Autonomous Pricing & Capital Optimization

Record Types

Ten wire record types ship, each with a validator. Each record is a serde struct with deny_unknown_fields and a Signed<Name> alias for SignedExportEnvelope<Name>, e.g. SignedAutonomousPricingDecision. A validator rejects an unknown schema id, an empty required field, a duplicate reference, or a non-uppercase currency code.

Evidence References

Automation is evidence-referential. A pricing input, an explanation factor, and a drift signal all cite prior Chio truth through an AutonomousEvidenceReference:

pub struct AutonomousEvidenceReference {
    pub kind: AutonomousEvidenceKind,
    pub reference_id: String,
    pub observed_at: Option<u64>,
    pub locator: Option<String>,
}

AutonomousEvidenceKind has eleven variants for the records read by automation: underwriting_decision, exposure_ledger, credit_scorecard, capital_book, credit_facility, credit_loss_lifecycle, web3_settlement_receipt, liability_quote_response, liability_auto_bind_decision, claim_workflow, and runtime_assurance_appraisal. Reference IDs inside one record must be unique; a duplicate is a DuplicateValue error.

Pricing Input

AutonomousPricingInputArtifact is the evidence bundle a decision is computed over. It names the subject, provider, coverage class, and currency, and carries the loss, capital, reputation, and settlement state used by the model. Validation fails closed on missing evidence, mixed currency, or zero capital:

• currency is a three-letter uppercase code, matched by exact string comparison with no case-folding or trimming; the requested coverage amount's currency must equal it.
• receipt_history_window_secs and available_capital_units are non-zero, and reputation_score_bps is at most 10000.
• evidence_refs must include, at minimum, underwriting_decision, exposure_ledger, credit_scorecard, and capital_book evidence.
• Any non-zero pending_loss_units or settled_loss_units forces a credit_loss_lifecycle reference; a set latest_web3_settlement_state forces a web3_settlement_receipt reference. A claimed loss or settlement state without the matching evidence is an UnknownReference error.

The support boundary is explicit on the input and defaults to the default configuration delegated_authority_required, reserve_optimization_required, with bind and operator override supported.

Authority Envelope

The authority envelope is the signed grant that bounds every decision. It names the subject, provider, and currency, the permitted_actions automation may take, the coverage and premium ceilings, the rate-change and daily-decision caps, and the review thresholds. Three envelope kinds ship ( operator_policy, regulated_role, and delegated_market_authority) and three automation modes: shadow, advisory, and active.

{
  "schema": "chio.autonomous-pricing-authority-envelope.v1",
  "envelope_id": "ape-1",
  "issued_at": 1743379200,
  "subject_key": "subject-1",
  "provider_id": "carrier-1",
  "currency": "USD",
  "kind": "delegated_market_authority",
  "automation_mode": "active",
  "permitted_actions": ["reprice", "renew", "decline", "bind"],
  "authority_chain_refs": [
    "underwriting-committee-approval",
    "operator-treasury-approval"
  ],
  "max_coverage_amount": { "units": 150000, "currency": "USD" },
  "max_premium_amount": { "units": 6000, "currency": "USD" },
  "max_rate_change_bps": 750,
  "max_daily_decisions": 20,
  "requires_human_review_for_bind": false,
  "requires_human_review_above_premium": { "units": 5000, "currency": "USD" },
  "delegated_authority_reference": "lpa-1",
  "not_before": 1743379200,
  "not_after": 1743465600,
  "support_boundary": {
    "delegated_authority_required": true,
    "live_bind_supported": true,
    "reserve_optimization_required": true,
    "operator_override_supported": true
  }
}

Envelope validation enforces:

• permitted_actions and authority_chain_refs are non-empty and free of duplicates.
• max_coverage_amount, max_premium_amount, and any requires_human_review_above_premium threshold share the envelope currency; the review threshold cannot exceed max_premium_amount.
• max_rate_change_bps is between 1 and 10000, max_daily_decisions is non-zero, and not_before is strictly earlier than not_after.
• A regulated_role envelope names its role; a delegated_market_authority envelope names its delegation reference.
• Only an active envelope may list bind in permitted_actions. A shadow or advisory envelope that permits bind is rejected with InvalidEnvelope.

Pricing Decision

AutonomousPricingDecisionArtifact embeds its own pricing input, authority envelope, and model provenance, so a verifier revalidates the whole chain in one pass. It carries a disposition (reprice, renew, decline, bind_within_envelope, manual_review), a review_state (auto_approved, human_review_required, shadow_only, blocked), suggested coverage and premium, a confidence score, and the weighted explanation factors behind the price.

Beyond the recursive input and envelope checks, the decision fails closed when automation steps outside the grant:

• The input's subject, provider, and currency must match the envelope, and both suggested amounts must be denominated in the envelope currency.
• suggested_coverage_amount and suggested_premium_amount cannot exceed the envelope ceilings. confidence_bps and every factor's weight_bps are between 1 and 10000, and explanation factor codes are unique.
• Shadow-mode alignment is biconditional: a shadow envelope forces review_state: shadow_only, and shadow_only requires a shadow envelope.
• A manual_review disposition cannot be auto_approved, and an auto-approved premium cannot exceed the envelope's human-review premium threshold.
• A bind_within_envelope disposition requires bind permission, live_bind_supported on the envelope support boundary, and, when the envelope sets requires_human_review_for_bind , a review state other than auto_approved.

Model provenance is checked too: model_id, model_version, engine_family, input_hash, and explanation_version are non-empty, and training_cutoff is no later than published_at.

Capital-Pool Optimization

Reserve and capital changes are explicit records, not hidden model side effects. CapitalPoolOptimizationArtifact references the pricing decision and capital book it acts on, names the facilities in scope, sets the target reserve ratio, facility-utilization cap, and bind-capacity ceiling, and lists recommendations.

{
  "schema": "chio.capital-pool-optimization.v1",
  "optimization_id": "cpo-1",
  "issued_at": 1743379320,
  "subject_key": "subject-1",
  "currency": "USD",
  "pricing_decision_ref": "apd-1",
  "capital_book_ref": "cb-1",
  "facility_refs": ["facility-1", "facility-2"],
  "pending_claim_refs": ["claim-1"],
  "target_reserve_ratio_bps": 3500,
  "max_facility_utilization_bps": 7000,
  "max_bind_capacity_units": 250000,
  "recommendations": [
    {
      "action": "increase_reserve",
      "source_ref": "pool:primary",
      "amount": { "units": 25000, "currency": "USD" },
      "rationale": "Raise reserve coverage before new autonomous binds."
    },
    {
      "action": "shift_capacity",
      "source_ref": "facility-2",
      "destination_ref": "facility-1",
      "amount": { "units": 15000, "currency": "USD" },
      "rationale": "Move capacity toward the lower-loss facility."
    }
  ],
  "support_boundary": {
    "live_mutation_supported": false,
    "scenario_comparison_supported": true,
    "cross_currency_optimization_supported": false,
    "web3_reconciliation_required": true,
    "operator_override_required": true
  }
}

Recommendation actions are increase_reserve, decrease_reserve, shift_capacity, hold_capacity, and defer_claim. Validation requires unique facility_refs and pending_claim_refs, the two ratio ceilings between 1 and 10000, a non-zero max_bind_capacity_units, and at least one recommendation. Each recommendation carries a positive amount in the optimization currency, and a shift_capacity recommendation must name a destination_ref. The default support boundary keeps live_mutation_supported false and operator_override_required true: the record recommends; the operator moves capital.

CapitalPoolSimulationReport pairs a baseline optimization with a candidate one and reports the deltas between them under a what_if or shadow mode. Both optimizations are revalidated; they must share the report's subject and currency, carry distinct optimization ids, and set scenario_comparison_supported. The report closes with a non-empty recommended_operator_action and does not mutate a live position.

Execution

AutonomousExecutionDecisionArtifact is where a decision becomes an action. It references the pricing decision, optimization, and authority envelope by id, records the action taken and a lifecycle_state (prepared, executed, interrupted, rolled_back, blocked), the safety gates it cleared, and the rollback control that keeps it interruptible.

{
  "schema": "chio.autonomous-execution-decision.v1",
  "execution_id": "aed-1",
  "issued_at": 1743379440,
  "pricing_decision_ref": "apd-1",
  "optimization_ref": "cpo-1",
  "authority_envelope_ref": "ape-1",
  "subject_key": "subject-1",
  "provider_id": "carrier-1",
  "currency": "USD",
  "action": "bind",
  "lifecycle_state": "executed",
  "quote_response_ref": "quote-response-1",
  "auto_bind_decision_ref": "auto-bind-1",
  "bound_coverage_ref": "bound-coverage-1",
  "settlement_dispatch_ref": "dispatch-web3-1",
  "safety_gates": [
    {
      "name": "authority-within-envelope",
      "passed": true,
      "description": "Coverage and premium remain inside the active authority envelope."
    },
    {
      "name": "capital-headroom",
      "passed": true,
      "description": "Capital-pool optimization preserved minimum reserve headroom."
    }
  ],
  "rollback_control": {
    "rollback_plan_ref": "arp-1",
    "interruptible": true,
    "human_interrupt_contact": "ops@chio.example"
  }
}

The lifecycle state is gated on the gates: executed requires every safety gate to pass, and blocked requires at least one to fail. Gate names are unique, and the rollback control names both a plan reference and a human interrupt contact. The embedded reference set is action-specific:

• reprice and renew carry a quote_response_ref and cannot embed any bind or settlement reference.
• decline cannot embed any bind or settlement reference.
• bind requires a quote_response_ref, auto_bind_decision_ref, and bound_coverage_ref; an executed bind additionally requires a settlement_dispatch_ref onto the official web3 lane.

The quote_response_ref, auto_bind_decision_ref, and bound_coverage_ref point back into the liability market workflow; the settlement_dispatch_ref points at on-chain settlement. Automation never dispatches settlement of its own authority.

Rollback & Drift

AutonomousRollbackPlanArtifact names a safe state to fall back to ( shadow_mode_only, delegated_only, bind_disabled, or full_pause) the drift triggers that engage it, and the actions it takes (for example switch_to_safe_state, cancel_pending_execution, require_human_approval). Both lists are non-empty and duplicate-free.

AutonomousDriftReport embeds its rollback plan and a comparison report, then lists the observed drift signals. Each signal has a kind (loss_ratio_spike, premium_variance, capital_utilization, settlement_failure_rate, override_rate, model_version_mismatch, evidence_staleness), a severity of warning or critical, and an observed value against a non-zero threshold.

"drift_signals": [
  {
    "kind": "settlement_failure_rate",
    "severity": "critical",
    "metric_name": "failed_settlement_rate_bps",
    "observed_value": 275,
    "threshold_value": 100,
    "description": "Settlement failures exceeded the automation safe-state threshold."
  }
],
"rollback_plan": {
  "safe_state": "delegated_only",
  "triggers": ["settlement_failure_rate", "premium_variance"],
  "actions": ["switch_to_safe_state", "cancel_pending_execution", "require_human_approval"]
},
"fail_safe_engaged": true

Comparison Report

AutonomousComparisonReport holds an automated decision against a comparable manual one. Its disposition is match, narrower_than_manual, wider_than_manual, or manual_override. Any disposition other than match requires at least one delta, each field non-empty, and a manual_override requires an override_reference. This is the record that compares automated pricing with its manual baseline.

Qualification & Bounded Claim

AutonomousQualificationMatrix records the profile's bounded claim as a set of cases, each tying one or more requirement ids to an expected and observed outcome of pass or fail_closed. The shipped matrix (docs/standards/CHIO_AUTONOMOUS_QUALIFICATION_MATRIX.json) qualifies four claims:

• autonomous pricing stays bounded by explicit authority envelopes;
• capital-pool optimization remains simulation-backed and override-ready;
• automatic bind execution stays interruptible and rollback-safe;
• critical drift triggers a fail-safe rollback without hidden widening.

The profile is deliberately narrow. It does not claim open-ended insurer-network automation, hidden model authority outside the signed envelope family, permissionless dispatch beyond the official Chio web3 lane, or autonomous trust widening from imported evidence or external execution alone. Validators enforce each boundary.

Error Model

Every validator returns Result<(), AutonomyContractError>. The error is a closed thiserror enum, so callers match on the variant instead of parsing a message:

pub enum AutonomyContractError {
    UnsupportedSchema(String),
    MissingField(&'static str),
    DuplicateValue(String),
    UnknownReference(String),
    InvalidEnvelope(String),
    InvalidDecision(String),
    InvalidOptimization(String),
    InvalidExecution(String),
    InvalidDrift(String),
    InvalidQualificationCase(String),
}

Validating Records

Deserialize with serde, then call the matching validator. Because the pricing decision and drift report embed their dependencies, validating the outer record revalidates the embedded records.

use chio_autonomy::{
    AutonomousPricingDecisionArtifact, validate_autonomous_pricing_decision,
};

let decision: AutonomousPricingDecisionArtifact =
    serde_json::from_slice(bytes)?;
validate_autonomous_pricing_decision(&decision)?;
// input, authority envelope, and model provenance are all checked here.

The crate's regression test reference_artifacts_parse_and_validate deserializes and validates every reference example under docs/standards/CHIO_AUTONOMOUS_*.json and docs/standards/CHIO_CAPITAL_POOL_*.json, so the JSON on this page is the same JSON the validators are tested against.

cargo test -p chio-autonomy

Next Steps

• Underwriting Risk Taxonomy : the decision evidence a pricing input cites.
• Credit Facilities & Bonds : the capital book and facilities a capital-pool optimization acts on.
• Liability Market : the quote response, auto-bind decision, and bound coverage an execution references.
• On-Chain Settlement : the official web3 lane an executed bind dispatches onto.
• Credit Scorecards : the scorecard evidence that shapes automated confidence.