Twelve terms for the structural liabilities of AI deployment at property and casualty carriers, and the control architecture that answers them.
Hirak Chatterjee · Canonical definitions · Updated September 2026
A gap is a static absence you fill once. A debt compounds, has to be serviced, and becomes more expensive the longer it goes unnamed. Every term in Part One is named as a debt because carriers keep treating these conditions as gaps, funding a remediation once, and then finding the investment did not hold.
Part One · The Debts
Five named liabilities. None of them appears on a balance sheet, and each is serviced whether or not it is recognised.
The accumulated structural cost that any new capability must pay to reach the transactional systems of record, and which is absorbed silently by every initiative because no prior programme recorded having paid it.
Decades of accumulated middleware sit between a modern capability and the systems that actually hold the policy, the billing account, and the claim. Reasoning is not the constraint. Traversal is. Every initiative pays the toll before it delivers anything, and the toll does not appear in the business case because the previous programme paid it too and nobody wrote it down. The failure mode this produces is easy to misread: a pilot that satisfies every success criterion and then does not scale, which gets attributed to model limitations when the binding constraint was the substrate.
The liability created when the commitment horizon of a decision exceeds the half life of the conditions that justified it.
An eighteen month procurement cycle cannot buy into a six month technology half life. By the time the contract is signed, yesterday's constraints have been codified into a multi year obligation. The same failure applies to market conditions and not only to technology: a transformation business case justified at one point in the pricing cycle is delivered into a different one, and a programme of three to five years will outlive the environment that approved it. The decision was not wrong when it was made. It was calibrated to a present that does not persist.
The distance between the agreement a governance body reached and the scrutiny it skipped in order to reach it.
Steering committees approve pilots on broad alignment without establishing the architecture, ownership, and operational guardrails required to survive production. The cost surfaces later as a model nobody owns, a risk nobody flagged, and a use case nobody stress tested. The counterintuitive property of this debt is that the speed of convergence is the warning rather than the achievement. A body that aligns quickly on an agentic deployment has usually agreed on the objective while leaving the contested questions, which are the ones about authority and failure, unopened.
Counter positionIf an AI council reaches consensus quickly, it is not working. It is performing.
The accumulated distance between what an access model authorises action by action and what an autonomous process can assemble across a sequence of individually authorised actions.
Access is granted to agents faster than the structures needed to supervise what they do with it. Every individual permission is defensible on review, because each was granted for a legitimate task and evaluated in isolation. The sequence is not defensible, and the sequence is what runs in production. Agentic systems also do not violate segregation of duties so much as render it incoherent, because a single identity occupies every role in the sequence while each role remains formally separate on paper. Access reviews that evaluate grants one at a time are structurally incapable of detecting this, since the object of concern is the reachable path rather than the grant.
The liability incurred when the work that used to manufacture institutional judgment is automated while the operating model that depends on that judgment is retained.
Entry level underwriting and claims work was never only production. It was the mechanism that produced senior judgment, and it produced it slowly, as a by product that nobody budgeted for and nobody measured. Remove the volume and the pipeline closes quietly. The shortfall stays invisible for years because the existing senior bench masks it, and it presents itself at the turn of the cycle, which is precisely the moment when judgment rather than throughput is the scarce input. This is the one debt in the set whose cost is realised on a delay long enough to fall outside the tenure of the executives who incur it.
The deliberately narrow set of decisions that a named human owns, scoped by irreversibility and contestability rather than by monetary threshold.
This is the response to Permission Debt. Perimeter controls assume the boundary is where authority is exercised. In an agentic claims or underwriting operation, authority is exercised at the decision, several thousand times a day, so control has to move to the decision. Narrow is the operative word. A judgment layer that covers everything is a review queue, and a review queue is not judgment. Monetary thresholds are the conventional basis for approval authority and they are the wrong one here, because the decisions that create the most institutional exposure are frequently small in dollar terms and large in precedential or regulatory consequence.
What it is notNot a review queue, not a committee, and not a control that scales with decision volume. If it grows as throughput grows, it has become a bottleneck wearing the name of a control.
A supervisory design in which humans engage by exception, and in which the exception is defined by the structural shape of the decision rather than by a confidence score the model generates about its own work.
A model reporting its own certainty is the least reliable available trigger, because the failure mode that matters is the decision that is confident and wrong. Exceptions have to be defined structurally and in advance, on properties knowable independently of the model: irreversibility, contestability, precedent setting effect, and regulatory exposure. The exception queue is also drawn by the system being supervised, which means any threshold adjustment made to manage queue capacity is an undocumented change to institutional risk appetite. Treated correctly this is a cost architecture as much as a governance one, since reserving the expensive path for the genuine exception is what makes the unit economics work at volume.
Counter positionOne person approving several hundred agent decisions an hour is not oversight. It is the manufacture of a liable signature, and it will not survive its first contested file.
A contemporaneous record in which every consequential decision carries its inputs, the version of the system that produced it, and the authority under which it was made.
The purpose is reversibility rather than documentation. A compromised window has to be identifiable and unwindable rather than merely apologised for, and that is only possible if the record was constructed at decision time. Provenance reconstructed after the fact is not provenance; it is an inference about your own system, offered under your own signature, at the moment it is least likely to be believed. The exposure in insurance operations typically arrives through actions never classified as automated decision making in the first place. A model that routes a claim into investigation has made no coverage determination, so nobody records it as an automated decision and the claimant is never told, yet the routing is the action that determined the claimant's experience.
Counter positionThe regulator will not ask whether the agent was removed. It will ask who decided, on what basis, and under whose authority.
The unit economic measure of an automated decision at production volume, and the design objective that this unit cost should fall as decision count rises.
At carrier volume, artificial intelligence stops behaving like project spend and starts behaving like a variable cost attached to every quote, every first notice of loss, and every endorsement. The operative question is not what the system can do but what each invocation costs multiplied by volume, and whether that curve is sublinear as it scales. Scaling smarter has an exact technical meaning under this definition: an architecture in which cost per decision falls as decision count rises, through routing, caching, cheaper models tiered beneath expensive ones, and the expensive path reserved for genuine exceptions. Pilot economics mislead in both directions, because pilots run at pilot volume.
The distortion introduced when experience generated under one market condition is applied to another, carried by a model rather than by a triangle, and uncorrected because the equivalent actuarial discipline has no counterpart in model governance.
Reserving actuaries know that loss development factors calibrated on hard market vintages behave differently on soft market ones, and they correct for it as routine practice. Models trained on the same period encode the same pricing and severity environment, and no equivalent discipline exists in retraining cadence, feature stability, or drift detection. The reason this survives production monitoring is structural rather than negligent: most drift detection watches input distributions for movement, and cycle bias does not live in the inputs. The features arriving today look unchanged; what changed is the market that produced the labels. The contamination is also uneven across a book, which makes a single retraining cadence wrong by construction, and retraining on recent data moves the contaminated window forward rather than removing it.
Counter positionOur actuaries adjust their development factors for cycle bias. Nobody is adjusting the models for it.
A design principle under which the objective is not the optimal target state but the state from which retreat is possible without rework.
In an environment that cannot be forecast over the life of a transformation programme, the discipline is identifying the one way doors before the programme starts and accepting a worse theoretical design in exchange for a shorter distance back. Most programmes optimise for the target state and treat reversibility as a failure to commit, which is exactly inverted when the environment turns faster than the programme completes. Reversibility is also the operational purpose of Decision Provenance, which is what makes an automated decision window unwindable rather than merely auditable.
The systemic exposure created when carriers fine tune similar model families on similar data through the same small set of platform providers, producing convergent behaviour that no individual carrier's validation process is positioned to detect.
Validation is conducted within the boundary of the firm, against the firm's own data and thresholds, and is therefore constitutionally blind to correlation across firms. Convergence removes dispersion, and dispersion is what made differentiated results possible in the first place. In a market with limited rate cover, price becomes the remaining lever, and price competition between carriers operating effectively identical decision structures is a recognised route from a soft market into a reserving problem. What makes this difficult to govern is that it is assembled entirely out of individually sound decisions.
These definitions are canonical. Where an earlier published version of a term differs in wording, the version on this page governs.
Citation. Chatterjee, H. (2026). The AI Vocabulary: Decision Architecture Terms in Property and Casualty Insurance. Retrieved from https://hirakchatterjee.com/vocabulary/
