A parametric flood policy pays a seven-figure claim the moment a satellite says a location is under water, with no adjuster on the ground. The trouble is that floodwater, a cloud shadow, a radar shadow, and a permanent reservoir all darken the same pixels the same way. So the expensive failure of an automatic flood trigger is not the flood it misses. It is the confident false positive: a payout that fires on a shadow, with no evidence trail to defend the call afterward. Automation without adjudication just pays faster.
When we built TriggerProof (the demo runs at veriprajna.com/demos/satellite-flood-intelligence), we did not set out to build a sharper flood detector. We built the adjudication layer that sits between a fired trigger and the payout. It takes the trigger as given and proves whether it should pay: a deterministic physics verifier written in plain Python returns the verdict, a language model only advises, and a policy gate escalates anything uncertain to a human instead of bluffing. The verdict a reviewer can read and a reinsurer can audit is the durable asset here, and it does not get obsoleted by next year's satellite or next year's model.
The failure mode is a confident false positive
A single-frame trigger reads one optical image or one radar pass and calls it water. Four different things produce that same dark signature. Floodwater pools and stays. A cloud shadow is transient and gone in the next acquisition. A radar or terrain shadow reads dark to SAR while the ground stays optically bright. A permanent reservoir was always there. TriggerProof separates them with five inspectable physics rules and no model in the decision: temporal persistence, SAR-optical agreement, DEM slope, a permanent-water mask, and hydrological linkage to the drainage network. Each rule is plain code a reviewer can step through.
A parametric payout is only as trustworthy as the trigger behind it, and a single-frame satellite trigger cannot tell floodwater from a cloud shadow, a radar shadow, or a permanent reservoir.
One shadow, in full
Here is one catch from the demo's portfolio run, so the mechanism is concrete rather than a slogan. A storm passes a book of eight areas of interest (every area is synthetic and physics-faithful). The legacy single-frame trigger fires on six of them and queues $8.0M in automatic payouts. One of those, AOI-B, Mesa Junction Depot, is a $1.2M payout waiting to go out on a cloud shadow.
Open AOI-B in the temporal filmstrip and step through the acquisition frames. The dark patch appears only in the trigger frame and is gone in the very next acquisition, because it moved at cloud speed, while SAR backscatter stayed normal the whole time (radar saw dry ground through the cloud). Temporal persistence fails, SAR-optical agreement fails. The verifier classifies it cloud_shadow at confidence 1.00 and returns DENY. The shadow moved; the water would have stayed. That is $1.2M withheld on one call.
AOI-B in the filmstrip: dark only in the trigger frame, gone in the next acquisition, SAR normal the whole time. Classified cloud_shadow, DENY, $1.2M withheld.
Across the full book, TriggerProof confirms two real floods to PAY ($4.0M), denies three false triggers (the $1.2M cloud shadow, a $1.0M radar shadow, and a $1.0M permanent reservoir, $3.2M withheld in total), and escalates one ambiguous case ($0.8M) to a human. Of the $8.0M the legacy trigger would have auto-paid, $4.0M is stopped or held for proof.
The adjudicated book: 2 PAY and 3 DENY and 1 ESCALATE, $4.0M confirmed against $4.0M withheld, every decision backed by evidence.
Escalate instead of bluffing
There is a case in the portfolio the system deliberately does not decide. AOI-F, Canal Street Hub, has a weak signal and a river gauge that never crossed bankfull. The physics is genuinely ambiguous, so the verifier's confidence lands at 0.151, below the automation bar of 0.65 that was fitted on the labeled eval set. The gate does not force a PAY or a DENY. It routes the case to a human with the evidence attached and labels it "needs proof." A coin-flip $0.8M payout becomes a reviewed decision. Governance here is about risk, not just accuracy: the system is built to know when it does not know.
AOI-F: weak signal, gauge conflict, confidence 0.151 under the 0.65 bar. The gate escalates for human review rather than auto-paying $0.8M.
Why the adjudication layer is the durable part
Model quality and sensor resolution are moving targets. A higher-resolution satellite gives you a crisper ambiguous pixel; it still cannot tell you whether the darkness persisted across acquisitions or whether SAR saw dry ground underneath. Those questions are answered by physics across time and sensors, not by a bigger image or a smarter language model. That is why we put the decision in deterministic code and let the Contextual Cross-Reference Agent only advise. It checks the physics verdict against independent ground signals (river gauge, precipitation, field reports) and can be overruled by the gate. Agents advise, code decides.
The deterministic physics verifier decides the payout. The language model only advises, and the policy gate can overrule it.
Every decision, PAY or DENY or ESCALATE, emits a forensic dossier: the data lineage, the per-rule evidence, the false-positive elimination log, the ground-signal cross-reference, and a SHA-256 provenance hash of the decision. (The hash is a content hash for tamper-evidence in the demo, not a real PKI digital signature.) That dossier is the artifact a reinsurer or an auditor asks for when a $2.0M payout is questioned a year later. The requirement to produce it does not age out when the models improve, which is why the adjudication and provenance layer is the part worth owning.
The per-decision dossier: per-rule evidence, the false-positive elimination log, and a SHA-256 provenance hash, the record a reinsurer or auditor can read back.
We measured the whole approach on a fixed, labeled set of 60 synthetic, physically-faithful cases. On that set the system makes 0 unsafe automated decisions, against 48 for a single-frame baseline that pays every flagged case. It auto-resolves 80% (48 of 60) and escalates the remaining 20% (12 of 60) to a human. Among the cases it does auto-resolve, it suppresses 100% of the false positives (36 of 36 cloud-shadow, radar-shadow, and permanent-water cases denied) and pays 100% of the real floods (12 of 12). The point of those numbers is not a perfect score on a benchmark. It is that on this labeled set the system never makes an unsafe automated decision: when the physics is ambiguous, it escalates. Field validation against Sen1Floods11 and real Sentinel archives is the first engagement deliverable, not something this demo claims.
The 60-case labeled benchmark: 0 unsafe automated decisions against 48 for the single-frame baseline, 80% auto-resolved, 100% suppression and 100% recall among the cases it decides.
If you run an automatic flood-trigger book, the question we would put on the table is narrower than the usual detection-accuracy debate. When a trigger fires and queues a payout, is the pay-or-deny call made by deterministic physics a reviewer can read and a reinsurer can audit, or by the same signal that fired the trigger? You can watch our version separate the shadows from the floods, and escalate what it cannot prove, at veriprajna.com/demos/satellite-flood-intelligence. We are still working out where the automation bar should sit for different books of risk, and we would rather compare notes on that threshold than argue about satellite resolution.