Zen Algorithms · Insurance Lab ← Home

Architecture · Presale Onboarding & Distribution

Onboarding Architecture

How three distribution channels — direct, producer, and mortgage — feed one platform without duplicate spend, privacy leaks, or premium games. Identity verification is staged so no paid external call runs before the trust tier that justifies it; concurrent flows on one property are detected and resolved by rules the customer controls. Below: the flows, the gates, the collision state machine, and the schema shown as real tables with sample rows from three worked storylines.

1 · Channel flows 2 · Trust tiers & the two-gate rule 3 · Collision state machine 4 · Schema with sample rows 5 · Events 6 · Storylines

1 · Channel flows

Each lane is one channel's path to a bound policy. The tier chips mark where identity trust rises — and therefore which vendor calls become spendable. Whatever the channel, T3 (bind) is always the customer personally: OTP + e-sign. A producer can never e-sign for the insured.

Channel A — Direct

Customer self-serves on the carrier site.

Browse anonymouslyindicative estimate from free/cached data onlyT0

→

OTP verify contactemail/SMS code → submission(channel='direct')T1

→

Resolve identitydoc-scan / device signals (KBA fallback) → paid Groundwork prefill unlocksT2

→

Bind intentpayment instrument + e-sign → consumer reports per the two-gate rule → final premium → bindT3

Channel B — Producer (independent agent / broker)

Harbor Lane Insurance Group initiates on the customer's behalf; the customer is invited in.

Standing trust (once)NPN + state licenses + carrier appointments + E&O + commission schedule

→

Initiate on behalf ofinitiator=producer, on_behalf_of=customer · consent attestation recorded → prefill unlocksT2

→

Invite the customermagic link scoped view | modify | renewT1 (customer)

→

Customer binds personallyOTP + e-sign — never the producerT3

Compensation is carrier-paid commission per schedule — never a premium discount (anti-rebating, ~48 states). Representation moves only by customer-signed BOR on carrier-configured clocks.

Channel C — Mortgage (two distinct sub-flows)

Pacific Crest Home Loans — the lender never buys the borrower's policy at origination; it requires proof of one.

C1 · Originationclosing registered → EOI needed by closing date

→

Borrower buys via A or Bbound policy adds the mortgagee clause (templated; never MERS) + optional escrow billing

→

Continuing dutyannual EOI verification (Fannie B7-3-07/08)

C2 · Lapse detectedreasonable basis documented → lpi_cycle opens

→

Notice 1 → Notice 2≥45 days before any charge; reminder ≥30 days after notice 1 — method + template version stored

→

Place LPImaster policy · structure-only warning mandatory

→

Evidence arrivescancel + refund over the overlap within 15 days

2 · Trust tiers & the two-gate rule

Every prefill or report pull costs real money. Verification level is the API budget gate — unverified visitors never trigger paid calls. But the tier is a business control, not the legal line: for FCRA-governed consumer reports the legal gate is permissible purpose (15 U.S.C. §1681b), which attaches earlier and carries its own duties. The price book records both gates; conflating them causes either under-use of reports or off-ledger exceptions.

T0 · Anonymousjust browsingSpend: none. Free/cached only — geocode cache, flat-rate public GIS.

T1 · Contact-verifiedOTP (direct) · invitation-accept (producer's customer)Spend: cheap metered — address normalization, parcel lookup.

T2 · Identity-resolveddoc-scan/KBA · producer attestation + consent artifact · lender KYC + insurer-held consentSpend: paid Groundwork bundle — assessor, aerial/roof, reconstruction cost, hazard layers.

T3 · Bind-intentpayment instrument + e-sign — always the customer personallySpend: consumer reports (loss history, credit-based insurance score) — subject to the two-gate rule.

Vendor call requestede.g. A-PLUS loss history for SUB-7312

→

Gate 1 · LEGALlegal_basis_required — permissible purpose + consent artifact + notice/adverse-action duties. Owned by compliance.

AND

Gate 2 · BUSINESSbusiness_min_trust_tier — is this visitor worth the spend yet? Owned by the carrier's cost/fraud policy.

→

Buy — or reusesame risk_entity within the dedupe window ⇒ reused_from_call_id, $0. Every call lands in the ledger.

See the external_call_ledger sample rows — one Groundwork pull bought by the direct flow, reused twice by the other channels. Collision becomes a cost saving.

3 · Channel collision — the state machine

Same property, three flows in flight. Detection keys on multi-source entity resolution — normalized address + unit + geocode + APN + jurisdiction + confidence — because APN alone false-collides condo units sharing a master parcel. Disclosure is neutral before authority: channel identity is sensitive (it can reveal a closing in progress), so each flow sees only "another active workflow exists."

OPEN

→≥2 active submissions resolve
to one risk_entity
MatchDetected

DISCLOSED

→neutral banner to each flow,
logged per member
MatchDisclosed

RESOLVED

resolution ∈ bor (customer designates a producer; clocks run)
· withdrawn (a flow expires/exits) · first_bind (atomic bind lock; later binds allow | suppress | refer per carrier config, default refer)
· merged (same actor, one flow absorbs the other)

Side path — low confidence: a candidate match below the confidence threshold (e.g. unit 3A vs 2B on one master APN) routes to a human review queue instead of auto-colliding. No disclosure is issued for unconfirmed matches.

Premium discrepancies: the rating engine is deterministic over (risk data, product version, rate program) — so any quote difference between colliding flows decomposes into filed factors (DOI filing ref) or data differences, shown side-by-side. That labeling is the anti-rebating compliance story. See it live on the producer dashboard →

4 · Schema — the tables, with the storylines' actual rows

Extends the platform's canonical tables (submission, quote, policy, outbox already exist). Sample rows are drawn from the three storylines in §6 — highlighted rows belong to storyline 1 (J. Rivera, risk RSK-2207). Dates are illustrative; vendor prices are illustrative (real pricing is contract-confidential).

`party` + `party_contact` + `party_identity`

One row per person/org across all channels; contacts and verifications are append-only children — the audit trail of how trust was earned.

party_id	kind	legal_name	trust_tier	identity events (from party_identity)
PTY-1001	person	J. Rivera	T3	otp_sms ✓ Jun 8doc_scan ✓ Jun 9producer_attest ✓ Jun 10
PTY-1014	org	Harbor Lane Insurance Group	standing (producer)	npn_registry ✓ 2024
PTY-1022	org	Pacific Crest Home Loans	standing (lender)	nmls_registry ✓ 2024
PTY-1008	person	E. Sandoval	T3	otp_email ✓ May 18doc_scan ✓ May 19
PTY-1031	person	L. Farrow	T1	lender_kyc ✓ 2023 (loan file) — not insurer authorization by itself

`consent_artifact`

Insurer-held authorization — who consented to what, captured by whom. Lender KYC alone is never enough; lender-originated flows still capture one of these.

consent_id	party_id	scope	channel	captured_by	captured_at
CNS-5510	PTY-1001	property_prefill	direct	self (web)	Jun 9
CNS-5521	PTY-1001	property_prefill	producer	PRD-204 (attestation)	Jun 10
CNS-5538	PTY-1001	property_prefill	lender_origination	LND-77 + borrower e-consent	Jun 10
CNS-5544	PTY-1001	consumer_report	producer	self (e-sign, bind intent)	Jun 20

`producer` + `producer_license` + `producer_appointment` + `commission_schedule`

Standing trust, verified once at onboarding. Licenses and appointments are per-state / per-carrier child tables with effective dates — an array column can't carry status history.

producer_id	npn	eo_policy_ref	licenses (state · status · expires)	appointment	commission (new / renewal)
PRD-204	17204931	EO-44812 ($1M/$2M)	CA active 2027-01 · WA active 2026-11 · TX renewal-due 2026-07 · OR expired	this carrier · appointed 2024-03	CS-12 · 12% / 10% — carrier-paid

`lender_org` + `mortgagee_clause_template`

Lender standing trust + versioned clause templates. Clause text is rendered per loan from a template — never a free-text string on the lender row.

lender_id	nmls_id	is_servicer	template_id	investor_rule	body (placeholders)
LND-77	991204	true	TPL-FNMA-v3	fnma	{{servicer_legal_name}}, its successors and/or assigns… — servicer named, MERS prohibited (B7-3-08)

`risk_entity`

One row per insurable property/unit. Multi-source resolution — note the two condo units sharing one master APN that must NOT collide.

risk_id	addr_normalized	unit	geo	apn	apn_jurisdiction	confidence
RSK-2207	14 ALDER CT, SANTA ROSA CA 95404	2B	38.4521, −122.7140	037-220-014	Sonoma County	0.97
RSK-2208	14 ALDER CT, SANTA ROSA CA 95404	3A	38.4521, −122.7139	037-220-014	Sonoma County	0.97
RSK-2671	2 DRIFTWOOD CT, HALF MOON BAY CA 94019	—	37.4636, −122.4286	064-310-022	San Mateo County	0.99
RSK-3310	88 QUARRY ST, STOCKTON CA 95205	—	37.9577, −121.2730	149-082-007	San Joaquin County	0.99

Same APN, different units, different risks — unit + geocode + confidence keep RSK-2207 and RSK-2208 apart. APN-only matching would have falsely collided them.

`submission` (extended with channel provenance)

Who started the flow, for whom, on which risk — the channel facts every other table hangs off.

submission_id	channel	initiator_party_id	on_behalf_of	risk_id	billing_method	status
SUB-7299	direct	PTY-1001	—	RSK-2207	direct	withdrawn (BOR effective)
SUB-7312	producer	PTY-1014	PTY-1001	RSK-2207	escrow	bound → POL-88471
SUB-7305	lender_origination	PTY-1022	PTY-1001	RSK-2207	—	EOI satisfied
SUB-7341	direct	PTY-1008	—	RSK-2671	direct	bound → POL-88502…
SUB-7344	producer	PTY-1014	PTY-1008	RSK-2671	—	expired (quote validity)

`submission_match` + `submission_match_member`

Collision header + one member row per submission, carrying disclosure audit and an append-only state history — a bare array of submission IDs can't support the BOR inbox or disclosure log.

match_id	risk_id	status	resolution	member (submission)	disclosed_at	disclosure shown
MTCH-0098	RSK-2207	resolved	bor	SUB-7299 (direct)	Jun 10	"another active workflow exists" (neutral)
MTCH-0098				SUB-7312 (producer)	Jun 10	neutral → full detail after BOR-2214 authority
MTCH-0098				SUB-7305 (lender)	Jun 10	"another active workflow exists" (neutral)
MTCH-0102	RSK-2671	resolved	withdrawn	SUB-7341 · SUB-7344	May 20	neutral both ways; producer flow expired unbound

`bor_request`

Representation change with carrier-configured clocks. Commission & servicing move only at effective_at — never on signature.

bor_id	match_id	insured	gaining_producer	losing	signed_at	notified_at	rescind_deadline	effective_at	status
BOR-2214	MTCH-0098	PTY-1001	PRD-204	— (direct channel)	Jun 9	Jun 10	Jun 19	Jun 21	effective
BOR-2199	—	K. Mehta	PRD-310	PRD-204	May 30	Jun 1	Jun 11	—	rescinded Jun 8

`invitation`

Scoped customer access into a producer-initiated flow. The token is stored hashed; viewing is low-trust, binding is always the customer at T3.

invitation_id	submission_id	from → to	scope	expires_at	accepted_at	revoked_at
INV-3320	SUB-7312	PTY-1014 → PTY-1001	modify	Jun 24	Jun 10	—
INV-3344	SUB-7344	PTY-1014 → PTY-1008	view	May 26	— (expired)	—

`rate_program` + `rate_program_state`

Filed factors — the legal way premiums differ by affiliation. A factor with a DOI filing reference, never a producer favor.

program_id	name	filing_ref	factor	eligibility_rule	states (effective)
RP-AFF-PC	Affinity — Pacific Crest Home Loans	CA-2025-0441	0.985	verified loan_link with the partner lender — any channel	CA (2025-11-01)

`policy_interest` + `premium_schedule`

Who is named on the policy (clause rendered from the versioned template, with validation state) and how installments are paid — the join the escrow calendar reads.

policy_id	interest kind	party	clause_template	validation	installments (due · amount · payer · paid)
POL-88471	mortgagee	LND-77 (Pacific Crest)	TPL-FNMA-v3	valid	Jul 1 · $1,206 · escrow · — \| Jan 1 · $1,206 · escrow · —
POL-88412	mortgagee	LND-77	TPL-FNMA-v3	valid	Jun 15 · $990 · escrow · paid Jun 12 \| Dec 15 · $990 · escrow · —

`loan_link`

The lender's portfolio tracking row — the EOI grid on the mortgagee dashboard is exactly this table.

loan_id	lender_id	risk_id	borrower	escrow_billed	eoi_status	closing_date	last_verified_at
LN-30417	LND-77	RSK-2207	PTY-1001	true	verified	Jun 27	Jun 21
LN-28560	LND-77	RSK-3310	PTY-1031	true	lapsed → verified	2023	May 30

`lpi_cycle` (storyline 3 — every Reg X evidence field)

The compliance record. The mortgagee dashboard's notice timeline must be reconstructible from stored facts — so every method, template version, and date is a column.

field	CYC-883 (LN-28560 · L. Farrow)
basis_reason	EOI expired Mar 31; no renewal on file (reasonable basis documented)
notice1_sent_at · method · template_ver	Apr 3 · first-class mail + email · LPI-N1 v4
notice2_sent_at · method · template_ver	May 4 · first-class mail · LPI-N2 v4
charge_assessed_at	May 19 (≥45 days after notice 1)
placed_at · master_policy_ref · premium	May 19 · MP-PROP-2026 · $1,612/yr
contents_warning_shown	true (notices 1 & 2 — structure-only, no liability/contents)
evidence_received_at · coverage_from → to	May 30 · May 12 → (in force) — borrower policy POL-88502
cancelled_at · cancel_reason	Jun 2 · borrower evidence received (within 15 days)
refund_overlap_from → to · refund_amount	May 12 → Jun 2 · $94.30

`vendor_price_book` + `external_call_ledger`

The cost-control spine. The price book carries both gates per product; the ledger records every call — and the dedupe that turns a collision into a saving.

vendor · product	unit_price	data_class	fcra_flag	legal_basis_required	business_min_trust_tier
Groundwork · property bundle	$14.50	property_intel	false	consent artifact	T2
A-PLUS · loss history	$9.75	consumer_report	true	permissible purpose §1681b + consent + adverse-action duties	T3
VeriDoc · doc-scan identity	$1.80	identity_kyc	false	user-initiated	T1 (to reach T2)
geocode cache	$0.00	property_intel	false	—	T0

call_id	vendor · product	price	tier_at_call	consent_id	risk_id	reused_from_call_id	called_at
CALL-9015	Groundwork · property bundle	$14.50	T2	CNS-5510	RSK-2207	—	Jun 9 (direct flow)
CALL-9022	Groundwork · property bundle	$0.00	T2	CNS-5521	RSK-2207	CALL-9015	Jun 10 (producer flow)
CALL-9031	Groundwork · property bundle	$0.00	T2	CNS-5538	RSK-2207	CALL-9015	Jun 10 (lender flow)
CALL-9054	A-PLUS · loss history	$9.75	T3	CNS-5544	RSK-2207	—	Jun 20 (bind intent)

One $14.50 pull served three channels. Each reuse carries its own consent artifact — reuse rules are per data_class (consumer reports get stricter windows than property intel).

5 · Events

All emitted via the platform-standard transactional outbox → event bus. Dashboards are projections of these.

event	emitted when	storyline example
PartyVerified(tier)	a party_identity row raises the trust tier	Rivera → T2 on doc-scan, Jun 9
ConsentCaptured	a consent_artifact is recorded	CNS-5521 (producer attestation)
InvitationAccepted / InvitationExpired / InvitationRevoked	scoped-access lifecycle	INV-3320 accepted Jun 10 · INV-3344 expired May 26
MatchDetected / MatchDisclosed	collision opens; neutral banner logged per member	MTCH-0098, Jun 10
BORRequested / BORRescinded / BOREffective	bor_request lifecycle — servicing moves only on BOREffective	BOR-2214 effective Jun 21 · BOR-2199 rescinded Jun 8
MatchResolved(bor\|withdrawn\|first_bind\|merged)	terminal state of the collision	MTCH-0098 → bor · MTCH-0102 → withdrawn
ExternalCallReused	ledger dedupe hit — money saved, logged	CALL-9022, CALL-9031
EOIVerified / EOIDeadlineBreached / EOILapsed	loan_link EOI lifecycle	LN-30417 verified Jun 21 · LN-28560 lapsed Mar 31
LPINoticeSent(1\|2) / LPIPlaced / LPICancelled	Reg X cycle steps, each with its evidence	CYC-883: Apr 3 · May 4 · May 19 · Jun 2

6 · The three storylines behind the rows

① BOR-resolved — three channels, one property, one vendor pull J. Rivera quotes direct (SUB-7299, Jun 8–9; Groundwork bought once, CALL-9015). Harbor Lane Insurance Group initiates on his behalf the next day (SUB-7312; pull reused, CALL-9022). Pacific Crest registers his closing needing EOI (SUB-7305; reused again, CALL-9031). Match MTCH-0098 opens with three members — each sees only the neutral banner. Rivera signs BOR-2214; clocks run (notified Jun 10 → rescind Jun 19 → effective Jun 21); the producer flow wins, Rivera binds personally at T3 → POL-88471 with the mortgagee interest rendered from TPL-FNMA-v3; LN-30417 flips to eoi_status='verified'. No LPI ever starts.

② Customer keeps direct — the producer flow simply expires E. Sandoval starts direct (SUB-7341); the same producer initiates for her (SUB-7344). Match MTCH-0102 opens, neutral disclosure both ways. She ignores the BOR draft; SUB-7344 lapses at quote-validity end (InvitationExpired, May 26); her direct flow binds. Resolution: withdrawn — no one's channel identity was ever revealed to the other.

③ LPI cancel/refund — the Reg X clock, with receipts L. Farrow's coverage lapses Mar 31 (LN-28560). Notice 1 (Apr 3) and notice 2 (May 4) go out — method + template version stored; both carry the structure-only warning. LPI placed May 19 under MP-PROP-2026. Her own policy (effective May 12) surfaces May 30 → cancelled Jun 2, refund $94.30 computed over the May 12 → Jun 2 overlap. Every step of that sentence is a column in lpi_cycle — the dashboard timeline is just a projection of the row.

See the working mockups: Producer dashboard · Mortgagee dashboard. Design source: the platform's onboarding research doc (channels, gates, collision rules — reviewed by independent AI partners before these pages were built).

Onboarding Architecture

1 · Channel flows

Channel A — Direct

Channel B — Producer (independent agent / broker)

Channel C — Mortgage (two distinct sub-flows)

2 · Trust tiers & the two-gate rule

3 · Channel collision — the state machine

4 · Schema — the tables, with the storylines' actual rows

party + party_contact + party_identity

consent_artifact

producer + producer_license + producer_appointment + commission_schedule

lender_org + mortgagee_clause_template

risk_entity

submission (extended with channel provenance)

submission_match + submission_match_member

bor_request

invitation

rate_program + rate_program_state

policy_interest + premium_schedule

loan_link

lpi_cycle (storyline 3 — every Reg X evidence field)

vendor_price_book + external_call_ledger