The problem this artifact solves
CarrierIQ's approval flow already does serious work. The Bind Review drawer moves an operator through structured intake, per-carrier execution stages, quote comparison, review classification, verification with live agent sessions, operator notes, and human approval. Reading order runs from asserted status to supporting context to human judgment. The architecture is sound.
Every status in that flow, though, arrives as settled fact. Bindable, BEST RATE, Bind approved, Bound. The interface never shows what evidence supports a status, who established it, when, whether it is still current, or what the system could not confirm. Bindable is a badge with no view into the observations that produced the classification. Coverage deltas highlight deviations from requested terms without telling the operator whether a deviation is a real carrier term or an extraction error. Bind approved records a human decision while collapsing three separate facts: that the operator authorized binding, that the carrier accepted it, and that coverage is in effect.
So the interface displays status without substantiating it. The Claims Ledger closes that distance by treating every consequential status as a claim that has to carry visible evidence, an attributed owner, a timestamp, and an explicit account of what remains unknown.
On the name. The pattern itself is not new. Assertions backed by traceable evidence already appear in AI verification research, OSINT methodology, and agent evidence frameworks, and the underlying structure is formalized in NIST's assurance-case definition and the OMG SACM specification. What you are adding is the application of that structure to live agent statuses as user-facing interaction design. One problem with the name: in insurance software, a claims ledger is a record of policyholder claims, meaning reserves, payments, and loss history. Because CarrierIQ operates in insurance, a broker will hear the wrong thing. Keep the working name through the build. If it ships as a labeled pattern in the portfolio, qualify it.
Where this sits. The Delegation Contract specification already defines a commitment sequence (Proposed → Staged → Authorized → Committed → Settled → Compensating) and a state inventory covering authority, commitment, trust indicators, and correction chains. The Claims Ledger is the visual grammar that substantiates those states. Build it as a layer inside that specification, not alongside it. For positioning: Agent Infrastructure as UX first, Human-Agent System Design second.
Your production work at TinyFish is the technical motivation here. Building agent traces, auditability layers, and attribution systems teaches the same lesson repeatedly. When an agent reports a status, the operator's ability to calibrate trust depends on whether the interface connects that status to the evidence behind it. Absent that connection, what the operator trusts is the label.
Track A — Extending CarrierIQ
Four extension points in the existing interface. For each: what it currently communicates, what it omits, what you add, and which Trust essay handoff it maps to. Two handoffs are in play. Output Review is where a human checks what the agent produced. Decision Gate is where a human authorizes a step the agent cannot take back.
Review classification
Currently: The Bind Review drawer opens with a review summary and a routing badge: Bindable, Normalize, Referral, or Call review. The operator learns how to route the quote.
Missing: Which observations produced the classification. Whether a human or the system assigned it. When. Whether the evidence has aged out. Whether another actor contests it.
Add: A claim row under the badge. Name the classification as a claim, link (don't summarize) the observations supporting it, attribute the assignment to an agent or a human, timestamp it, and mark freshness. If any supporting observation is missing or stale, surface that as an explicit unknown. The badge should not imply a complete evidence chain when the chain is incomplete.
Handoff: Output Review. The Trust essay asks for disclosure of sources, confidence level, and what the system did not find. This is where that requirement becomes an interface element.
Coverage deltas
Currently: The drawer lists returned coverage terms and highlights deviations from the user's requested baseline.
Missing: Whether a delta is a real carrier term, an extraction error, or a normalization problem. No source observation or observation time is attached to the field.
Add: Treat each delta as a mini-claim: asserted value, source (extracted field, carrier page, API response), extraction timestamp, verification state. Where the system cannot tell a genuine carrier term from an extraction artifact, say so beside the delta. Put the unknown primitive here first. Coverage deltas are where extraction errors bear most directly on the operator's decision, and where clean formatting does the most to conceal them.
Handoff: Output Review. A delta with no verified source is a finding the system has not confirmed, which is precisely what the Trust essay means by showing what the system did not find.
Verification panel
Currently: The verification section can show an active or completed agent session, a Watch live link, a proof attachment (Browser Use or Mock), Verify this carrier, Re-run verification, and a follow-up prompt. With nothing attached, it reads No verification run attached, the one place the current interface already admits it has nothing.
Missing: Which claim the proof supports. Whether verification drew on independent evidence. When the proof was produced. How long it stays good. Who ran it.
Add: Bind each verification attachment to the specific claim it substantiates, so that the interface says this Browser Use session verifies the extracted premium for Progressive. Add verifier identity, production timestamp, and freshness window. Then generalize No verification run attached into a reusable absence pattern, so any claim without linked evidence gets an equivalent disclosure rather than only the verification section.
Handoff: Output Review, feeding the Decision Gate. The trust ladder in the Trust essay depends on users seeing correct behavior they can check. Linking verification to claim is what makes checking possible.
Approval action
Currently: Approve Bind enables once the market snapshot and selected quote are both complete. After the click, the button reads Bind approved with a timestamp and the header reads Bound.
Missing: Bind approved and Bound carry three claims in a single visual state: the operator authorized binding, the carrier accepted the bind, coverage is in effect. Authorization, external commitment, and settlement are different things, and the interface does not separate them. It also says nothing about carrier rejection, or about the state of the world after a cancellation.
Add: Replace the single Bound state with the commitment sequence from the Delegation Contract specification: Authorized (human approved), Committed (submission sent to carrier), Settled (carrier confirmed). Each gets its own evidence, owner, and timestamp. Between authorization and carrier response the commitment status is unknown, and the interface should say so rather than imply resolution. Add Compensating for post-bind recovery, where the system acknowledges that stopping leaves residue. After a cancellation the world is not back where it started, and the state should account for partial execution.
Handoff: Decision Gate. The Trust essay's requirement that an interface show where irreversibility begins is satisfied by making the Authorized/Committed boundary visible. That boundary is where the operator's decision stops being reversible by the operator alone.
Track B — Five primitives
Structural specifications, not visual designs. Enough logic that you can open Figma without guessing at hierarchy, reading order, or how one state differs from another.
1. Claim
A named assertion the system or a human makes about the current state of a process step. Every consequential status in CarrierIQ becomes one.
Visual logic. Primary text weight, first in reading order within its container. The claim label is the anchor; evidence, time, owner, and unknown sit subordinate to it.
States:
- Active — current and substantiated
- Stale — established but evidence has aged past a freshness threshold
- Contested — evidence or another actor contradicts the claim
- Superseded — a newer claim has replaced this one
Example. Bindable is a claim. Active and substantiated, it appears at full weight with its evidence chain visible. When the underlying quote data ages past threshold without re-verification, it shifts to stale. If a re-verification run returns contradictory data, it becomes contested.
2. Evidence
The specific observation, artifact, or data point supporting a claim. Evidence is always linked to a claim. Unlinked evidence is context, not proof.
Visual logic. Secondary text weight. Nested below or expandable from its parent claim. Each item is individually addressable, so the operator can inspect it. When multiple items support one claim, they stack vertically in chronological order.
States:
- Present — exists and linked
- Absent — no evidence provided; triggers the unknown primitive
- Stale — produced outside its freshness window
- Contested — contradicts other evidence linked to the same claim
Example. The Bindable classification rests on three items: the extracted premium matches the carrier's displayed rate (Browser Use screenshot, timestamped), the coverage terms match the requested baseline (field-level comparison), and the carrier's AM Best rating clears the threshold. If the screenshot is twelve hours old against a four-hour freshness window, that item is stale while the other two remain present.
3. Time
When a claim was established, when its evidence was produced, and how current both remain. Time is a property of claims and evidence rather than an independent element, but it needs its own treatment because a claim substantiated four hours ago may not be substantiated now.
Visual logic. Tertiary weight. Timestamp beside or below its parent claim or evidence item. Communicate freshness through the parent's state change, so that a claim with stale evidence becomes a stale claim. Don't signal staleness twice.
States:
- Current — within freshness window
- Approaching threshold — within a defined warning period
- Stale — past freshness window
- Expired — past a hard validity limit; the claim should not be acted on without re-establishment
Example. A quote extracted at 2:14 PM with a four-hour freshness window is current until 6:14 PM, approaching threshold at 5:44 PM on a 30-minute warning, stale at 6:14 PM, and expired at end of business day if the carrier's rate filing could change overnight.
4. Owner
Who is responsible for a claim or an evidence item. Attribution answers two questions: who produced this, and who is accountable if it is wrong.
Visual logic. Tertiary weight, inline with the claim or evidence it qualifies. Compact label or icon: agent, human, shared. Where ownership is shared, because the agent extracted the data and the human approved the classification, both actors appear with their contributions distinguished.
States:
- Human — a person established this
- Agent — the system established this
- Shared — both contributed, roles distinguished
- Unattributed — ownership not recorded; a defect state rather than a design state; surface it as an integrity gap
Example. Bindable is agent-owned if the system assigned it from extraction rules, and becomes shared once a human reviews and confirms it. Bind approved is human-owned. Committed is agent-owned. If a checklist item is checked but nobody recorded who checked it or on what basis, it is unattributed, and the interface should treat that as a problem to resolve rather than a normal state.
5. Unknown
What the system cannot confirm. The other four primitives organize what the system knows. This one is why the artifact is worth building.
Visual logic. Equal or greater prominence than evidence when present. The unknown should interrupt reading flow, since its job is to stop the operator from treating an unsubstantiated claim as substantiated. Place it at the same hierarchical level as evidence, immediately after the last evidence item, or in place of evidence when none exists. Give it a treatment that reads as disclosure rather than error: nothing is broken, the system is reporting the boundary of what it checked.
States:
- Acknowledged — the system explicitly names what it cannot confirm
- Resolved — a previously unknown item has been substantiated or ruled out
There is no unacknowledged-unknown state in the interface. If the system doesn't flag an unknown, the primitive simply isn't rendered. The point of the artifact is to make acknowledged unknowns the default behavior.
Example. After the Bindable classification and its evidence chain: "Cannot confirm whether the carrier's quoted deductible reflects the current rate filing or a cached value." After Bind approved: "Carrier has not yet confirmed acceptance. Binding status is based on submission, not carrier acknowledgment." Write these in the operator's language, not the system's.
What to build first
Claim-evidence binding on the review classification and the approval action, plus the unknown primitive on coverage deltas. Three elements, two locations in the existing flow.
The review classification is where the operator decides whether to proceed, and binding evidence to Bindable turns a routing label into an assertion the operator can evaluate. The approval action is where irreversibility begins; separating Authorized from Committed from Settled, each with its own evidence, puts the Delegation Contract's commitment sequence into the interface instead of leaving it in a spec. Coverage deltas are where the unknown primitive does its most concrete work, since a delta with no verified source is the most common place an extraction error hides behind clean presentation.
Defer to v2: owner attribution and time indicators. Both matter, and neither changes the core interaction yet. An operator can evaluate evidence quality and acknowledged unknowns without knowing precisely who produced each item or exactly when. Owner and time become essential once the system handles multiple runs, multiple operators, or multi-day workflows, and CarrierIQ doesn't expose that scope yet.
Which companies care about which parts. The unknown primitive is the strongest signal for OpenAI's Identity role. Their posted mandate covers agent identity, permissions, authorization, and governance, and their own September misalignment disclosures document agents operating outside intended boundaries through credentials, shared files, and compaction summaries. A visual vocabulary for systems that surface what they don't know maps directly onto that, and it is not something you will find in competing portfolios. The claim-evidence binding is the strongest signal for the Slack VP role, where interaction coherence across surfaces is the unit of accountability. Every status substantiated by traceable evidence is an argument about how information stays consistent as it moves between contexts.
Both elements are buildable from data CarrierIQ already has. The traces, comparison tables, verification attachments, and review classifications contain the raw material. What's missing is the binding: connecting each status to its evidence, and showing the places where no evidence exists. That work lives in Figma, not in new research.
- OpenAI's misalignment disclosures: Six published incidents document agents carrying behavior across session boundaries through compaction summaries, shared repositories, and exposed credentials — exactly the kind of residual state the Claims Ledger's unknown primitive is designed to surface.
- Anthropic's monitoring funnel numbers: Their internal measurement report describes ingesting over one billion agent decisions monthly, flagging roughly 100,000 transcripts per week for classifier review, and escalating about 50 to humans — concrete quantities that could inform how the Claims Ledger scales beyond single-operator workflows.
- NIST's agent identity framework: The NCCoE concept paper proposes applying identity and authorization standards to AI agents with attention to delegation, access rights, and auditability — vocabulary that maps directly to the owner primitive and the approval action's commitment sequence.
- Causal explanations in surprising behavior: A peer-reviewed Nature study found that explanations improved user prediction only when tied to concepts that actually governed the system's behavior during surprising events, supporting the Claims Ledger's principle that evidence must be linked to the specific claim it substantiates rather than offered as generic context.