Capability deep-dive · exposure and hazard
Your exposure sits in someone else’s format, and the hazard score arrives after the quote is bound.
The peril view is a batch job that lands next week, in a schema only one vendor reads, and the underwriter who needed it made the call on Tuesday. Two things have to change: the schema has to be one anybody can read, and the score has to happen inside the decision rather than beside it.
Import on the industry’s own schema, not on ours
The schema is a published open standard curated by a not-for-profit whose members include most of the market’s largest carriers, brokers and reinsurers; adopting it rather than inventing one is a commercial promise dressed as an engineering choice, and we would rather write it that way round. Exposure data only we can read is a lock-in mechanism, and this product’s whole argument is that it should be swappable. The route-peril count and the bit-identity fixture are read from our own deployed hazard engine, which runs on a compute-agnostic adapter — the same code on ordinary processors or GPUs — and therefore carries no accelerator dependency.
Scored inside the decision, logged into the record it justified
The run belongs to the decision
A per-location hazard score computed at quote time is written into the decision record it justified — not into a separate analytics store that nobody can join back six months later. The engine version, the feed snapshot identifiers and the seed travel with it, which is what makes “what did we know when we priced this?” a query rather than an archaeology project.
The map is a rendering, not a second data path
The console map is a client of the same tile and feed endpoints the ingest plane already serves. There is no separate pipeline behind the picture, so what you see on the map and what a decision consumed cannot drift apart by construction.
route peril over terrain(shipped)SOV/services/nexus-hazard-engine/src/lib.rsmanifest-driven ingest, dispatched through the orchestrator(shipped)SOV/services/nexus-geodata-ingestobservation feeds with no silent fallback(shipped)SOV/services/nexus-weather-feeds/src/lib.rs
The hard part is the join, and it is not compute
It would be convenient to claim the gap between a hazard field and a book is processing power. It is not. Published physics has crossed the operational threshold. The gap is the join: a portfolio object with locations, values, taxonomy and terms, geocoded to a point that is not the address, then sampled against the field — read off the hazard surface at that exact point.
THE TERM EVERYBODY FORGETS
Geocoding is a measurement with an error distribution, and the quality class — rooftop, parcel, street, postcode, locality — dominates the answer for gradient perils. On a floodplain edge the depth gradient is steep enough that a postcode-centroid geocode carries an intensity uncertainty of the same order as the depth itself, at which point the damage ratio is essentially unconstrained. That is why the join has to refuse rather than default when the class falls below the per-peril floor, and why our own geocode classes and their positional error are a projection rather than a figure.
Downstream of the join is the layer that will not fall to compute at all. Mapping a metre of water or a gust speed to a paid-claims damage ratio, by construction class and policy term, is learned from decades of proprietary claims history. No simulation produces it. So we do not author vulnerability curves and do not claim to: the admissible postures are your own curves registered and version-governed, a licensed vendor’s curves under your own licence on the same neutral rails, or a refusal.
The nearest incumbent shape, drawn without a caricature
Property-level peril enrichment already exists in the market, it is fast, and it is genuinely useful. What it is, structurally, is static data: there is no gate around it, no ledger under it, and the largest such dataset is regional rather than global. The argument here is not that the enrichment is worse. It is that an enrichment which cannot say who consumed it, under which version, inside which decision, is not evidence — and evidence is the part a regulator, a reinsurer and a validation committee are all actually asking for.
Where exposure work fails closed
REFUSED
A portfolio read was requested that the caller’s scope cannot express — a business unit whose exposure is separately governed, on a token that carries no unit axis. The read was refused rather than widened to the whole book.
Isolation runs on three axes — tenant, owner and optionally business unit — and all three are resolved from the authenticated request and nowhere else. A surface that cannot express the predicate — the scope rule itself — refuses with a machine code; it never widens to an estate-wide read and never substitutes a placeholder identifier. The measured reason this is a mechanism rather than a convention: in this estate’s own history, an identity remap that ran before any query served one organisation another organisation’s records. The middleware carrying the predicate is production; threading the unit axis through every analytical repository is named, unfinished work.
What you can do next
ROS/src/middlewareDetails for support
SCOPE_REFUSED
See it in the console
What this connects to
Stress testing
What a book-level answer would have to become on the other side of the join: a distribution with its tail support, not a scalar.
Event-time readiness
What all of this is for, on the day an event is three days out.
Four working papers. A person sends the one you pick — no download wall, and no meeting is booked.
Work out what this costs