Liability Coverage
Bind scoped liability coverage for agent work from a provider's quote, inside delegated authority, and keep the signed records a claim files against.
On this page
An operator can put consequential agent work under liability coverage and bind it automatically, inside limits that someone else signed. A provider publishes what it covers, quotes terms for one request, and Chio issues the placement and coverage records only when the quote sits inside delegated binding authority.
The running example is a provider in the us-ny jurisdiction that covers your ToolExecution losses, such as a wrong refund issued through pricing.refund, in USD, up to USD 50,000 per request, with a 60-second quote lifetime.
A quote inside delegated authority binds
The provider quotes USD 10,000 of ToolExecution coverage for a USD 100 premium. The delegated authority permits USD 10,000 of coverage and a USD 120 premium, and the quote is inside its 60-second TTL. Issuance signs a placement for the selected quote and a bound coverage record. Liability coverage.
us-ny configuration; premium collection and claim payment are left out.A provider policy states what it covers and what it needs to see
Each provider publishes one LiabilityJurisdictionPolicy per jurisdiction. The example covers one loss family, quotes in one currency, and asks for three kinds of signed evidence with every request.
let policy = LiabilityJurisdictionPolicy {
jurisdiction: "us-ny".into(),
coverage_classes: vec![LiabilityCoverageClass::ToolExecution],
supported_currencies: vec!["USD".into()],
required_evidence: vec![
LiabilityEvidenceRequirement::CreditProviderRiskPackage,
LiabilityEvidenceRequirement::UnderwritingDecision,
LiabilityEvidenceRequirement::CreditBond,
],
max_coverage_amount: Some(MonetaryAmount {
units: 5_000_000, // $50,000 in cents
currency: "USD".into(),
}),
claims_supported: true,
quote_ttl_seconds: 60,
notes: None,
};The three evidence families are a signed CreditProviderRiskPackage for the agent (exposure ledger, scorecard, facility, recent loss history), a signed approved UnderwritingDecisionArtifact, and a signed active CreditBondArtifact. Against this policy, the operator submits a LiabilityQuoteRequestArtifact for USD 10,000 of coverage, with an effective window that starts one hour later and lasts 30 days. The provider returns quoted terms or declines.
Read more in Underwriting, which produces the decision a provider asks for.
A quote binds only inside the authority someone delegated
Suppose the provider quotes USD 10,000 of coverage for a USD 100 premium, and the signed delegated authority permits at most USD 10,000 of coverage and a USD 120 premium. The broader USD 50,000 provider limit plays no part: the request names the amount it binds. The quoted premium is an example value; the configuration does not compute it.
- Within authority. The USD 100 premium sits under the USD 120 ceiling, so automatic binding may proceed. A USD 130 premium exceeds the ceiling even if the provider would accept it.
- Inside the quote lifetime. The 60-second lifetime starts with the request, so placement must happen before request time plus 60 seconds. Coverage that begins an hour later leaves that deadline unchanged.
- Issued as signed records. Success produces a signed placement and a bound coverage record that keep the selected terms and their source records.
An expired quote needs current terms before placement. A selection above the ceiling needs terms within it, or replacement authority issued separately. On a refusal, the issuing operation returns an error to the caller, which routes the request to its own manual review when it wants one.
Binding authority rests on a facility, an underwriting decision, and a capital book
A LiabilityPricingAuthorityArtifact ties the quote request to an active granted credit facility, an active approved underwriting decision, and a capital book. It caps the coverage and premium that may be bound automatically, and it permits automatic binding only when the provider policy supports both bound coverage and claims.
- Structure. Validation checks every signature and binding. The embedded capital book must match the subject and the facility, and an available commitment, when present, bounds the coverage.
- Issuance. The auto-bind operation checks current provider state and freshness, quote and authority expiry, the bound request, and the coverage and premium ceilings.
- Outcome. Success produces an
AutoBoundrecord holding the signed placement and bound coverage. The record format also definesManualReviewandDenied; failed checks return an error instead of emitting either.
The provider sets the rate. The authority bounds the coverage and premium an operator may bind automatically at that rate.
Read more in Credit Facilities, which issues the facility and capital book this authority binds.
Bound coverage is the record a claim files against
A LiabilityBoundCoverageArtifact records the provider's commitment: policy_number, an optional carrier_reference, bound_at, the effective window, the coverage amount, and the premium. Claims for ToolExecution incidents inside that window file against these terms.
Coverage is scoped to the jurisdiction policy that priced it. A binding in us-ny leaves us-ca uncovered, because each jurisdiction carries its own policy, evidence requirements, currencies, and maximum. An operator with agents in several jurisdictions binds one policy per jurisdiction and routes each claim to its provider policy by LiabilityProviderPolicyReference. Federation across operators is a separate relationship, shown in the two-org worked example.
This is indemnity coverage: a claim settles against an assessed loss, adjudicated per claim. Collecting the premium and paying a claim are their own capital instructions, executed on a rail and recorded as observed, and a carrier's regulatory status is checked in the operator's provider onboarding. Parametric insurance is the parallel tier, where a deterministic predicate over receipt evidence decides eligibility.
Read more in Claims Lifecycle, which follows a covered loss from package to payout.
Coverage records and enums
Search for PremiumSourceFailed, RiskPool, or quote_ttl_seconds.
Quote-and-bind workflow
Binding coverage has two interfaces. The provider-facing path produces signed records. A separate local quote_and_bind helper constructs a policy value from premium inputs and fiscal parameters, outside the signed provider workflow.
Signed record workflow
- Quote request.
LiabilityQuoteRequestArtifactreferences aLiabilityProviderPolicyReference, a requested coverage amount, an effective window, and a signedCreditProviderRiskPackage. Validation checks the risk package signature and that the requested amount stays within the provider's maximum coverage. - Quote response.
LiabilityQuoteResponseArtifactcarriesLiabilityQuoteDisposition::QuotedwithLiabilityQuoteTerms(coverage amount, premium amount, optional deductible,expires_at) orDeclinedwith a decline reason.expires_atis at most request issuance plus the provider policy'squote_ttl_seconds; the lifetime starts with the request. - Pricing authority.
LiabilityPricingAuthorityArtifactcarries the coverage and premium ceilings for automatic binding. Its bindings and checks are listed under binding authority. - Placement.
LiabilityPlacementArtifactlocks in the selected coverage and premium against a quoted response. Selected amounts and the effective window match the quote request and response, and placement is issued strictly before quote expiry. - Bound coverage.
LiabilityBoundCoverageArtifactcarries the fields listed under bound coverage. Validation requires the provider policy to support both bound coverage and claims. - Auto-bind decision. The outcome record of the issuing operation:
AutoBoundon success, withManualReviewandDenieddefined in the format for a caller that issues them.
quote_and_bind helper
The compact path lives in chio-market::insurance_flow and accepts a caller-supplied premium source and fiscal resolver. A source failure returns PremiumSourceFailed; fiscal-resolution or underwriting denial returns PremiumDeclined.
pub fn quote_and_bind(
agent_id: &str,
scope: &str,
lookback_window: LookbackWindow,
premium_source: &dyn PremiumSource,
resolver: &FiscalResolver<'_>,
effective_at: u64,
policy_duration_secs: u64,
) -> Result<BoundPolicy, InsuranceFlowError>- Pulls
PremiumInputsfrom the caller-suppliedPremiumSource. - Calls
price_fiscal_premium. The resolver supplies governed premium parameters when they exist, an allowed fallback, or a denial. - On a
PremiumQuote::Quoted, derives default coverage as the quoted minor-unit premium times 100, with saturating arithmetic, and constructs aBoundPolicy.
The helper returns a local policy value. Premium collection, a carrier's signature, and the signed authority chain that automatic issuance requires all sit outside it. BoundPolicy::new_with_coverage overrides the default coverage rule when a caller sizes coverage itself.
BoundPolicy
pub struct BoundPolicy {
/// Stable, deterministic policy id derived from the agent, scope, and
/// quote via canonical-JSON hashing.
pub policy_id: String,
/// Agent the policy insures.
pub agent_id: String,
/// Scope / coverage identifier the policy applies to.
pub scope: String,
/// The underwriting premium quote that was bound into this policy.
pub premium_quote: PremiumQuote,
/// Maximum payable coverage for any single claim against the policy.
pub coverage_limit: CoverageLimit,
/// Unix-seconds timestamp at which the policy became effective.
pub effective_at: u64,
/// Unix-seconds timestamp at which the policy expires (exclusive).
pub expires_at: u64,
/// Current lifecycle state.
pub status: PolicyStatus,
}policy_id is insp- followed by the SHA-256 hex of the canonical JSON of a fixed tuple: the literal chio.market.insurance-policy.v1, the agent id, the scope, the quote, and the two window timestamps.
A policy is in force when status == Active and effective_at <= now < expires_at. A claim against a policy that is out of force at claim time is denied with PolicyNotInForce.
Provider types
LiabilityProviderType classifies each configured provider. Verification of a carrier's legal status belongs to the operator's onboarding process.
| Provider | Configured model | Intended use |
|---|---|---|
AdmittedCarrier | Carrier classified as admitted for a jurisdiction | Coverage under that provider's jurisdiction policy |
SurplusLine | Carrier classified as a surplus-line provider | Specialized coverage under the provider's stated terms |
Captive | Self-insurance entity owned by the insured organization | A large operator insuring its own agents |
RiskPool | Mutualized capital pool shared across participants | Coverage for a group with a shared risk profile |
Provider lifecycle uses LiabilityProviderLifecycleState: Active, Suspended, Superseded, Retired. The default registry is curated, and LiabilityProviderSupportBoundary carries its support flags.
Coverage classes
LiabilityCoverageClass sorts requests into five loss families. The provider's own terms set covered events, limits, and exclusions.
ToolExecution: losses caused by a tool invocation failing or returning an incorrect result.DataBreach: costs from unauthorized data exposure during agent activity.FinancialLoss: direct financial losses arising from agent actions.ProfessionalLiability: errors and omissions in professional agent outputs.RegulatoryResponse: costs of regulatory investigations, audits, and compliance actions.
Jurisdiction policies
Each provider publishes one or more LiabilityJurisdictionPolicy records, one per jurisdiction. The jurisdiction is an opaque label the provider chooses, such as us-ny, and validation rejects duplicate jurisdictions on one provider.
pub struct LiabilityJurisdictionPolicy {
pub jurisdiction: String,
pub coverage_classes: Vec<LiabilityCoverageClass>,
pub supported_currencies: Vec<String>,
#[serde(default, skip_serializing_if = "Vec::is_empty")]
pub required_evidence: Vec<LiabilityEvidenceRequirement>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub max_coverage_amount: Option<MonetaryAmount>,
pub claims_supported: bool,
pub quote_ttl_seconds: u64,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub notes: Option<String>,
}- At least one coverage class is listed.
- At least one supported currency is listed, each a three-letter uppercase ISO-style code.
quote_ttl_secondsis greater than zero.- The resolved
LiabilityProviderPolicyReferencechecks that an optional maximum is positive and in the selected currency; the provider-report validator leaves that check to it.
Evidence requirements
LiabilityEvidenceRequirement names the record types a provider expects with each quote request, in seven variants:
BehavioralFeed: behavioral anomaly signals, such as z-score history and drift indicators.UnderwritingDecision: a signedUnderwritingDecisionArtifactfromchio-underwriting.CreditProviderRiskPackage: a bundled risk package of exposure ledger, scorecard, facility report, and recent loss history.RuntimeAttestationAppraisal: a current runtime attestation appraisal (TEE, attested runtime).CertificationArtifact: an active tool-server certification record.CreditBond: an active credit bond covering the agent.AuthorizationReviewPack: authorization review evidence, such as multi-signature approvals and policy review records.
The provider policy declares its required evidence. The quote request itself carries the signed credit-provider risk package, and validation checks that package's signature and subject; the provider integration checks the other families it lists.
Implementation sources
Provider policies and signed records live in chio-market. chio-open-market is the separate bid and ask venue, and chio-listing handles tool discovery.
crates/economy/chio-market/src/provider.rs: provider classifications, jurisdiction policies, and validation.crates/economy/chio-market/src/quote.rs: request, response, and pricing-authority bindings.crates/economy/chio-market/src/placement.rs: placement, bound coverage, and auto-bind formats.crates/economy/chio-market/src/insurance_flow.rs: local policy construction and claim helpers.crates/platform/chio-control-plane/src/trust_control/capital_and_liability/liability.rs: live issuance checks.