Insurance
A claim decision an agent influenced has to be reconstructable years later, by somebody who was not there.
On this page
What is already on you
- 01
The tail is measured in years, not in log-retention windows
A claim reopened in 2031 has to be explained by a record made in 2026. That is an argument for deciding a retention period deliberately — the default here keeps everything, which over-satisfies an evidence obligation and satisfies nothing in data-protection storage limitation, so both duties have to be reconciled by a person rather than a default. - 02
The oversight has to be real, and it has to look real
An approval queue nobody reads is worse than no gate at all, and a record of thousands of instant confirmations invites exactly the conclusion it appears to invite. Risk-tiered gates exist so approvals stay rare enough to be read, which is a design position on the human-in-the-loop failure mode rather than a feature you configure. - 03
Claims and underwriting prompts carry special-category data by default
Health information, criminal-conviction history and financial hardship arrive as free text inside a description of what happened, and free text is precisely what regex and checksum detection cannot find. The honest position is that inline redaction is a compensating control, not the only one you should rely on for a claims corpus. - 04
Whether a pricing or claims agent sits in the high-risk tier is your call, not the product’s
The compliance mapping declines to classify anything for you: deciding risk tiers is printed as a deployer duty that stays with the deploying organisation, and nothing in the product reads your use case and tells you which tier it lands in. What the mapping does cover, if your own assessment puts an agent in the demanding tier, is the artefact shape those obligations ask for — automatic recording over the system’s lifetime, human oversight that can intervene and stop, an ability to halt, and use in accordance with instructions. Those are also the clauses that make a record kept from day one cheaper than one reconstructed later. - 05
Someone will ask whether the model was right, not just permitted
That question is not answered here, and pretending otherwise would be the expensive kind of overclaim. Traces make outputs reviewable and there is a hook for evaluation scores, but governing the judges that gate a release — signed rubrics, calibration against human decisions, drift monitoring, independent quorum — is a later roadmap proposal rather than shipped capability.
The objections, in the words they are raised in
Not a marketing FAQ. These are the sentences this reader says out loud in a first call, quoted rather than softened, and several of the answers below concede that the limitation is real and name the person who has to accept it.
- 01· asked
Our agents only propose and a human always decides. Why add a control?
answeredBecause the proposal is part of the decision, and it is the part nobody currently records. What a human saw at the moment they approved — the tool, the arguments, the policy that stopped it, the trace it belonged to — is the evidence that separates oversight from rubber-stamping when the file is reopened years later. Approvals here are bound to one exact payload, single-use and expiring, with the approver’s identity, time and rationale recorded. One caveat belongs beside that: the approval summary is built from up to 160 characters of the model’s proposed arguments before response redaction runs, so treat the approvals store at the same sensitivity as trace content.
- 02· asked
Can we keep the evidence for the life of the claim?
answeredYes, and the decision is yours rather than the product’s. Trace retention is unset by default and unset means keep forever, which suits a long tail and fails storage limitation, so a regulated deployment sets a window that reconciles both. The hash-chained governance log is never touched by retention at all, by design, so the record of a deletion outlives the deleted data and verification still passes after a purge. The published licence provides that records may be retained and used indefinitely including after termination — intended terms in a file awaiting counsel rather than an executed grant, so put that survival clause in the agreement you sign. The operational corollary is yours too: there is no vendor-side copy, so back the database up like evidence and verify the chain after every restore.
- 03· asked
Will it tell us whether the model’s decision was fair?
answeredNo, and it is worth being precise about the gap. The mapping marks misinformation as partial — traces make outputs reviewable and there is a hook for evaluation scores — and improper output handling as partial, because response redaction cannot control what your downstream system does with the text. Evaluator governance, which would treat an evaluator verdict as evidence with provenance rather than an unquestionable fact through signed rubrics, model provenance, calibration against human decisions, drift monitoring and approval gates on release-blocking evaluators, is a later roadmap proposal. Buy this for authority and effect evidence, and keep your fairness testing where it is.
- 04· asked
Could we hand this to a reinsurer or an underwriter as evidence?
answeredSome of it, and one tempting version of that does not exist yet. What exists today is a period-bounded compliance bundle covering traces, approvals and governance-plane changes with a chain verification result, SHA-256 digest-sealed but not signed, plus canonical Ed25519 effect receipts for terminal effect outcomes that verify offline against a public key distributed independently. What does not exist is an underwriting-grade evidence pack as a product: it is listed among research options explicitly labelled as not committed roadmap promises, with the constraint that Token Observe must provide evidence rather than calculate or promise coverage.
If the objection that would actually decide this for you is not one of the ones above, that is the more useful question, and it is the one worth sending.
Talk it throughWhat a claims interaction leaves behind
The record is bounded on purpose, and knowing the bounds is what makes it usable in a complaint file. A governed request produces a trace holding metadata only — agent, session, delegated principal, team, tags, status, token counts, cost, the kinds of personal data detected, and tool names — and a set of trace events holding a post-redaction prompt excerpt capped at four thousand characters, tool arguments and results capped at sixteen thousand, and the policy decisions taken.
Model response text is deliberately not stored: the response event records the stop reason, the upstream request id, token counts and content-block types rather than the generated text. Tool results are stored, because a tool result is evidence of an action rather than a draft of one. Hidden model reasoning is recorded nowhere, and the compliance mapping says so beside the logging clause rather than leaving you to discover it.
The excerpt is read back off the outbound payload after redaction, so the search index cannot contain the personal data the pipeline just removed. That is a genuine protection and it is also a genuine limitation for a claims corpus: what redaction did not detect is what the record retains, and free text is what redaction does not detect.
Approvals at claims volume, and the failure mode they are designed against
The failure mode is not the missing gate, it is the gate everybody clicks through. The design answer is scope rather than volume: policies match on agent id, team and tag, and gates are set where the action is consequential, so approvals stay rare enough that reading one is a realistic expectation of the person approving it. That is a stated position on overwhelming the human in the loop, and it should shape how you write your first policy set.
Mechanically, an approval binds to the payload hash, is consumed once, and expires. Resuming a blocked call requires the same payload, so an approval granted for a settlement of one amount cannot be carried onto another. The caller receives the approval id and the resume header inside its provider’s native error envelope, which is what lets an existing claims application handle a pause without a rewrite.
Getting there without an outage is the other half. Every policy runs in shadow mode first, so the first week produces findings rather than blocked claims, and a backtest replays a candidate rule against retained traces before anyone promotes it. An optional gate refuses promotion into enforcement until a backtest of that exact rule digest has been acknowledged by a named person, whose name and accepted figures are copied into the audit entry.
- What an approver sees
- The tool name and, on the request path for a model-proposed call, up to 160 characters of the proposed arguments, plus the policy reason. Approvals raised on the tool gateway carry the tool name or policy reason without arguments.
- What the record keeps
- Approver identity, decision time and the rationale they typed, alongside the trace the decision belonged to. Control-plane accounts are disabled rather than deleted, so the actor still resolves years later.
- What it will not do
- Approvals are not purged by the trace retention window and cannot be erased by subject, so they need their own place in your retention schedule rather than inheriting the trace window’s.
Special-category data in a claims prompt
Detection before egress is regex plus checksum, and the confidence per kind is published rather than averaged into a reassuring number. NHS numbers are validated mod-11 and cards by Luhn, scoring between 0.9 and 0.98. National insurance numbers score 0.85. Telephone numbers score 0.7. A health condition described in a sentence scores nothing at all, because free-text personal data is not detected.
What that means for a claims deployment is that the control is real at the identifier layer and absent at the narrative layer, and the product says so: it is a compensating control, not your only data-loss prevention. The residual is named in the threat model as requiring acceptance by the Data Protection Officer specifically. Confidence scores are exposed so a policy can set its own threshold instead of inheriting one, and secret kinds are always masked irreversibly whatever a policy’s mode says.
Two routing controls are worth setting on a claims agent on day one, and they are independent booleans rather than one flag because providers genuinely differ on each: require no training on payloads, and require a serving region. They are enforced on the fallback chain as well as the primary route, and a request with no qualifying route is refused with a typed error rather than downgraded quietly. The honest limit: those provider flags are your assertions about your contracts, unverified by the product, and the assertion itself is audited with the actor who set it.
The parts of the platform this leans on
In the order they matter to this reader rather than the order the platform argues them, and each one carries its own stated limit on the page it links to.
Human approvals
One human decision, bound to one exact payload, spendable once.
Flight recorder
Every governed request in a timeline a compliance officer can read, and a search box that never writes SQL.
Policy engine
One deterministic verdict on every governed request: allow, block, redact, or park it for a human.
Audit chain
Every administrative act hash-chained; seal it under a key held off the box, and anchor it with a signature your auditor can check alone.
Agent registry
One record per agent, and it is the record the gateway enforces against.
Which agent use cases in insurance does this actually help with?
Any where an agent’s output influences a decision somebody may later challenge, and particularly any where the agent takes an action rather than drafting one: setting a reserve, issuing a payment, transitioning a claim status, sending a customer communication. For those, the effect contract lifecycle verifies a postcondition rather than trusting a success response. For pure drafting workflows the value is narrower and should be described that way — a searchable, bounded, hash-chained record of what was asked, what was proposed and who approved it.
How do we evidence human oversight to a complaints reviewer?
With the approval record and the trace it belongs to, read together. The approval carries the approver’s identity, the decision time and the rationale they typed; the trace carries the bounded prompt excerpt after redaction, the tool arguments, the tool results and the policy decisions that led to the pause. Both sit inside a period-bounded compliance export that also carries the audit-chain verdict. What the reviewer cannot be given is the model’s hidden reasoning, because no gateway can see it, and the mapping states that limit rather than implying coverage.
Can an agent be stopped immediately if a pattern goes wrong?
Yes, and the stop is scoped and attributable. A kill switch can target one agent, a team or the whole estate, requires an actor and a reason, and is evaluated first in the request path so it beats every other gate. Suspension of a single agent is a lifecycle change that takes effect on that agent’s next governed request with no redeployment, because the gateway resolves the registry record itself rather than an exported copy, and the transition is published as an event as well as audited.
What does the product not claim about detection?
That it is complete. The licence states plainly that policy, redaction, injection-detection and routing controls are heuristic and are not warranted to identify every instance of what they are designed to detect, and that the software is a compensating control which does not make you compliant with any law, regulation or standard. Free-text personal data is undetected, identifier formats outside the supported set are undetected, and both residuals carry a named acceptor in the threat model — the Data Protection Officer for regex personal-data detection, the CISO for prompt-injection false negatives — neither of which counts as accepted until that person dates it. Those are published positions rather than answers extracted under questioning.
Is there a signed artefact we can rely on?
Two, and it matters which one you are holding. Ed25519 audit anchors sign a statement of the chain head and are published off-box; canonical effect receipts sign a terminal effect outcome and verify offline against a public key you obtain independently — the key is never taken from the receipt, and an install with no signing key configured returns a not-found rather than an unsigned trust claim. The compliance and trace exports are the ones that are not signed: they are SHA-256 digest-sealed, which catches edits and does not prove origin.
Bring the objection that is not on this page.
Write to hello@tenhaw.com with what your agents do, which providers they call and what would have to be true for you to put something in front of them. James Rooney replies. You will get a straight answer about whether Token Observe fits, including when it does not.
no form · no qualification step · no sales desk · the other three ways in