Fintech: Insurance Claims Approval

End-to-end governed claims approval pipeline with policy, execution, and audit trail

Overview

This guide walks through a complete insurance claims approval system using Parmana Systems. Every claim decision is governed by a versioned policy, produces a signed attestation, and is independently verifiable by compliance teams without access to the production system.

Key requirements this solves:

• Every approval/rejection must be traceable to a specific policy version
• Decisions must be tamper-evident — regulators must be able to verify decisions post-hoc
• High-risk claims must be escalated for human review rather than auto-rejected
• VIP customers have a fast-track path that bypasses standard risk scoring

---

Policy definition

Save this as policies/claims-approval/v1/policy.json:

{
  "policyId": "claims-approval",
  "policyVersion": "v1",
  "schemaVersion": "1.0.0",

  "signalsSchema": {
    "insurance_active": { "type": "boolean" },
    "risk_score":       { "type": "integer" },
    "vip_customer":     { "type": "boolean" },
    "claim_amount":     { "type": "integer" }
  },

  "rules": [
    {
      "id": "high-risk-reject",
      "condition": { "signal": "risk_score", "greater_than": 80 },
      "outcome": {
        "action": "reject",
        "requires_override": false,
        "reason": "risk_score_exceeded_threshold"
      }
    },
    {
      "id": "vip-fast-track",
      "condition": { "signal": "vip_customer", "equals": true },
      "outcome": {
        "action": "approve",
        "requires_override": false,
        "reason": "vip_customer_approved"
      }
    },
    {
      "id": "standard-approval",
      "condition": {
        "all": [
          { "signal": "insurance_active", "equals": true },
          { "signal": "risk_score",       "less_than": 70 }
        ]
      },
      "outcome": {
        "action": "approve",
        "requires_override": false,
        "reason": "standard_approval"
      }
    },
    {
      "id": "catch-all-reject",
      "condition": { "all": [] },
      "outcome": {
        "action": "reject",
        "requires_override": true,
        "reason": "policy_requirements_not_satisfied"
      }
    }
  ]
}

---

Execution code

import crypto from "crypto";
import {
  executeFromSignals,
  LocalSigner,
  LocalVerifier,
  MemoryReplayStore,
} from "@parmanasystems/core";

const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519", {
  privateKeyEncoding: { type: "pkcs8", format: "pem" },
  publicKeyEncoding:  { type: "spki",  format: "pem" },
});

const signer      = new LocalSigner(privateKey);
const verifier    = new LocalVerifier(publicKey);
const replayStore = new MemoryReplayStore();

// --- Claim 1: Standard approval ---
const claim1 = await executeFromSignals(
  {
    policyId:      "claims-approval",
    policyVersion: "v1",
    signals: {
      insurance_active: true,
      risk_score:       42,
      vip_customer:     false,
      claim_amount:     8500,
    },
  },
  signer, verifier, replayStore
);

console.log(claim1.execution_state);
// "completed"
console.log(claim1.decision.reason);
// "standard_approval"

// --- Claim 2: High-risk auto-reject ---
const claim2 = await executeFromSignals(
  {
    policyId:      "claims-approval",
    policyVersion: "v1",
    signals: {
      insurance_active: true,
      risk_score:       91,   // exceeds threshold of 80
      vip_customer:     false,
      claim_amount:     75000,
    },
  },
  signer, verifier, replayStore
);

console.log(claim2.execution_state);
// "blocked"
console.log(claim2.decision.reason);
// "risk_score_exceeded_threshold"

// --- Claim 3: Catch-all → escalation required ---
const claim3 = await executeFromSignals(
  {
    policyId:      "claims-approval",
    policyVersion: "v1",
    signals: {
      insurance_active: false,  // insurance not active
      risk_score:       55,
      vip_customer:     false,
      claim_amount:     12000,
    },
  },
  signer, verifier, replayStore
);

console.log(claim3.execution_state);
// "pending_override"
console.log(claim3.decision.requires_override);
// true — route to human review queue

---

Storing the audit trail

Each attestation can be persisted to PostgreSQL via @parmanasystems/audit-db:

import { AuditDb } from "@parmanasystems/audit-db";

const db = new AuditDb({ connectionString: process.env.DATABASE_URL });

await db.recordDecision(claim1);
// Stores executionId, policyId, policyVersion, decision, execution_state, signature

Compliance queries against this table are independently reproducible — the signature field proves the record has not been modified since it was written.

---

Regulatory audit workflow

When a regulator requests documentation for a specific claim:

# 1. Export the verification artifact
npm run proof:verify -- --executionId a3f2b1c4...

# 2. Verify the artifact independently
parmana verify artifact ./artifacts/reproducibility/verification.json

# Output:
# [VERIFY] Verification Artifact
# Artifact: ./artifacts/...
# ✓ signature_verified
# ✓ runtime_manifest_verified
# ✓ bundle_manifest_verified
# ✓ attestation_signature_verified
# ✓ invariants_verified

The verifier requires only the public key and the artifact — no production system access needed.

---

Decision matrix

Signals	Matched rule	execution_state	requires_override
risk_score > 80	high-risk-reject	blocked	false
vip_customer = true	vip-fast-track	completed	false
insurance_active = true AND risk_score < 70	standard-approval	completed	false
Everything else	catch-all-reject	pending_override	true