Line of business · Reinsurers
You price a cedant’s book on their own account of their own controls. What arrives is a slide, not a record.
Their models, their validation, their overrides, their change history: you are told about all of it and shown almost none of it. At renewal you end up pricing the uncertainty in the account itself, and both sides know that is what is happening.
What breaks at renewal today
The pack is a narrative
Assembled for you, by the party it describes, after the year it describes. Every number in it is an output; the runs behind them stay on the other side of the wall.
You cannot re-execute anything
A back-test you cannot re-run is a claim about a back-test. Often the cedant cannot re-run it either, because the seed and the inputs were never kept together.
Override behaviour is invisible
How often a chair overrode the model, on what grounds, and whether the overrides cluster in one class of risk is the most predictive material in the file and the least likely to be in it.
Scope is granted by trust, not proved
An extract emailed to you is a copy in your control, with no record of what you were entitled to see. A seat scoped by the same predicate that scopes their own staff is provable in both directions.
What a scoped seat can rest on today
How we count this
The stream is the Article-12-shaped interaction log plus a never-dropped audit emitter, in production. The seat is a scoped read over it, not an export of it.NX/services/nexus-workflows/src/services/{governance,audit-emitter}.tsThe three axes are enforced in the shared query primitive every repository inherits, with relationship-based access control on every read, write and dispatch — never a fragment each route remembers to append.NX/services/nexus-auth/internal/authz/openfga_client.goSeeded and pure is what makes a run admissible to re-execute; an unseeded run is a number, not evidence.ROS/src/services/gtm-genesis/blueprint/MonteCarloEngine.tsWhich pillars answer it
P6 · for the Model Risk Lead
Validation-Evidence Autopilot
The annual validation dossier compiles itself, out of runs that were reproducible on the day they happened — rather than being reconstructed once a year from memory and spreadsheets.
The ledger you read is the one the cedant keeps for their own validation — seeded runs, logged judgements, champion–challenger records — not a document written for a renewal.
ROS/src/services/gtm-genesis/blueprint/MonteCarloEngine.tsP5 · for the Chief Compliance Officer
One-Log, Many-Regulator Evidence Fabric
One governed event stream compiles into every regulator’s artefact, instead of four teams reconstructing four different stories from the same week.
The read-seat is a scoped projection of one governed event stream, so what you see and what their supervisor sees are the same thread, cut differently.
NX/services/nexus-workflows/src/services/governance.tsP3 · for the Chief Risk Officer
Cross-Model Computed Gate → Sealed Certificate
Two or more heterogeneous models re-derive the answer. A computed — not learned — agreement predicate must pass before anything is released, and the inputs and model versions are sealed into the record.
Decisions in that book carry the verdict of a cross-model gate, with predicate inputs and model versions sealed alongside them.
NCT/services/nexus-workflows/src/services/tool-executors/sentinel-executors.tsHow a scoped seat compares to a confidence pack
A seat onto the ledger is a stronger artefact than a pack, and it is still not a substitute for your own view of the book. The material behind it is one governed stream, read by both sides.
REFUSED
A read-seat that cannot express whose data it is reading refuses to read at all — no placeholder identifier, no silent portfolio-wide read.
A seat that quietly widened would be worthless to you and dangerous to the cedant. Because it refuses instead, both sides can prove the same thing: you can show what you were entitled to see, and they can show what you were not.
What you can do next
Your sign-in is valid but names no workspace, and signing in again will not change that. Ask an admin of your organisation to add you to a workspace, then try again here.
Details for support
SCOPE_PREDICATE_MISSING
Start with one cedant, one treaty year
A read-seat is provisioned by the cedant, scoped to what they agree to show, and revocable by them. Nothing moves out of their tenant. What changes at the next renewal is that the conversation starts from a ledger you both read rather than a document one of you wrote.