Line of business · Brokers, MGAs and coverholders
You bind on someone else’s paper. Whether the risk was inside the pen gets proved afterwards, if at all.
The binder says what you may write. The system says yes. The reconciliation that checks one against the other happens weeks later in a bordereau, which means the control that matters most to your capacity provider runs after the exposure already exists.
What breaks under a delegated authority today
“Inside the pen?” is asked too late
The question that decides whether a bind was authorised is answered in a bordereau weeks afterwards. A breach found then is a conversation with your capacity provider, not a control. (UC032)
One person can bind alone
Dual control is a line in a procedures manual rather than an arming step in the path. Nothing in the system requires a second named human before the capability can be used. (UC031)
The pen lives in prose
A binder is a wording that a person interprets, per risk, under time pressure, from memory. Two experienced underwriters can read the same clause differently and both be reasonable.
Your tooling is priced on your book
Licensing metered on premium volume charges you for growth before you have banked it, which is the mechanism that keeps smaller carriers and delegated authorities out of the good tools.
What holds today, and how you check it
Which pillars answer it
P4 · for the General Counsel
Two-Lane Provable Decisions
Some questions about a policy wording are decidable. Where they are, the answer carries a machine-checkable proof; where they are not, the cross-model gate covers the gap — and the certificate says which lane it used.
Some questions about a binder are decidable — whether this risk falls inside the pen is one of them. Where the answer is decidable it carries a proof, and where it is not the page says which lane was used.
designed, not built(designed, not built)P9 · for the Chief Operating Officer
Governed Change Control + the A2A Corridor
Changing a rule, a threshold, a persona or a model version is itself a governed decision that carries a certificate — and the same discipline extends to actions between companies.
A second named human arms the bind capability before any agent can invoke it, and the arming is itself a governed, revocable event.
designed, not built(designed, not built)P3 · for the Chief Risk Officer
Cross-Model Computed Gate → Sealed Certificate
Two or more heterogeneous models re-derive the answer. A computed — not learned — agreement predicate must pass before anything is released, and the inputs and model versions are sealed into the record.
Where the formal answer does not reach, two heterogeneous models must re-derive and agree before the bind releases.
shipped(shipped)P2 · for the Head of Claims
The Chaired Deliberation Chamber
Versioned expert personas argue the case from different angles — including one seat whose only job is to attack the conclusion — and a named human chair rules, at a durable waitpoint.
A risk that falls outside the pen becomes a referral room with a named chair and a durable waitpoint, rather than an email to the carrier.
shipped(shipped)What this does not do yet, for a pen
WHAT THIS DOES NOT DO YET
- The formal-methods lane — the policy-wording compiler and the solver integration. The cross-model gate that backs it up IS built; the formal lane is not.
- A2A migration from the spec version our endpoint conforms to (v0.3.0) to the current one (v1.0.0), plus the party model, claim-state synchronisation and conflict surfacing.
Read plainly: the pen-boundary answer that carries a machine-checkable proof is the part not built, and binder pens are the first place it is being built. What runs today is the lane behind it — two heterogeneous models re-deriving the answer, dual-control arming, and a referral room when the answer is no. A certificate always names which lane produced it, so you are never told a question was proved when it was cross-checked.
REFUSED
AUTHORITY_EXCEEDED
A bind outside the pen does not warn and proceed. It refuses, names the clause it failed, and offers the referral room in the same surface.
Every delegated authority already has a rule that says this. The difference is where the rule runs: before the bind arms, in the path, rather than in a reconciliation weeks later where the only remaining option is to report yourself.
Start with one binder
You can encode a single binder, arm one bind capability under dual control, and leave the rest of your placement process untouched. What your capacity provider gets back is a per-risk record of the pen question being asked before the bind, which is the conversation you would otherwise be having at audit.