The $1.2M payout I watched get stopped on a flood that never happened
I watched my own code stop a $1.2M flood payout on Mesa Junction Depot, a freight yard on the Segura plains where a parametric policy had already queued the money to pay out automatically. A satellite had looked down, seen the ground go dark where floodwater pools, and called it a flood. No loss adjuster was going to drive out there to check. The payout was already moving.
When I opened that location in the demo I was building and stepped through the acquisition frames, the dark patch was in only one of them. The acquisition before the trigger read clear. The one after, clear again. The thing that had queued a million-dollar payout showed up in a single frame and was gone by the next pass. Its temporal persistence came out at 33%, one frame out of three. And the radar gave it away: while the optical band went dark, the SAR backscatter stayed normal, because radar saw dry ground straight through the cloud that cast the shadow. The shadow had moved at cloud speed, and floodwater does not.
The demo denied the payout at confidence 1.00 and named the reason in plain language: cloud shadow, not water. That is the failure I built TriggerProof to catch, and watching it fire on a case I had made deliberately convincing was the moment the whole thing felt worth building.
The catch that started the demo: AOI-B queued a $1.2M payout, but the dark patch appears in only the trigger frame and the SAR stays normal. The shadow moved; the water would have stayed.
Why I would not let the model make the call
I decided early that nothing about that decision could rest on a language model's opinion. It is tempting to hand the satellite frames to a capable model, ask "is this a flood?", and trust the answer, and for a demo it would even look impressive. But a $1.2M automatic payout that fired on a model's say-so is exactly the call you cannot defend to a reinsurer or an auditor a year later. So the payout verdict in TriggerProof comes from five plain-Python physics rules, and the model is not allowed to make it.
Each of the five rules separates real water from one of the ways a single frame lies. Temporal persistence catches the cloud shadow that is gone in the next frame. SAR-optical agreement catches it a second way, since a cloud shadow goes optically dark but leaves radar backscatter normal, while a radar or terrain shadow does the reverse. A DEM slope check throws out water that would have to pool on terrain too steep to hold it. A permanent-water mask excludes the reservoir that was always there. A hydrological-linkage rule asks whether the wet patch actually connects to the drainage network. Every rule is a computed number compared against a published physical band, sitting in code you can read.
There is an agent in the loop, built on Pydantic AI with claude-opus-4-8 as the default model. It cross-references the physics verdict against independent ground signals, a river gauge, precipitation, and field reports, and returns whether they corroborate or contradict. It advises. It never decides the payout, and the demo runs fully offline on a deterministic fallback if you unplug the model entirely. Holding that boundary was most of the design work, and it is the boundary I would defend hardest.
The book that queued $8.0M, and what was left standing
I ran a whole portfolio through it to see what adjudication actually does to a book. A storm passes eight areas of interest, the legacy single-frame trigger fires on six of them, and $8.0M in automatic payouts queues up. Every area here is synthetic, built physics-faithful rather than pulled from a real satellite archive, which is what let me plant each failure mode on purpose and know the ground truth for each one.
After adjudication, two of the six were real floods that persisted across frames with SAR and optical agreeing and the gauge corroborating, so they paid, and that is $4.0M confirmed. Three were the look-alikes, a cloud shadow, a radar shadow, and a permanent reservoir, each denied at high confidence, holding back $3.2M. One was too close to call and went to a human. Of the $8.0M the legacy trigger would have auto-paid, $4.0M was stopped or held for proof, and every decision in the book carries its own forensic dossier, so the evidence coverage reads 100%.
The 8-AOI book after adjudication: of the $8.0M the legacy trigger queued, $4.0M is confirmed for two real floods and $4.0M is withheld across three suppressed look-alikes and one escalation, each with a forensic dossier.
The case I built so the system would refuse to answer
I put real effort into the one case I wanted the system to refuse, because a governance layer that only ever says PAY or DENY is bluffing. AOI-F, a canal-district hub with $0.8M at stake, is borderline by construction. Its flood signature is weak, optical and SAR both sitting around 0.32, persistence at 67% of frames, and the independent river gauge only reached 0.86 times bankfull and never crossed it. The physics rules pass, but the ground evidence disagrees with the satellite.
The automation bar in the gate is a fitted threshold, CONF_MIN = 0.65. AOI-F came in at confidence 0.15, well under it, with the agent flagging a contradiction. So the gate escalated it to a human adjudicator with the full evidence attached, rather than force a $0.8M call in either direction out of a signal that weak. Getting it to escalate the genuinely ambiguous case, instead of guessing, took as much care as any flood the system pays, and it is the behavior I point to first when someone asks what "governance" buys you here.
The case I built to be refused: AOI-F comes in at confidence 0.15 with the river gauge never crossing bankfull, so the gate escalates the $0.8M call to a human instead of guessing.
What building this changed my mind about
I started this build assuming the hard, valuable part would be telling flood from shadow accurately, and building it moved where I think the value sits. On a benchmark of 60 labeled cases, spanning clear signatures down to near-threshold noise, the system made zero unsafe automated decisions, against 48 for the single-frame baseline that pays every flagged case. It auto-resolved 80% of the book, suppressed 100% of the false positives it auto-decided (36 of 36 shadows and reservoirs denied), and paid 100% of the real floods it auto-decided (12 of 12). Those numbers are on a fixed, labeled set of synthetic, physically faithful cases, not a field guarantee. Validating against real Sentinel archives and a public flood benchmark is the first thing a real engagement would do, and it is not something this demo claims to have done.
The 60-case labeled benchmark: zero unsafe automated decisions against 48 for the single-frame baseline, 80% auto-resolved, and 100% false-positive suppression and flood recall among the cases it auto-decided.
What that number actually proves is narrower and more useful than a high score. The system never makes an unsafe automated decision, because when the physics is uncertain it escalates instead of guessing. A sharper satellite would not have produced that behavior, and neither would a smarter model. It came from moving the decision into code that can be read, argued with, and audited, and from letting the model advise only the parts where advice is all you can safely trust it with. You can step through the same cloud-shadow catch, the escalation, and the evidence trail in the Satellite Flood Intelligence demo.
The line I kept from building it is the one the filmstrip makes without a word. The shadow moved, and the water would have stayed. A payout is only ever as trustworthy as the trigger behind it, and a single frame cannot tell you which of the two you are paying for.