Building TriggerProof, an adjudication layer for parametric flood triggers, I found the real failure is the false positive, and a deterministic physics verifier catches it.

Parametric InsuranceRemote SensingFlood Risk

A satellite said a depot was under water. It was a cloud's shadow, and the parametric trigger was one click from auto-paying $1.2M.

Ashutosh Singhal July 12, 202612 min read

A satellite looked at Mesa Junction Depot, saw a dark patch where dry ground should be, and flagged the location as flooded. A parametric flood policy read that trigger as fact and armed a $1.2M payout to fire automatically, no adjuster, no phone call, no second look. The dark patch was a cloud's shadow. It was gone from the imagery six days later, and the ground under it had never been wet.

I built that exact case on purpose, because it is the one a single satellite frame can never catch. I am Ashutosh, and I run Veriprajna. TriggerProof is a demo I built to prove a specific claim: the dangerous moment in parametric flood insurance is not detection, it is the decision to pay. Every location, tile, river gauge, and field report in it is synthetic, physics-faithful stand-ins I wrote so I could stage the failure modes cleanly. You can open it and drive the whole thing yourself at veriprajna.com/demos/satellite-flood-intelligence. Mesa Junction Depot is where I want to start, because it is the case that taught me what I was actually building.

Four different things darken the same pixels

I did not appreciate the real problem until I sat down to generate the synthetic imagery and had to make four things look identical on one frame. Parametric flood insurance replaced the loss adjuster with a trigger: a satellite says a location is under water, and money moves. The trouble is that on a single optical image or one radar pass, real floodwater, a cloud shadow, a radar or terrain shadow, and a permanent reservoir all go dark the same way. A single frame cannot separate them, because the information that separates them does not live in a single frame.

That reframed the whole demo for me. The catastrophic error in this business is not the flood the trigger misses. It is the flood the trigger invents, a confident $2M payout on a shadow, with no evidence trail to defend the call when a reinsurer asks about it a year later. TriggerProof does not detect floods and does not produce satellite data. It takes a trigger that has already fired and adjudicates whether it should actually pay.

One frame said flood; the next said the ground was never wet

I still remember stepping through the Mesa Junction filmstrip the first time it rendered correctly. The interface lets you open a flagged location and walk the acquisition frames one at a time, optical on top, radar below. In the trigger frame, the dark patch is right there, water-signal green, exactly what fired the alarm. Step to the next acquisition and it is gone. Step back and the radar backscatter under that same patch reads normal in every frame, because radar saw dry ground straight through the cloud the whole time.

The AOI-B temporal filmstrip for Mesa Junction Depot: the optical dark patch appears only in the t+0 trigger frame and is absent at t-6d and t+6d, while the SAR row stays uniform across all three frames, classified cloud shadow at confidence 1.00. — Mesa Junction Depot, the $1.2M case. The optical dark patch shows up only in the trigger frame (temporal persistence 33%) and radar backscatter stayed normal throughout. Rule R1 fails, rule R2 fails, and the verdict is cloud shadow, not water.

The shadow moved; the water would have stayed. You only see that across time and across sensors, never on the single frame that fired the trigger.

The physics is not subtle once you lay the frames side by side. A cloud shadow is transient and it travels at cloud speed, so it is dark in one acquisition and gone in the next. Real floodwater persists across acquisitions and reads dark on optical and low on radar at the same time. Two rules encode exactly that: temporal persistence and radar-optical agreement. On Mesa Junction they both come back FAIL, and the classifier lands on cloud shadow at confidence 1.00. The $1.2M never should have been queued.

The five rules decide, not the language model

I tried, early on, to let the language model make this call, and I am glad I did because it failed in the most instructive way possible. I had an agent reading the same evidence and asked it, in effect, whether the location was really flooded. On an ambiguous case it wrote me a fluent, confident paragraph arguing for a flood, and it was wrong, and nothing in its tone flagged that it was wrong. That afternoon settled a design decision I have not reopened since.

So the decision lives in plain Python, in five inspectable discriminators, with no model anywhere in the path that moves money. Temporal persistence (R1) separates a flood from a transient cloud shadow. Radar-optical agreement (R2) separates a flood from both a cloud shadow and a radar shadow. DEM slope (R3) rejects water that would have to pool on steep terrain. A permanent-water mask (R4) excludes known reservoirs. Hydrological linkage (R5) checks that the wet area actually connects to the drainage network. The verifier decides; the language model only advises. The advisory agent is built on Pydantic AI, model-swappable, defaulting to claude-opus-4-8, and it checks the physics verdict against independent ground signals and returns corroborates, contradicts, or inconclusive. It can be overruled, and when I pull the API key the demo runs fully offline on a deterministic fallback, because the part I trust with a payout cannot be the part that speaks in confident paragraphs.

When the physics itself is unsure, the system escalates instead of guessing

I care more about the case where the system says "I do not know" than about any of the clean catches. Canal Street Hub is that case. The optical and radar signatures are borderline, the flood signal persists across two of three frames, and the independent river gauge never crossed bankfull. The evidence genuinely conflicts. The confidence comes back at 0.151, far under the automation bar of 0.65 that I fitted on the labeled set, and the ground agent contradicts the satellite classification outright.

The AOI-F Canal Street Hub detail: classified flood at confidence 0.15, a borderline optical and SAR signature, the river gauge below bankfull, and a verdict routed to a human adjudicator as ESCALATE rather than an automatic payout. — Canal Street Hub, $0.8M at stake. The signal is borderline and the river gauge never crossed bankfull, so the ground evidence conflicts with the satellite. Confidence 0.151 sits below the 0.65 bar, and the case escalates to a human with the full evidence attached instead of being auto-decided.

The policy gate sends that $0.8M to a human with all of the evidence attached, marked "needs proof," rather than flipping a coin and calling it automation. A flood trigger that escalates the genuinely ambiguous case reads to some buyers as the weaker product. I see it the other way. It is the only version I would let run unattended, because the alternative to escalation here is a fast guess on real money, dressed up as a decision.

The portfolio number I keep coming back to

I keep pulling up the eight-location book, because it makes the stakes concrete in a way no single case does. A storm passes a portfolio of eight areas. The legacy single-frame trigger fires on six of them and queues $8.0M in automatic payouts. TriggerProof adjudicates the book: two real floods confirmed and paid at $4.0M, three false positives suppressed (a cloud shadow at $1.2M, a radar shadow at $1.0M, a permanent reservoir at $1.0M) for $3.2M withheld, and the one ambiguous case escalated at $0.8M.

The adjudicated TriggerProof portfolio: legacy queued $8.0M, confirmed to pay $4.0M across two real floods, $4.0M withheld across three suppressions and one escalation, with 100% evidence coverage, and per-row PAY, DENY, and ESCALATE verdicts against the legacy PAY column. — The eight-location book after adjudication. Of the $8.0M the single-frame trigger would have auto-paid, $4.0M is confirmed on two real floods and $4.0M is stopped or held: $3.2M of false positives suppressed and $0.8M escalated for proof. Every row carries its own forensic dossier.

Half of what the legacy trigger would have paid, $4.0M of $8.0M, is either stopped or held for proof. That is the number, and I want to be precise about its scope: this is the demo's synthetic portfolio, eight cases I authored to be physically faithful, not a book of real claims. The mechanism is real and inspectable. The claims are staged so you can watch the mechanism work.

Zero unsafe decisions, and the caveat I refuse to drop

I ran a proper benchmark because a portfolio of eight is a story, not evidence. The harness scores 60 labeled cases spanning clear signatures down to near-threshold noise. The headline is not an accuracy score, it is a safety count: zero unsafe automated decisions, against 48 for a single-frame baseline that pays every flagged case. Eighty percent of cases auto-resolve and the uncertain 20% escalate. Among the auto-resolved cases, false-positive suppression is 36 of 36 and flood recall is 12 of 12, and every one of the 12 genuinely ambiguous cases escalates instead of being auto-decided.

The TriggerProof benchmark panel over 60 labelled cases: zero unsafe auto-decisions versus 48 for the single-frame baseline, 80% auto-resolution, 100% false-positive suppression at 36 of 36 shadows denied, and 100% flood recall at 12 of 12. — The 60-case labelled benchmark. The number that matters is the leftmost one: zero unsafe automated decisions against 48 for the single-frame baseline, with 80% auto-resolved and the uncertain fifth escalated for proof.

The point was never a perfect score on my own test set. The point is that the system never makes an unsafe automated decision. When it is not sure, it escalates.

The caveat travels with every one of those numbers, and I will not let it get stripped off. They are measured on a fixed, labeled set of 60 synthetic, physically-faithful cases, not an open-world guarantee and not a field result. The honest next step is not a bigger claim, it is validation against real archives like Sen1Floods11 and live Sentinel scenes, and that is the first thing a real engagement would deliver, not something this demo has done. Saying that plainly is what lets me stand behind the rest of the numbers.

A payout you cannot defend later is a liability, even when it was right

I did not set out to make the evidence trail the centerpiece, but by the end it was the part I was most sure an insurer could actually stand behind. A correct payout you cannot reconstruct later is still a liability, because "the satellite said so" is not a defense a reinsurer or an auditor accepts. So every decision, a pay and a suppression alike, emits a forensic dossier: the data lineage of every frame, the per-rule evidence with each discriminator's measured value, the false-positive elimination log, the independent ground cross-reference, and a SHA-256 provenance hash of the decision.

The forensic flood-trigger dossier for Mesa Junction Depot: a DENY verdict, the five-rule evidence table showing R1, R2 and R5 as FAIL with their measured readings, a false-positive elimination log, the contextual cross-reference, and a Sentinel-1 and Sentinel-2 data-lineage table. — The dossier behind the Mesa Junction denial. Every rule shows its measured value and result, the false-positive elimination log names why it was not a flood, and the whole record carries a SHA-256 hash. This is the artifact you hand a reinsurer, not a screenshot of a dashboard.

I want to be careful about what that hash is and is not. It is a content hash that makes the record tamper-evident, so anyone can recompute it and check the decision was not altered after the fact. It is not a PKI digital signature, and the satellite retrieval, the SAR tasking, the ground feeds, and the claims-platform integration are all stubbed in this demo, simulated so the whole thing runs on my laptop. What is real is the shape of the record: for every automated payout decision, exactly which physics said what, at what confidence, checked against what independent signal.

Parametric insurance made a genuine trade, giving up the loss adjuster to make payouts instant and disputeless. What it inherited was a physics problem it cannot see past on a single frame, and the failure that trade exposes you to is a fast, confident payout on a shadow. The durable fix lives outside the model: deterministic rules that separate the look-alikes across time and sensors, a gate that escalates the ambiguous case to a person, and a record that makes each decision defensible. A sharper satellite does not fix an adjudication problem, and this is an adjudication problem.

And if you would rather watch it than read me describe it, here is the whole thing running end to end.

Mesa Junction is the case I keep coming back to. Only the second acquisition ever knew the difference between the shadow and the flood, and the trigger fired before it arrived. You can step through that filmstrip yourself, and break the payout you think should have fired, at veriprajna.com/demos/satellite-flood-intelligence. The question I would put to anyone running an automatic flood book is a narrow, answerable one: of the triggers you auto-paid last season, how many could you still prove were water and not a shadow?