Autonomous Pricing & Capital Optimization

Let a pricing model reprice, renew, decline, or bind coverage while signed envelopes bound every decision and drift forces rollback.

On this page

Reprice, renew, decline, and bind decisions can come from a pricing model while the operator keeps the limits. Each decision is a signed record that cites its evidence, stays inside a signed authority envelope, and remains interruptible, with a rollback plan for the drift it can detect.

Your pricing model computes the decision. The chio-autonomy validators check the ten signed records that tie it to evidence, authority, execution gates, and rollback. The decision reads underwriting, credit, and liability-market records and dispatches binds onto the web3 settlement rail, a module that is off by default.

Pricing inside an authority envelopeChoose an outcome.

A decision inside the ceilings may bind

Suggested coverage and premium sit under the envelope's ceilings, in its currency, and the active envelope permits bind. The execution record lists every safety gate it passed, names a rollback plan and a human interrupt contact, and reaches executed only when every gate passes.

One autonomous pricing decision checked against its evidence references and its signed authority envelope, with the outcomes the validators allow. The pricing model's internals and capital-pool optimization are left out.

Every decision cites the evidence it was computed over

A pricing input, an explanation factor, and a drift signal each point at prior Chio records through an AutonomousEvidenceReference. Reference ids inside one record are unique; a duplicate fails with DuplicateValue.

crates/economy/chio-autonomy/src/model.rs183-190rust

pub struct AutonomousEvidenceReference {
    pub kind: AutonomousEvidenceKind,
    pub reference_id: String,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub observed_at: Option<u64>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub locator: Option<String>,
}

AutonomousPricingInputArtifact is the bundle a decision is computed over: the subject, provider, coverage class, and currency, with the loss, capital, reputation, and settlement state the model used. It must cite underwriting_decision, exposure_ledger, credit_scorecard, and capital_book evidence. A non-zero pending or settled loss requires a credit_loss_lifecycle reference, and a recorded web3 settlement state requires a web3_settlement_receipt reference; a claimed state without its evidence fails with UnknownReference.

Read more in Underwriting, which produces the decision evidence a pricing input cites.

The authority envelope bounds what automation may decide

The envelope is the signed grant behind every decision. It names the subject, provider, and currency, the permitted_actions, the coverage and premium ceilings, the rate-change and daily-decision caps, and the review thresholds. Its kind is operator_policy, regulated_role, or delegated_market_authority, and its automation_mode is shadow, advisory, or active.

docs/standards/CHIO_AUTONOMOUS_PRICING_AUTHORITY_ENVELOPE.jsonjson

{
  "schema": "chio.autonomous-pricing-authority-envelope.v1",
  "envelope_id": "ape-1",
  "issued_at": 1743379200,
  "subject_key": "subject-1",
  "provider_id": "carrier-1",
  "currency": "USD",
  "kind": "delegated_market_authority",
  "automation_mode": "active",
  "permitted_actions": [
    "reprice",
    "renew",
    "decline",
    "bind"
  ],
  "authority_chain_refs": [
    "underwriting-committee-approval",
    "operator-treasury-approval"
  ],
  "max_coverage_amount": {
    "units": 150000,
    "currency": "USD"
  },
  "max_premium_amount": {
    "units": 6000,
    "currency": "USD"
  },
  "max_rate_change_bps": 750,
  "max_daily_decisions": 20,
  "requires_human_review_for_bind": false,
  "requires_human_review_above_premium": {
    "units": 5000,
    "currency": "USD"
  },
  "delegated_authority_reference": "lpa-1",
  "not_before": 1743379200,
  "not_after": 1743465600,
  "support_boundary": {
    "delegated_authority_required": true,
    "live_bind_supported": true,
    "reserve_optimization_required": true,
    "operator_override_supported": true
  },
  "note": "Binds automation to one delegated pricing authority envelope."
}

The example envelope is active and permits bind, with a premium ceiling of 6,000 units, human review above 5,000, at most a 750 bps rate change, and 20 decisions a day. Only an active envelope may list bind. A decision embeds its own input, envelope, and model provenance, so a verifier revalidates the whole chain in one pass, and it fails when automation steps outside the grant:

suggested coverage or premium above a ceiling, or in a currency other than the envelope’s, or an input whose subject, provider, or currency differs from it;
an auto-approved premium above the human-review threshold, or a manual_review disposition marked auto_approved;
a shadow envelope without review_state: shadow_only, or shadow_only under any other envelope;
bind_within_envelope without bind permission, without live_bind_supported on the support boundary, or auto-approved when the envelope sets requires_human_review_for_bind.

Read more in Liability coverage, which runs the quote and bind workflow these decisions automate.

Capital moves through explicit records the operator executes

Reserve and capital changes are records of their own. CapitalPoolOptimizationArtifact references the pricing decision and capital book it acts on, names the facilities in scope, sets the target reserve ratio, the facility-utilization cap, and the bind-capacity ceiling, and lists recommendations: increase_reserve, decrease_reserve, shift_capacity, hold_capacity, or defer_claim.

docs/standards/CHIO_CAPITAL_POOL_OPTIMIZATION_EXAMPLE.jsonjson

{
  "schema": "chio.capital-pool-optimization.v1",
  "optimization_id": "cpo-1",
  "issued_at": 1743379320,
  "subject_key": "subject-1",
  "currency": "USD",
  "pricing_decision_ref": "apd-1",
  "capital_book_ref": "cb-1",
  "facility_refs": [
    "facility-1",
    "facility-2"
  ],
  "pending_claim_refs": [
    "claim-1"
  ],
  "target_reserve_ratio_bps": 3500,
  "max_facility_utilization_bps": 7000,
  "max_bind_capacity_units": 250000,
  "recommendations": [
    {
      "action": "increase_reserve",
      "source_ref": "pool:primary",
      "amount": {
        "units": 25000,
        "currency": "USD"
      },
      "rationale": "Raise reserve coverage before new autonomous binds."
    },
    {
      "action": "shift_capacity",
      "source_ref": "facility-2",
      "destination_ref": "facility-1",
      "amount": {
        "units": 15000,
        "currency": "USD"
      },
      "rationale": "Move capacity toward the lower-loss facility."
    }
  ],
  "support_boundary": {
    "live_mutation_supported": false,
    "scenario_comparison_supported": true,
    "cross_currency_optimization_supported": false,
    "web3_reconciliation_required": true,
    "operator_override_required": true
  },
  "note": "Keeps optimization bounded and override-ready."
}

The default support boundary keeps live_mutation_supported false and operator_override_required true: the record recommends, and the operator moves capital. A CapitalPoolSimulationReport sets a baseline optimization beside a candidate under what_if or shadow, revalidates both, reports the deltas, and closes with a recommended_operator_action. The report changes no live position.

Read more in Credit facilities, which owns the capital book and facilities an optimization acts on.

Execution stays interruptible, and critical drift forces rollback

AutonomousExecutionDecisionArtifact is where a decision becomes an action. It names the decision, the optimization, and the envelope by id, the action taken, its lifecycle_state (prepared, executed, interrupted, rolled_back, or blocked), the safety gates it cleared, and a rollback control that names a plan and a human interrupt contact. executed requires every gate to pass; blocked requires at least one to fail. An executed bind dispatches settlement only through its settlement_dispatch_ref.

AutonomousRollbackPlanArtifact names a safe state (shadow_mode_only, delegated_only, bind_disabled, or full_pause), the drift triggers that engage it, and the actions it takes. AutonomousDriftReport embeds that plan and a comparison report, then lists drift signals, each with a kind, a severity of warning or critical, and an observed value against a non-zero threshold.

docs/standards/CHIO_AUTONOMOUS_DRIFT_REPORT_EXAMPLE.jsonjson

{
  "schema": "chio.autonomous-drift-report.v1",
  "drift_report_id": "adr-1",
  "generated_at": 1743379620,
  "subject_key": "subject-1",
  "pricing_decision_ref": "apd-1",
  "optimization_ref": "cpo-1",
  "drift_signals": [
    {
      "kind": "settlement_failure_rate",
      "severity": "critical",
      "metric_name": "failed_settlement_rate_bps",
      "observed_value": 275,
      "threshold_value": 100,
      "description": "Settlement failures exceeded the automation safe-state threshold.",
      "evidence_refs": [
        {
          "kind": "web3_settlement_receipt",
          "reference_id": "receipt-web3-1",
          "observed_at": 1743379000,
          "locator": "web3-settlement:receipt-web3-1"
        }
      ]
    }
  ],
  "rollback_plan": {
    "schema": "chio.autonomous-rollback-plan.v1",
    "plan_id": "arp-1",
    "issued_at": 1743379560,
    "subject_key": "subject-1",
    "safe_state": "delegated_only",
    "triggers": [
      "settlement_failure_rate",
      "premium_variance"
    ],
    "actions": [
      "switch_to_safe_state",
      "cancel_pending_execution",
      "require_human_approval"
    ],
    "requires_operator_ack": true,
    "note": "Falls back to delegated pricing when automation drifts beyond the accepted envelope."
  },
  "comparison_report": {
    "schema": "chio.autonomous-comparison-report.v1",
    "comparison_id": "acr-1",
    "generated_at": 1743379500,
    "pricing_decision_ref": "apd-1",
    "manual_decision_ref": "uwd-manual-1",
    "disposition": "narrower_than_manual",
    "deltas": [
      {
        "field": "premium_units",
        "automated_value": "4800",
        "manual_value": "5100",
        "description": "Automation priced inside the manual ceiling."
      }
    ],
    "note": "Shows automation staying narrower than the comparable manual decision."
  },
  "fail_safe_engaged": true,
  "note": "Fail-safe engaged after settlement drift breached the critical threshold."
}

Any critical signal requires fail_safe_engaged: true, and its kind must appear in the plan’s triggers; otherwise the report fails with InvalidDrift. In the reference report, a settlement failure rate of 275 against a threshold of 100 is critical, the plan lists settlement_failure_rate, and automation falls back to delegated_only.

Automated decisions are measured against manual ones

AutonomousComparisonReport holds an automated decision against a comparable manual one. Its disposition is match, narrower_than_manual, wider_than_manual, or manual_override. Anything but match carries at least one delta with every field filled, and manual_override names its override_reference.

AutonomousQualificationMatrix records the profile’s bounded claim as cases, each tying requirement ids to an expected and an observed outcome of pass or fail_closed. The matrix in docs/standards/CHIO_AUTONOMOUS_QUALIFICATION_MATRIX.json qualifies four claims:

autonomous pricing stays bounded by explicit authority envelopes;
capital-pool optimization remains simulation-backed and override-ready;
automatic bind execution stays interruptible and rollback-safe;
critical drift triggers a fail-safe rollback without hidden widening.

The claim is scoped to the signed envelope family. It excludes open-ended insurer-network automation, model authority outside the envelope, settlement dispatch beyond the Chio web3 settlement rail, and trust widened from imported evidence or external execution alone.

Autonomy records and validators

Record types

Ten wire record types ship, each with a validator. Each is a serde struct with deny_unknown_fields and a Signed<Name> alias for SignedExportEnvelope<Name>, for example SignedAutonomousPricingDecision. A validator rejects an unknown schema id, an empty required field, a duplicate reference, or a currency code that is not uppercase.

Schema id	Record type	Validator
`chio.autonomous-pricing-input.v1`	`AutonomousPricingInputArtifact`	`validate_autonomous_pricing_input`
`chio.autonomous-pricing-authority-envelope.v1`	`AutonomousPricingAuthorityEnvelopeArtifact`	`validate_autonomous_pricing_authority_envelope`
`chio.autonomous-pricing-decision.v1`	`AutonomousPricingDecisionArtifact`	`validate_autonomous_pricing_decision`
`chio.capital-pool-optimization.v1`	`CapitalPoolOptimizationArtifact`	`validate_capital_pool_optimization`
`chio.capital-pool-simulation-report.v1`	`CapitalPoolSimulationReport`	`validate_capital_pool_simulation_report`
`chio.autonomous-execution-decision.v1`	`AutonomousExecutionDecisionArtifact`	`validate_autonomous_execution_decision`
`chio.autonomous-rollback-plan.v1`	`AutonomousRollbackPlanArtifact`	`validate_autonomous_rollback_plan`
`chio.autonomous-comparison-report.v1`	`AutonomousComparisonReport`	`validate_autonomous_comparison_report`
`chio.autonomous-drift-report.v1`	`AutonomousDriftReport`	`validate_autonomous_drift_report`
`chio.autonomous-qualification-matrix.v1`	`AutonomousQualificationMatrix`	`validate_autonomous_qualification_matrix`

Evidence kinds

AutonomousEvidenceKind has eleven variants: underwriting_decision, exposure_ledger, credit_scorecard, capital_book, credit_facility, credit_loss_lifecycle, web3_settlement_receipt, liability_quote_response, liability_auto_bind_decision, claim_workflow, and runtime_assurance_appraisal.

Pricing input rules

currency is a three-letter uppercase code, matched by exact string comparison with no case-folding or trimming; the requested coverage amount’s currency must equal it.
receipt_history_window_secs and available_capital_units are non-zero, and reputation_score_bps is at most 10000.
evidence_refs includes at least underwriting_decision, exposure_ledger, credit_scorecard, and capital_book evidence.
Any non-zero pending_loss_units or settled_loss_units requires a credit_loss_lifecycle reference; a set latest_web3_settlement_state requires a web3_settlement_receipt reference.
The support boundary on the input defaults to delegated_authority_required and reserve_optimization_required, with bind and operator override supported.

Authority envelope rules

permitted_actions and authority_chain_refs are non-empty and free of duplicates.
max_coverage_amount, max_premium_amount, and any requires_human_review_above_premium threshold share the envelope currency, and the review threshold is at most max_premium_amount.
max_rate_change_bps is between 1 and 10000, max_daily_decisions is non-zero, and not_before is strictly earlier than not_after.
A regulated_role envelope names its role; a delegated_market_authority envelope names its delegation reference.
A shadow or advisory envelope that lists bind fails with InvalidEnvelope.

Pricing decision fields

disposition is reprice, renew, decline, bind_within_envelope, or manual_review. review_state is auto_approved, human_review_required, shadow_only, or blocked. The decision also carries suggested coverage and premium, a confidence score, and the weighted explanation factors behind the price.

confidence_bps and every factor’s weight_bps are between 1 and 10000, and explanation factor codes are unique. In the model provenance, model_id, model_version, engine_family, input_hash, and explanation_version are non-empty, and training_cutoff is no later than published_at.

Optimization and simulation rules

An optimization requires unique facility_refs and pending_claim_refs, both ratio ceilings between 1 and 10000, a non-zero max_bind_capacity_units, and at least one recommendation. Each recommendation carries a positive amount in the optimization currency, and shift_capacity names a destination_ref. A simulation’s two optimizations share the report’s subject and currency, carry distinct optimization ids, and set scenario_comparison_supported; its recommended_operator_action is non-empty.

Execution references by action

reprice and renew carry a quote_response_ref and embed no bind or settlement reference.
decline embeds no bind or settlement reference.
bind requires a quote_response_ref, an auto_bind_decision_ref, and a bound_coverage_ref; an executed bind also requires a settlement_dispatch_ref onto the web3 settlement rail.

Gate names are unique. The quote, auto-bind, and bound-coverage references point into the liability market workflow, and the settlement dispatch reference points at on-chain settlement. Rollback plan triggers and actions are non-empty and duplicate-free.

docs/standards/CHIO_AUTONOMOUS_EXECUTION_EXAMPLE.jsonjson

{
  "schema": "chio.autonomous-execution-decision.v1",
  "execution_id": "aed-1",
  "issued_at": 1743379440,
  "pricing_decision_ref": "apd-1",
  "optimization_ref": "cpo-1",
  "authority_envelope_ref": "ape-1",
  "subject_key": "subject-1",
  "provider_id": "carrier-1",
  "currency": "USD",
  "action": "bind",
  "lifecycle_state": "executed",
  "quote_response_ref": "quote-response-1",
  "auto_bind_decision_ref": "auto-bind-1",
  "bound_coverage_ref": "bound-coverage-1",
  "settlement_dispatch_ref": "dispatch-web3-1",
  "safety_gates": [
    {
      "name": "authority-within-envelope",
      "passed": true,
      "description": "Coverage and premium remain inside the active authority envelope."
    },
    {
      "name": "capital-headroom",
      "passed": true,
      "description": "Capital-pool optimization preserved minimum reserve headroom."
    }
  ],
  "rollback_control": {
    "rollback_plan_ref": "arp-1",
    "interruptible": true,
    "human_interrupt_contact": "ops@chio.example"
  },
  "note": "Executes one bounded autonomous bind over the official web3 lane."
}

Drift signal kinds

loss_ratio_spike, premium_variance, capital_utilization, settlement_failure_rate, override_rate, model_version_mismatch, and evidence_staleness. Rollback actions include switch_to_safe_state, cancel_pending_execution, and require_human_approval.

Error model

Every validator returns Result<(), AutonomyContractError>. The error is a closed thiserror enum, so callers match on the variant instead of parsing a message.

crates/economy/chio-autonomy/src/error.rsrust

#[derive(Debug, thiserror::Error, PartialEq, Eq)]
pub enum AutonomyContractError {
    #[error("unsupported schema: {0}")]
    UnsupportedSchema(String),

    #[error("missing field: {0}")]
    MissingField(&'static str),

    #[error("duplicate value: {0}")]
    DuplicateValue(String),

    #[error("unknown reference: {0}")]
    UnknownReference(String),

    #[error("invalid envelope: {0}")]
    InvalidEnvelope(String),

    #[error("invalid decision: {0}")]
    InvalidDecision(String),

    #[error("invalid optimization: {0}")]
    InvalidOptimization(String),

    #[error("invalid execution: {0}")]
    InvalidExecution(String),

    #[error("invalid drift: {0}")]
    InvalidDrift(String),

    #[error("invalid qualification case: {0}")]
    InvalidQualificationCase(String),
}

Validating records

Deserialize with serde, then call the matching validator. The pricing decision and the drift report embed their dependencies, so validating the outer record revalidates the embedded ones.

src/main.rs · in mainrust

use chio_autonomy::{
    AutonomousPricingDecisionArtifact, validate_autonomous_pricing_decision,
};

let bytes = std::fs::read("decision.json")?;
let decision: AutonomousPricingDecisionArtifact = serde_json::from_slice(&bytes)?;
validate_autonomous_pricing_decision(&decision)?;
// The embedded input, authority envelope, and model provenance are checked here.

The crate’s regression test reference_artifacts_parse_and_validate deserializes and validates every reference example under docs/standards/CHIO_AUTONOMOUS_*.json and docs/standards/CHIO_CAPITAL_POOL_*.json, so the JSON on this page is the JSON the validators are tested against. Unit tests are named for the rules they hold, such as pricing_decision_rejects_future_training_cutoff, pricing_input_requires_capital_book_evidence, non_active_authority_cannot_permit_bind, and bind_decision_cannot_auto_approve_when_human_review_required.

Source and profile

Type and field names come from crates/economy/chio-autonomy/src/model.rs and crates/economy/chio-autonomy/src/validation.rs; the integration tests are in crates/economy/chio-autonomy/tests/integration_smoke.rs. docs/standards/CHIO_AUTONOMOUS_PRICING_PROFILE.md specifies the bounded claim, and chio-core re-exports the crate as autonomy.

Next: the evidence a pricing input cites

UnderwritingProduce the signed decision evidence every pricing input must reference.Liability coverageThe quote, auto-bind decision, and bound coverage an execution references.Credit scorecardsThe scorecard evidence behind automated confidence.

PreviousClaims NextOperating an Economy