Understanding the product before generating anything
SALC builds a versioned understanding of the product before it generates a single downstream artifact. Sources are normalised, never replaced.
Four documents, normalised and preserved
Each ingested file becomes a SALC Source Artifact: original bytes, location, version, author, permissions and processing history.
Primary product requirements document for claim intake, evidence handling and payout controls.
Given/When/Then acceptance criteria maintained alongside the sprint backlog.
Contract for the claims service: submission, document upload, settlement and audit endpoints.
Working notes on fraud scoring, escalation thresholds and retention obligations.
Original sources are preserved. AI summaries never replace source truth — extraction produces new rows that reference the artifact.
What comes out of the sources
Six structured outputs, each one citing the artifact and locator it came from.
- ✓Requirements37
- ✓Business rules12
- ✓Risks8
- ✓Constraints14
- ✓Dependencies22
- ✓Contradictions2
Product Knowledge Snapshot #KN-0842
Editing produces a new snapshot. Approvals reference a snapshot ID permanently.
- Snapshot ID
- KN-0842
- Sealed at
- 13:42:12
- Requirement set
- v17
- Tenancy
- org-demo-001 · project-demo-001
- Mutability
- Immutable — edits create a successor
How the snapshot is wired
Requirements sit between the artifacts that justify them and the rules and risks that constrain them. This graph is what later stages read.
Abridged for display — the full snapshot holds 37 requirements, 12 rules, 8 risks and 214 citation relationships.
SALC does not silently choose an interpretation
Two authoritative sources disagree. A system that quietly picks one produces output that looks authoritative and cannot be falsified — so the contradiction itself is treated as the finding.
Conflicting daily transaction limit
Page 12 · Section 4.3
AC-41
Two authoritative sources specify different daily transaction limits for the same requirement. SALC cannot determine which is correct without a human decision.
Conflicting evidence retention period
Page 26 · Section 4.11
Section 5 · Retention
The PRD and the risk and compliance notes state different retention periods for claim evidence. Both are dated within the same week.
Business rules
- BR-11Claim eligibility window
A claim is eligible only if notified within 30 days of the incident and not already lodged for the same incident.
4 requirements - BR-14Identity and coverage precedence
Identity is verified before coverage; coverage is verified against the policy in force on the incident date.
6 requirements - BR-18Deductible application order
The deductible is applied to the assessed amount before limits and before any payout is proposed.
2 requirements - BR-22Daily transaction limit enforcement
The rolling 24-hour transacted total for a claimant must never exceed the stated daily limit. Enforcement is server-side and evaluated at the moment of transaction.
1 requirements - BR-25Settlement ceiling and authorisation
Settlements above the per-claim ceiling require supervisor authorisation before a payment instruction is generated.
2 requirements - BR-27Fraud escalation threshold
A fraud score at or above the threshold removes a claim from straight-through processing until an investigator clears it.
2 requirements - BR-31Mandatory evidence set
Each claim type defines a mandatory evidence set that must be satisfied or explicitly waived with a reason before submission.
6 requirements - BR-33Retention, redaction and versioning
Evidence is versioned, redacted when shared externally, retained for the stated period and then purged with an audit record.
4 requirements - BR-36Adjuster workload balancing
Assignment selects the lowest open workload within the competency pool for the claim type.
1 requirements - BR-38Partial settlement authority
A partial settlement must state the withheld amount and a reason, and leaves the claim open for the balance.
2 requirements - BR-41Regulatory record completeness
Every decision is auditable and exportable in the regulator's layout without personal contact details.
2 requirements - BR-44Notification and service-level cadence
Status changes notify within 5 minutes and first response is due within the stated service level.
2 requirements
Risks
- RSK-01Financial exposure from limit bypassHigh
If the daily limit or the settlement ceiling can be bypassed — client-side only enforcement, a race between two requests, or a window that fails to roll — the portal pays out more than the policy permits.
FinancialREQ-1042 · REQ-1043 · REQ-1040 · REQ-1041 · REQ-1044 - RSK-02Fraudulent claim accepted straight throughHigh
A claim scoring at or above the escalation threshold that still reaches settlement defeats the entire fraud control.
FraudREQ-1046 · REQ-1025 - RSK-03Sensitive data leaving the assessing teamHigh
Uploaded evidence routinely contains bank details and identity documents. Unredacted external sharing or an expired link that still resolves would disclose them.
PrivacyREQ-1020 · REQ-1023 · REQ-1024 · REQ-1030 - RSK-04Regulatory non-compliance on recordsMedium
An incomplete audit trail, an early purge or an export missing decisions would each fail a regulatory inspection.
ComplianceREQ-1026 · REQ-1029 · REQ-1050 · REQ-1051 - RSK-05Claim content lost during intakeMedium
A claimant who loses a partially completed claim or a large evidence upload frequently abandons the claim entirely.
OperationalREQ-1006 · REQ-1009 · REQ-1021 · REQ-1027 · REQ-1028 - RSK-06Service level breached without visibilityMedium
A first response that silently misses the service level damages the claimant relationship and the regulator's view of conduct.
OperationalREQ-1008 · REQ-1045 · REQ-1047 · REQ-1052 - RSK-07Unauthorised access to claim recordsHigh
Weak step-up authentication, a session that outlives the user, or a role boundary that leaks another claimant's record all expose claim data.
SecurityREQ-1001 · REQ-1002 · REQ-1003 · REQ-1004 · REQ-1005 - RSK-08Duplicate payout on a re-submitted claimMedium
A duplicate claim that reaches assessment, or a settlement instruction generated twice, results in paying the same loss twice.
FinancialREQ-1011 · REQ-1049