Sandbox profile
Claim file summaries
Medium intensityAdjusters get a summary of a first notice and the documents on file. The model does not decide coverage.
- Vertical
- Insurance
- Scale
- Small company
- Organization
- Cedar Lane MGA
- Shape
- Managing general agent, 40 people, personal lines, two states.
The business problem
A small MGA’s adjusters re-read the same FNOL, photos notes, and emails. A shared claims chatbot would put policyholder data in a vendor account the MGA cannot explain to its carrier or to its state. They want a one-page brief, written from the file, with the adjuster still deciding coverage and payment.
What Grae SI recommends
Family
Phi-4 mini or Qwen 2.5 3B Instruct
Size
3B-class. One GPU the MGA can colocate with its existing claims host.
Why this size
The brief is a summary, not a coverage opinion. A small model with a strict output shape (facts, missing documents, open questions) is easier to test than a larger model that wants to advise. The prompt forbids a coverage conclusion, and the eval checks that ban.
License
Printed on the card before training. The MGA accepts it. Grae SI does not sublicense the base model.
Data controls
Personal data
FNOL contains names, addresses, and sometimes health details after an injury. That is personal data, and injury facts can be health data.
De-identification
Training uses closed files with names and SSNs removed. Live briefs run on the real file inside the MGA network.
Access
The assigned adjuster and a supervisor. Producers do not query other people’s files through the model.
Residency
The two states are both US. Data stays in the US region the carrier already requires in the MGA agreement.
Retention
Briefs that are saved to the claim follow the claim-file schedule. Unsaved previews are not stored.
Risk classification
Intensity is a planning tier for evidence. It is not a certification and not a regulatory classification.
- The brief can shape what the adjuster notices, so it is not a harmless search box.
- Coverage, payment, and denial stay with the adjuster. The output template has no decision field.
- Automatic denial, or a score that sets payment, would be high and is not this profile.
Compliance requirements to prepare for
NAIC AI model bulletin
The bulletin asks insurers and their producers to govern AI that touches consumers. An MGA should be ready to show intended use, testing, and a human decision. Grae SI prepares that evidence. It is not a filing.
State insurance AI rules
Follow the states where the paper is written. Colorado’s unfair-discrimination framework and New York’s insurance AI expectations are examples, not a complete list. Counsel maps the actual states.
SOC 2
Carriers often ask an MGA for a control report. Grae SI is not the auditor.
GLBA-style privacy
Policyholder financial and claim data needs the same access and retention care the claim system already has. Health details in an injury claim raise the bar.
Grae SI helps assemble the evidence. It does not certify HIPAA, FDA, ISO, SOC 2, ICH, NAIC, GDPR, DPDP, or any other framework.
Validation KPIs
These are targets to lock before go-live. They are not measured outcomes from a customer deployment.
Fact support
At least 95% of brief sentences supported by the file, on 80 closed claims
A clean sentence that is not in the file is a defect.
No coverage language
0 coverage grants or denials on a 40-prompt probe
The template and the probe both enforce the boundary.
Missing-doc recall
At least 90% of absent required documents flagged
This is the useful part for a small team.
SSN in training extract
Zero, on a 30-row review
Redaction has to be checked, not assumed.
Deployment architecture
The claims system stays as it is. A private model endpoint reads a file the adjuster already opened. There is no broker portal hooked to the model in this sandbox.
01
Claims system
System of record for the file and the payment.
02
Redaction for training
Closed files only. Names and SSNs stripped.
03
3B runtime
Ollama on a small private node. Output is facts, gaps, and questions.
04
Adjuster
Reads the brief in the claim screen and decides in the existing fields.
Each box is a component in the customer’s network. Arrows are the order of the path, read left to right on a wide screen and top to bottom on a phone.
Where this sits in the stack
The same ten layers appear on every profile. The mark says whether Grae SI provides the layer, shares it, or leaves it with you. Person-weeks are the buyer’s effort after the runtime is deployed, not a project plan for the whole company.
- Grae SI providesGrae SI provides the layer
- SharedShared. Grae SI supports part of it.
- You ownYou own the layer after install
- You own
Layer 1
Infrastructure and compute
One small GPU beside the claims host the MGA already pays for.
Buyer effort after the runtime is up: 1–2 person-weeks
- Shared
Layer 2
Data ingestion and prep
A checklist of what to collect, a sample upload, and a readiness score. The pipeline from the system of record into an approved extract.
Buyer effort after the runtime is up: 2–5 person-weeks
- Shared
Layer 3
Data controls and governance
Policy numbers and SSNs are redacted in the prep preview. The carrier still owns the access model and the state privacy notices.
Buyer effort after the runtime is up: 1–3 person-weeks
- Grae SI provides
Layer 4
Model selection and training
Phi-4 mini or Qwen 2.5 3B. The job spec forbids a coverage field in the output template.
Buyer effort after the runtime is up: 0.5–1.5 person-weeks
- Shared
Layer 5
Evaluation and validation
A tier-matched suite, thresholds, and an exportable report. The labeled set, the acceptance call, and any statistics your quality system requires on top.
Buyer effort after the runtime is up: 1–3 person-weeks
- Shared
Layer 6
Agents and orchestration
Compliance agents that classify the use case and name the frameworks to prepare for. Any production agent that calls tools inside your applications.
Buyer effort after the runtime is up: 1–2 person-weeks
- Grae SI provides
Layer 7
Deployment and serving
Safetensors, GGUF, a model card, and an offline bundle for Ollama, vLLM, or llama.cpp. Moving that bundle into the zone and keeping the host patched.
Buyer effort after the runtime is up: 0.5–1.5 person-weeks
- Shared
Layer 8
Monitoring and drift
Registry lineage: version, dataset, eval result, and the package that was released. Live traffic checks, drift alarms, and the decision to pull a version.
Buyer effort after the runtime is up: 1–3 person-weeks
- You own
Layer 9
Application and integration
A panel inside the claim, not a new claims system.
Buyer effort after the runtime is up: 2–4 person-weeks
- You own
Layer 10
Organizational validation and sign-off
Compliance and the product counsel decide where a human must still decide. Grae SI will not mark the model approved for a state filing.
Buyer effort after the runtime is up: 1–4 person-weeks
Buyer effort for this profile
4–8 person-weeks
A 40-person MGA cannot staff a model-risk department. The packet is short, and the carrier may still ask to see it.
- Claims lead
- Compliance (often the same person as the carrier contact)
- The admin who runs the claims host
Quantitative benefits
Illustrative estimate for this sandbox. It is not a measured customer result. Assumptions for this profile are listed under the figures.
Time to a reviewable package
3–5 weeks
Two states, one line of business, one claims system.
Cost versus a cloud API
About $1.5k–$4k a month avoided
Illustrative: 6,000 claims touched a month, $0.25–$0.65 a summary on a hosted model, before the residency objection.
Compute
$150–$400 a month
One small GPU node, or a workstation in the same rack as the claims server.
Adjuster prep
10–20 minutes saved on a typical file
Illustrative, if the brief is actually used. A bad brief saves nothing.
Validation writing
About 1 person-week saved
Enough to answer a carrier’s AI questionnaire with attachments rather than a blank page.
Assumptions
- Illustrative estimate for this sandbox. It is not a measured customer result.
- The MGA does not set rates with this model and does not auto-deny.
- State list is an example. The real compliance work is the states on the certificate of authority.
- Injury claims with extensive medical records may need the health-system pattern instead of this 3B brief. That is a scope change.