, because it invites reliance it cannot carry. The scope line is written by the system that produced the answer, not by whoever presents it afterwards.
REFUSED
AUTHORITY_EXCEEDED
The risk sits outside the delegated authority in the binder, so the bind control never armed.
“Are we allowed to write this?” is one of the questions that is genuinely decidable — the pen is a finite set of conditions, written down, in a document. That makes a delegated-authority boundary the first thing worth formally encoding, and the reason lane A begins with binder pens rather than with whole policy wordings. Until lane A is built, this boundary is enforced by the same cross-model gate as everything else, which is a weaker guarantee and is labelled as one.
[O] Illustrative composition, built from the components the product ships. No customer data appears anywhere on this site; the seal above is a placeholder, not a real digest. The document intake this lane depends on is observed at NX/services/nexus-fileprocess/api/src/orchestration/SandboxFirstOrchestrator.ts and NX/services/nexus-graphrag/src/processors/ocr/ocr-cascade.ts. The formal lane itself is not observed anywhere, because it does not exist yet.
The mechanism, in three lines
Some questions about a policy wording are decidable. Where they are, the answer carries a machine-checkable proof; where they are not, the cross-model gate covers the gap — and the certificate says which lane it used.
First
The decidable part is separated out
Sub-limits, deductibles, periods, notification deadlines and delegated-authority conditions are arithmetic and set membership. They can be encoded, and an encoding can be re-checked by something other than the thing that produced the answer.
Then
The undecidable part is named, not absorbed
Open-textured terms are represented as inputs a human supplies, so the proof is honestly conditional: if the loss is a flood in the legal sense, then cover follows. Anything stronger over-claims, and we would rather print the conditional.
Finally
The certificate declares its lane
Every certificate says which lane answered, what was proved, and what was left to judgement. You can read the guarantee you are actually being offered instead of inferring it from a logo.
designed, not built(designed, not built)This is one of the four pillars that leads with the unbuilt glyph. The lane that backs it up is real; the lane the page is named for is not.
The honest limit
WHAT THIS DOES NOT DO YET
- The formal-methods lane — the policy-wording compiler and the solver integration. The cross-model gate that backs it up IS built; the formal lane is not.