Home · Work

Systems Work · No. 24

Claims Evidence Integrity

Rajesh Ranjan Mahapatra

A multi-agent verification layer for insurance cases that checks every artefact against the policy and the loss event, keeps fraud signalling in two clearly separated layers, and leaves every disposition with a human case handler.

Start reading
Systems WorkCase study

© 2026 Rajesh Ranjan Mahapatra. 6 min read

Claims Evidence IntegrityAll Systems Work
Home · Work

Claims Evidence Integrity

A multi-agent verification layer for insurance cases that checks every artefact against the policy and the loss event, keeps fraud signalling in two clearly separated layers, and leaves every disposition with a human case handler.

Challenge

A major insurer receives a claim as a bundle of artefacts: forms, photographs, invoices, repair estimates, medical notes, incident reports.

Architectural move

Models reason over structure with provenance attached, never over raw scans.

Control boundary

The two-layer split is the control.

Outcome

The programme took the design through build and assurance for a major insurer.

FIG.00 // SYSTEM MAPREJECTED PATHHUMAN AUTHORITYAGENTMODELDETERMINISTICSIGNAL / DATAIN · 01Claim artefactsforms, photos, invoices,estimates, medicalnotes, incident reportsDET · 02Documentintelligencetyped evidence objectswith provenanceAGT · 03Narrow verificationagentsprovenance · arithmetic· timeline · coverageDET · 04Consistency stagetriangulates claim,policy and loss eventL1 · 05Deterministic fraudrulesthe only layer allowedto assertL2 · 06Model signal layerranked, citedobservations; noverdictsHUM · 07Case handlerpays, queries or refersFINDINGSCITED DOSSIERBELOW BAREXCException pathlow-confidenceextraction routed tohuman correctionSYS/CEIL · FIG.00 · SCHEMATIC · NOT TO SCALE
FIG.00 // SYSTEM MAPSIGNAL / DATADETERMINISTICAGENTMODELHUMAN AUTHORITYREJECTED PATHIN · 01Claim artefactsforms, photos, invoices, estimates, medicalnotes, incident reportsDET · 02Document intelligencetyped evidence objects with provenanceAGT · 03Narrow verification agentsprovenance · arithmetic · timeline · coverageFINDINGSDET · 04Consistency stagetriangulates claim, policy and loss eventL1 · 05Deterministic fraud rulesthe only layer allowed to assertL2 · 06Model signal layerranked, cited observations; no verdictsCITED DOSSIERHUM · 07Case handlerpays, queries or refersBELOW BAREXCException pathlow-confidence extraction routed to humancorrectionSYS/CEIL · FIG.00 · SCHEMATIC
FIG.00 System map. Artefacts become typed evidence, narrow agents verify, two fraud layers with different rights compose a cited dossier, and the handler decides.

The problem

FIG.01 // THE PROBLEMGATEDETERMINISTICSIGNAL / DATALOSS EVENTPOLICYARTEFACTLEAKAGEARTEFACTEach document on its ownreading any single document is rarely the workPOLICYAgreement with the policyan exclusion nobody surfaced until the claim was paidLOSS EVENTAgreement with the loss as describedan invoice dated before the loss, damage inconsistentwith the perilLEAKAGE LIVES IN THE CROSS-CHECKSSYS/CEIL · FIG.01 · SCHEMATIC · NOT TO SCALE
FIG.01 // THE PROBLEMSIGNAL / DATADETERMINISTICGATELOSS EVENTPOLICYARTEFACTLEAKAGEARTEFACTEach document on its ownreading any single document is rarely the workPOLICYAgreement with the policyan exclusion nobody surfaced until the claimwas paidLOSS EVENTAgreement with the loss as describedan invoice dated before the loss, damageinconsistent with the perilLEAKAGE LIVES IN THE CROSS-CHECKSSYS/CEIL · FIG.01 · SCHEMATIC
FIG.01 The problem. The handler's real work is checking that documents agree with each other, the policy and the loss event; that is where leakage lives.

A major insurer receives a claim as a bundle of artefacts: forms, photographs, invoices, repair estimates, medical notes, incident reports. The handler's real work is rarely reading any single document. It is checking whether the documents agree with each other, with the policy, and with the loss event as described. That cross-checking is slow and uneven, and it is exactly where leakage lives: an invoice dated before the loss, damage inconsistent with the peril claimed, an exclusion nobody surfaced until the claim was already paid.

I designed the architecture for a claims evidence integrity layer: multi-agent verification of claim artefacts, consistency checking across claim, policy and loss event, and fraud signalling split into deterministic and model layers, all feeding a human case handlers who makes the decision. Teams I worked with took it through build and assurance.

Why it was hard

FIG.02 // WHY IT WAS HARDREJECTED PATHGATEMODELSIGNAL / DATAMISSA genuine inconsistencymissedthe insurer pays a claim itshould have queriedASYMMETRYProve versus noticethe system must know what it canprove and what it can only observeFALSE ASSERTAn inconsistency that isnot therean honest customer treated as asuspect: a conduct harm→ LEAKAGECONDUCT HARM ←TERRAIN EVERY OPTION MUST SURVIVEHZ · 01Hostile artefactsphotographed documents, handwrittenforms, estimates in a hundred formatsHZ · 02Fluent suspiciona model's confidence does notcorrelate with its evidenceHZ · 03Explainable per claimfraud reasoning must hold claim byclaimSYS/CEIL · FIG.02 · SCHEMATIC · NOT TO SCALE
FIG.02 // WHY IT WAS HARDSIGNAL / DATAMODELGATEREJECTED PATHMISSA genuine inconsistency missedthe insurer pays a claim it should havequeried↑ LEAKAGEASYMMETRYProve versus noticethe system must know what it can prove andwhat it can only observe↓ CONDUCT HARMFALSE ASSERTAn inconsistency that is not therean honest customer treated as a suspect: aconduct harmTERRAIN EVERY OPTION MUST SURVIVEHZ · 01Hostile artefactsphotographed documents, handwritten forms,estimates in a hundred formatsHZ · 02Fluent suspiciona model's confidence does not correlate withits evidenceHZ · 03Explainable per claimfraud reasoning must hold claim by claimSYS/CEIL · FIG.02 · SCHEMATIC
FIG.02 Why it was hard. Consistency judgments carry consequences in both directions, and the wrong one is a conduct harm, not a quality defect.

The artefacts are hostile to automation. Photographs of documents, scanned forms filled by hand, estimates in a hundred formats. Extraction alone was never the hard part; the hard part is that consistency judgments carry consequences in both directions. Miss a genuine inconsistency and the insurer pays a claim it should have queried. Assert an inconsistency that is not there and an honest customer is treated as a suspect, which is a conduct harm, not a quality defect.

That asymmetry shaped everything. A model that fluently narrates suspicion is the most dangerous component you can put in a claims pipeline, because its confidence does not correlate with its evidence. Fraud reasoning had to be explainable claim by claim, and the system had to know the difference between what it could prove and what it could only notice.

Key decisions

FIG.03 // KEY DECISIONSHUMAN AUTHORITYAGENTMODELDETERMINISTICSIGNAL / DATAD · 01Typed evidence firstNormalisedbefore reasoningProvenanceattachedNever raw scansD · 02Narrow agentsProvenanceArithmeticTimelineCoverageD · 03Layer 1 assertsDates ·arithmeticDuplicatesPolicy termsRule ID on everyassertionD · 04Layer 2 observesRanked, citedobservationsCannot issue averdictD · 05Handler disposesDossier + openquestionsPay · query ·referTYPED OBJECTSFINDINGS CITING BOTH SIDESWHAT REMAINSVERIFIED DOSSIERSYS/CEIL · FIG.03 · SCHEMATIC · NOT TO SCALE
FIG.03 // KEY DECISIONSSIGNAL / DATADETERMINISTICAGENTMODELHUMAN AUTHORITYD · 01Typed evidence firstNormalised before reasoningProvenance attachedNever raw scansD · 02Narrow agentsProvenanceArithmeticTimelineCoverageD · 03Layer 1 assertsDates · arithmeticDuplicatesPolicy termsRule ID on every assertionD · 04Layer 2 observesRanked, cited observationsCannot issue a verdictD · 05Handler disposesDossier + open questionsPay · query · referTYPED OBJECTSFINDINGS CITING BOTH SIDESWHAT REMAINSVERIFIED DOSSIERSYS/CEIL · FIG.03 · SCHEMATIC
FIG.03 Key decisions. Two fraud layers with different rights; every inconsistency cites both sides, and an uncited finding does not exist.

Every artefact is normalised into typed evidence objects by the platform's document intelligence services before any reasoning runs. Models reason over structure with provenance attached, never over raw scans.

Verification is a set of narrow agents, each owning one question: provenance, arithmetic, timeline, coverage. Narrow agents are individually testable against labelled cases, which a single broad reviewer never is.

Fraud signals live in two layers with different rights. The deterministic layer, dates, arithmetic, duplicate detection, policy terms, is the only layer allowed to assert, and every assertion carries a rule identifier. The model layer produces ranked, cited observations and is structurally incapable of issuing a verdict.

Every inconsistency must cite both sides: the claim artefact and the policy clause or loss fact it conflicts with. An uncited finding does not exist.

The disposition is never automated. The pipeline produces a verified dossier with open questions; the handler pays, queries or refers.

Architecture

FIG.04 // ARCHITECTUREREJECTED PATHSTORE / RECORDHUMAN AUTHORITYAGENTMODELDETERMINISTICSIGNAL / DATAAZ · 01Claim workspaceartefacts landAZ · 02Documentintelligencetyped evidence objectsAZ · 03Orchestrationfan-outverification agents onmanaged model endpointsAZ · 04Consistency stageclaim · policy · losseventAZ · 05Deterministic rulesrun firstAZ · 06Model layer ranksthe restAZ · 07Cited dossier to thehandlerLOW CONFIDENCEEXCException patha wrong date in thetimeline poisons everylater findingSYS/CEIL · FIG.04 · SCHEMATIC · NOT TO SCALE
FIG.04 // ARCHITECTUREDETERMINISTICAGENTMODELHUMAN AUTHORITYSTORE / RECORDREJECTED PATHAZ · 01Claim workspaceartefacts landAZ · 02Document intelligencetyped evidence objectsAZ · 03Orchestration fan-outverification agents on managed model endpointsAZ · 04Consistency stageclaim · policy · loss eventAZ · 05Deterministic rules run firstAZ · 06Model layer ranks the restAZ · 07Cited dossier to the handlerLOW CONFIDENCEEXCException patha wrong date in the timeline poisons everylater findingSYS/CEIL · FIG.04 · SCHEMATIC
FIG.04 Architecture. On the insurer's Azure estate; low-confidence extractions never propagate.

The pipeline runs on the insurer's Azure estate. Artefacts land in a claim workspace, document intelligence services produce typed evidence objects, and an orchestration layer fans verification agents out across managed model endpoints. A consistency stage triangulates claim, policy and loss event. Deterministic fraud rules run first, the model signal layer ranks what remains, and everything composes into a cited dossier for the handler.

Low-confidence extractions never propagate. An evidence object below the confidence bar routes to an exception path for human correction rather than flowing onward as a guess, because a wrong date entering the timeline check poisons every downstream finding.

Trade-offs

FIG.05 // TRADE-OFFSREJECTED PATHGATEDETERMINISTIC▼ PAYSDESIGN CHOICE▲ BUYSMore orchestration than onebroad reviewerT-01Narrow verification agentsA labelled test set andmeasurable error rate peragentSome genuine fraud rankedrather than flaggedT-02Verdict-free model layerErrs on the right side of theasymmetryCaps the throughput gainT-03Human gateMakes the handler's hourcountASSURANCE CONSUMES ERROR RATES, NOT ELOQUENCESYS/CEIL · FIG.05 · SCHEMATIC · NOT TO SCALE
FIG.05 // TRADE-OFFSDETERMINISTICGATEREJECTED PATHT-01Narrow verification agents▼ PAYSMoreorchestrationthan one broadreviewer▲ BUYSA labelled testset andmeasurable errorrate per agentT-02Verdict-free model layer▼ PAYSSome genuinefraud rankedrather thanflagged▲ BUYSErrs on theright side ofthe asymmetryT-03Human gate▼ PAYSCaps thethroughput gain▲ BUYSMakes thehandler's hourcountASSURANCE CONSUMES ERROR RATES, NOTELOQUENCESYS/CEIL · FIG.05 · SCHEMATIC
FIG.05 Trade-offs. Every cost is paid deliberately for something assurance can measure.

Narrow verification agents multiply orchestration compared with one broad reviewer, and that cost is paid gladly: each agent has a labelled test set and a measurable error rate, which is what assurance actually consumes. Keeping the model layer verdict-free leaves some genuine fraud ranked rather than flagged, and that is the right side of the asymmetry to err on. The human gate caps the throughput gain, deliberately; the system's job is to make the handler's hour count, not to remove the handler.

Governance

FIG.06 // GOVERNANCEREJECTED PATHSTORE / RECORDMODELDETERMINISTICCONTROLMECHANISMSTATEAdverse outcomes trace to a ruleRule identifier, version and owner on every assertionSPINEModel output is advisoryContext around the deterministic spine, never a verdictADVISORYEvery finding carries citationsClaim artefact and the clause or loss fact it conflictswithBLOCKINGException path is a designed stateLow-confidence objects routed to human correctionDESIGNEDCertified patternEvaluation pack and control mapping from historicalclaimsCERTIFIEDSYS/CEIL · FIG.06 · SCHEMATIC · NOT TO SCALE
FIG.06 // GOVERNANCEDETERMINISTICMODELSTORE / RECORDREJECTED PATHSPINEAdverse outcomes trace to a ruleRule identifier, version and owner on everyassertionADVISORYModel output is advisoryContext around the deterministic spine, nevera verdictBLOCKINGEvery finding carries citationsClaim artefact and the clause or loss fact itconflicts withDESIGNEDException path is a designed stateLow-confidence objects routed to humancorrectionCERTIFIEDCertified patternEvaluation pack and control mapping fromhistorical claimsSYS/CEIL · FIG.06 · SCHEMATIC
FIG.06 Governance. The two-layer split is the control.

The two-layer split is the control. Anything that can affect a customer adversely traces to a deterministic rule with an identifier, a version and an owner; model output is advisory context around that spine. Every finding carries its citations, the exception path is a designed state rather than a failure, and the whole pattern shipped as a certified pattern with its evaluation pack and control mapping, built from historical claims with known outcomes.

Outcome

FIG.07 // OUTCOMEDETERMINISTICSIGNAL / DATAHANDLER RECEIVESunchecked bundleCited dossierCHECKING DONE, OPEN QUESTIONS SURFACEDFRAUD CONVERSATIONgut feelEvidenceTHAT SURVIVES CHALLENGETWO-LAYER SIGNALLING REUSED FORAdjacent document-heavy verification workTAKEN THROUGH BUILD AND ASSURANCE FOR A MAJOR INSURERSYS/CEIL · FIG.07 · SCHEMATIC · NOT TO SCALE
FIG.07 // OUTCOMESIGNAL / DATADETERMINISTICHANDLER RECEIVESunchecked bundleCited dossierCHECKING DONE, OPEN QUESTIONS SURFACEDFRAUD CONVERSATIONgut feelEvidenceTHAT SURVIVES CHALLENGETWO-LAYER SIGNALLING REUSED FORAdjacent document-heavy verification workTAKEN THROUGH BUILD AND ASSURANCEFOR A MAJOR INSURERSYS/CEIL · FIG.07 · SCHEMATIC
FIG.07 Outcome. Handlers get a dossier in which the checking is already done and cited.

The programme took the design through build and assurance for a major insurer. Handlers receive a dossier in which the checking is already done and cited, with open questions surfaced instead of buried, and the fraud conversation moved from gut feel to evidence that survives challenge. The two-layer signalling pattern has since been reused for adjacent document-heavy verification work.

What I learned

FIG.08 // WHAT I LEARNEDREJECTED PATHGATEDETERMINISTICAX-01Assert versus observeOnce a model can accuse, no promptdiscipline fixes the control.AX-02Consistency is the productNot extraction: in claims work thevalue is in the cross-checks.AX-03Design the exception queue onday oneOn day one it is governance; bolted onlater it is an apology.SYS/CEIL · FIG.08 · SCHEMATIC · NOT TO SCALE
FIG.08 // WHAT I LEARNEDDETERMINISTICGATEREJECTED PATHAX-01Assert versus observeOnce a model can accuse, no promptdiscipline fixes the control.AX-02Consistency is the productNot extraction: in claims work the value is inthe cross-checks.AX-03Design the exception queue on day oneOn day one it is governance; bolted on laterit is an apology.SYS/CEIL · FIG.08 · SCHEMATIC
FIG.08 What I learned. Three lessons from the engagement.

The most important line in the design is the one between asserting and observing; once a model can accuse, you have built an unexplainable control and no amount of prompt discipline fixes that. Consistency, not extraction, is the product in claims work. And an exception queue designed on day one is governance; the same queue bolted on later is an apology.