LatticePolicy

KO | EN

gitlite — search

#nextjs #machine-learning #cross-platform #ai-agent #cloud-native #graphql #tensorflow #containers #awesome-list #computer-vision

(★ 9)

Open-source P&C insurance policy underwriting and multi-tenant policy administration framework.

File Explorer

ZIP Download

- - task-definition-api.json
  - task-definition-frontend.json
- - bug_report.md
  - config.yml
  - feature_request.md
  - good_first_task.md
  - release_checklist.md
- - ci.yml
  - codeql.yml
  - deploy-aws-ecs.yml
  - deploy-azure-container-apps.yml
  - publish-ghcr.yml
  - security.yml
  - sync-roadmap.yml
- CODEOWNERS
- dependabot.yml
- labels.yml
- milestones.yml
- pull_request_template.md
- - agency.json
  - coverage.json
  - customer.json
  - document.json
  - policy.json
  - policy_term.json
  - producer.json
  - risk.json
  - transaction_history.json
- - ho_policy_seed.sql
  - pas_mvp_seed.sql
- endorsement.request.schema.json
- policy.schema.json
- quote.request.schema.json
- - ai-contributor-process.md
  - code-scanning-alerts-remediation.md
  - consolidated-dependency-fixes.md
  - dependabot-noise-control.md
  - docker-root-lockfile-builds.md
  - epic-development-process.md
  - ghcr-release-image-publishing.md
  - issue-102-v0.2.0-release-readiness.md
  - issue-176-product-pack-example.md
  - issue-178-uw-referral-decide-route-guards.md
  - issue-182-accessible-icon-labels.md
  - issue-192-v0.2.1-release-readiness.md
  - issue-193-v0.2.2-release-readiness.md
  - issue-194-v0.2.3-release-readiness.md
  - issue-212-remaining-document-hooks.md
  - issue-213-openapi-drift-coverage.md
  - issue-214-portal-document-list-ui.md
  - issue-215-structured-contract-errors.md
  - issue-218-legacy-import-templates.md
  - issue-219-legacy-import-validation-design.md
  - issue-221-react-router-audit-exception.md
  - issue-223-reinsurance-placement-auto-compute.md
  - issue-224-renewal-candidate-scan-job.md
  - issue-225-claims-reference-field.md
  - issue-227-job-queue-admin-ui.md
  - issue-38-production-job-queue-slice.md
  - issue-46-commission-handoff-events.md
  - issue-49-compliance-admin-workflows.md
  - issue-50-underwriting-referral-workflow.md
  - issue-52-out-of-sequence-handling.md
  - issue-53-policy-audit-replay-ui.md
  - issue-56-product-pack-contract.md
  - issue-57-batch-scheduler-framework.md
  - issue-58-operational-admin-dashboards.md
  - issue-59-test-automation-coverage.md
  - issue-60-acord-grlc-mapping-layer.md
  - issue-61-reinsurance-treaty-facultative-model.md
  - issue-62-bordereaux-framework.md
  - issue-63-exposure-management-views.md
  - issue-64-large-commercial-placement-workflow.md
  - issue-65-enterprise-identity-security.md
  - issue-66-carrier-onboarding-kit.md
  - issue-67-data-migration-import-framework.md
  - issue-68-production-runbooks.md
  - issue-83-github-roadmap-setup.md
  - issue-85-91-105-api-contract-validation.md
  - issue-86-portal-document-listing.md
  - issue-87-notification-template-admin.md
  - issue-88-document-artifact-storage.md
  - issue-89-servicing-document-hooks.md
  - issue-90-idempotency-reservation.md
  - issue-92-103-runtime-guardrails.md
  - manual-aws-ecs-deploy.md
  - notification-notice-framework.md
  - npm-audit-vulnerabilities-remediation.md
  - pilot-foundation-state-idempotency.md
  - policy-document-generation.md
  - policy-status-filter-parity.md
  - private-cloud-demo-deployment.md
  - README.md
  - roadmap-layout.md
  - standardize-release-process.md
  - TEMPLATE-product-pack.md
  - TEMPLATE.md
- ACORD_GRLC_MAPPING.md
- AI_CONTRIBUTOR_PROCESS.md
- API.md
- architecture-diagram.svg
- ARCHITECTURE.md
- aws-deployment-flow.svg
- azure-deployment-flow.svg
- CARRIER_ONBOARDING_KIT.md
- CLOUD_DEPLOYMENT.md
- COMMISSION_HANDOFF.md
- CONTRIBUTOR_ONRAMP.md
- CYBER_PRODUCT_ANALYSIS.md
- DATA_IMPORT_DESIGN.md
- DATA_IMPORT_TEMPLATES.md
- DATA_MODEL_ERD.md
- DEVELOPER_SETUP.md
- DOMAIN.md
- ENTERPRISE_IDENTITY_SECURITY.md
- EPIC_WORKFLOW.md
- FIRST_GOOD_TASKS.md
- gcp-deployment-flow.svg
- GIPA_DIAGRAM_ALIGNMENT.md
- GITHUB_ACTIONS_AWS.md
- GITHUB_ACTIONS_AZURE.md
- GITHUB_ROADMAP_SETUP.md
- GITHUB_SECURITY_ISSUE_DRAFTS.md
- GLOSSARY.md
- HO_JSON_TO_RELATIONAL.md
- JOB_QUEUE_DESIGN.md
- LOCAL_HEALTH_CHECKS.md
- MULTITENANCY.md
- NOTIFICATIONS.md
- OPEN_SOURCE_READINESS.md
- PAS_RELATIONAL_MVP.md
- PRODUCT_PACK_CONTRACT.md
- PRODUCTION_RUNBOOKS.md
- PROJECT_CONTEXT.md
- REINSURANCE_MODEL.md
- RELEASE_PROCESS.md
- ROADMAP.md
- TEST_PLAN.md
- VERTICAL_SLICE_SCOPE.md
- - api.ts
- auth-route-access.spec.ts
- workflows.spec.ts
- - App.tsx
  - config.ts
  - main.tsx
  - styles.css
- .dockerignore
- .env.example
- .gitignore
- Dockerfile
- index.html
- nginx.conf
- package-lock.json
- package.json
- tsconfig.json
- vite.config.ts
- vitest.config.ts
- nginx.prod.conf
- grafana-datasources.yml
- loki-config.yml
- promtail-config.yml
- - package.json
- - coverage.yaml
  - rates.yaml
- - coverage.yaml
  - rates.yaml
- - coverage.yaml
  - rates.yaml
  - README.md
- - coverage.yaml
  - rates.yaml
- - coverage.yaml
  - rates.yaml
- - coverage.yaml
  - rates.yaml
- check-import-templates.mjs
- check-npm-audit.mjs
- sync-github-roadmap.mjs
- test-docker.sh
- test-e2e-docker.sh
- test-integration.sh
- test.sh
- - 001_init.sql
  - 002_policy_version_columns.sql
  - 003_add_percent_to_coverage_selections.sql
  - 004_add_state_to_quotes.sql
  - 005_add_vehicle_dwelling_tables.sql
  - 006_quote_number.sql
  - 007_add_transaction_number_to_policy_versions.sql
  - 008_quote_audit_fields.sql
  - 009_underwriting_companies.sql
  - 010_forms_admin.sql
  - 011_forms_template_assets.sql
  - 012_tenant_date_display_settings.sql
  - 013_rbac_permissions.sql
  - 014_tenant_policy_number_formats.sql
  - 015_async_message_outbox.sql
  - 016_mfa_settings.sql
  - 017_customer_master.sql
  - 018_agency_onboarding.sql
  - 019_agency_code.sql
  - 020_ai_ml_capabilities.sql
  - 021_policy_customer_links.sql
  - 022_backfill_policy_customer_links.sql
  - 023_backfill_policy_customer_links_by_identity.sql
  - 024_customer_key_pattern_without_tenant.sql
  - 025_backfill_customer_keys_remove_tenant.sql
  - 026_backfill_customer_key_references_everywhere.sql
  - 027_agency_commission_rate.sql
  - 028_effective_dated_timeline.sql
  - 029_rating_workbook_framework.sql
  - 030_user_customer_portal_link.sql
  - 031_p0_policy_features.sql
  - 032_agency_parent_relationship.sql
  - 033_idempotency_keys.sql
  - 034_notification_framework.sql
  - 035_idempotency_reservation.sql
  - 038_underwriting_referrals.sql
  - 039_compliance_admin.sql
  - 040_data_import_framework.sql
  - 041_enterprise_identity_security.sql
  - 042_job_queue_framework.sql
  - 043_reinsurance_treaty_facultative.sql
  - 044_bordereaux_framework.sql
  - 045_large_commercial_placement.sql
  - 046_claim_reference_field.sql
  - 047_renewal_candidate_scan_job.sql
- - smoke-transactions.mjs
  - smoke-transactions.ts
  - smoke.ts
- - admin.ts
  - agencyOnboarding.ts
  - aiMl.ts
  - app.ts
  - asyncMessageWorker.ts
  - auth.ts
  - cache.ts
  - config.ts
  - contracts.ts
  - customerCrypto.ts
  - customerPortal.ts
  - customers.ts
  - db.ts
  - formsAdmin.ts
  - index.ts
  - insuranceCarriers.ts
  - logger.ts
  - mfa.ts
  - notificationTemplates.ts
  - openapi.ts
  - persistence.ts
  - policyCompliance.ts
  - policyInterests.ts
  - policyNumbers.ts
  - policyTimeline.ts
  - products.ts
  - rating.ts
  - ratingModelRegistry.ts
  - ratingWorkbench.ts
  - rbac.ts
  - schema.ts
  - store.ts
  - tenancy.ts
  - tenantAi.ts
  - tenantIdentity.ts
  - tenantPreferences.ts
  - tenantSecurity.ts
  - users.ts
  - uuid.ts
  - uw.ts
  - uwCompaniesStore.ts
- .dockerignore
- Dockerfile
- drizzle.config.ts
- package-lock.json
- package.json
- tsconfig.json
- vitest.config.ts
- vitest.integration.config.ts
- - config.yaml
  - field_meta.homeowners.json
  - README.md
.dockerignore
.env.example
.gitignore
.node-version
.nvmrc
AGENTS.md
CHANGELOG.md
CODE_OF_CONDUCT.md
COMMERCIAL.md
CONTRIBUTING.md
docker-compose.observability.yml
docker-compose.prod.yml
docker-compose.yml
endorse-payload.json
endorse.json
GOVERNANCE.md
LICENSE
package-lock.json
package.json
playwright.config.ts
quote.json
README.md
SECURITY.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

LatticePolicy is an open-source starter framework for building property and casualty insurance policy underwriting systems and multi-tenant policy administration platforms. It includes a policy API, operations UI, customer portal views, product and tenant extension points, Docker-based local deployment, and documentation for architecture, APIs, and deployment.

The core design is a single policy platform with access-based experiences. Internal users, agents, underwriters, administrators, and end customers all enter through the same framework, but see different navigation, routes, APIs, and data projections based on tenant, role, permissions, and customer-policy relationships.

The current implementation focuses on carrier-extensible property and casualty insurance workflows:

- Multi-tenant policy lifecycle APIs
- Quote intake, underwriting review, rating, bind, issue, endorse, cancel, reinstate, and renew workflows
- Product packs and tenant configuration
- Unified internal operations and customer portal architecture
- PostgreSQL persistence and Redis-backed cache
- Docker Compose local deployment
- CI and AWS ECS deployment examples

## Unified Access-Based Architecture

LatticePolicy intentionally avoids building the internal policy system and the customer portal as unrelated applications. Instead, it uses one platform architecture with different role-scoped experiences on top of the same domain model, policy lifecycle, document service, tenant model, and security boundary.

This matters for insurance systems because the same policy data is used by many audiences:

- Administrators manage tenant configuration, users, products, forms, and security.
- Underwriters review submissions, referrals, rating details, and transaction history.
- Agents create quotes, bind policies, service endorsements, and search customer/policy records.
- Actuarial or product users manage rating inputs and product behavior.
- Customers view only their own issued policies, customer-safe summaries, declarations, and ID cards.

The framework keeps those experiences consistent while enforcing different access levels.

### One Frontend Shell, Many Experiences

The `frontend/` app is a single React application shell. It renders different routes and navigation based on the authenticated user context.

Internal users may see operational routes such as:

- Dashboard
- Search
- Quote wizard
- Policy view
- Underwriting queue
- Rating workbench
- Administration
- Tenant configuration
- User/security management

Customer users may see only portal-safe routes such as:

- My policies
- Policy summary
- Declarations
- ID cards

The shell is shared, but the route tree is permission-gated. A customer role should not merely have hidden navigation; customer routes and backend APIs are also scoped so a customer cannot fetch internal policy records, rating worksheets, admin data, or other customers' policies.

### Access Model

The access model combines several checks:

- Tenant scope: every request is resolved inside a tenant boundary.
- Role-based access control: user roles determine broad capabilities such as admin, underwriter, agent, actuary, or customer.
- Permission-gated routes: frontend routes and navigation items are derived from the user's allowed capabilities.
- API authorization: backend handlers enforce the same access rules independently of the UI.
- Customer identity links: customer portal access is constrained through the relationship between `users.customer_id`, `customers`, and `policy_customer_links`.
- Portal-safe projections: customer-facing APIs return reduced views of policy data instead of internal operational records.

This means the customer portal is not a separate data silo. It is a restricted view over the same policy system.

### Shared Domain, Different Projections

Internal and customer experiences use the same underlying policy lifecycle, but not the same response shape.

Internal views can include operational details such as:

- Quote and transaction status
- Underwriting referral reasons
- Rating inputs and calculation traces
- Policy timeline and endorsement history
- Admin metadata
- Tenant/product configuration
- Form and document management details

Customer portal views should expose only what a policyholder needs:

- Policy number
- Product/line of business
- Current term dates
- Current premium summary
- Covered vehicles or insured risk summary
- Selected limits and deductibles
- Customer-facing declaration documents
- ID cards for eligible products

The backend supports this by providing portal-specific endpoints, such as customer summary and customer policy detail routes, that enforce linked-customer scope and return customer-safe data.

### Why This Architecture

This architecture is useful for open-source PAS adoption because it gives implementers one extensible platform instead of multiple disconnected systems.

Benefits:

- Lower duplication: policy lifecycle, documents, tenant configuration, and product behavior are reused.
- Stronger consistency: portal users and internal users see different views of the same source of truth.
- Cleaner security model: customer access is a first-class capability, not an afterthought bolted onto admin APIs.
- Easier carrier customization: tenant and product extensions affect the full platform consistently.
- Better auditability: transactions, documents, and derived portal views remain tied to the same policy timeline.
- Simpler deployment: one policy API and one frontend shell can support multiple user experiences.

### Design Principle

The framework should treat "portal" as an access pattern, not a separate product. A portal user is a user with a constrained identity link, constrained permissions, constrained routes, and constrained data projections over the shared policy administration domain.

## Repository Layout

```text
contracts/        Request/response schemas and contracts
docs/             Architecture, API, domain, and deployment notes
frontend/         Policy operations/customer React UI
packages/types/   Shared type package
products/         Product pack definitions and rating inputs
server/           Policy API server
tenants/          Sample tenant configuration and overrides
nginx/            Production reverse proxy configuration
observability/    Optional monitoring stack configuration
```

## Quick Start

Prerequisites:

- Docker Desktop
- Node.js 20+ and npm, if running outside Docker

Start the full local stack:

```bash
cp .env.example .env
docker compose up -d --build
```

Default local URLs:

- Policy UI: http://localhost:5173
- Policy API health: http://localhost:3300/health
- PostgreSQL: localhost:65432
- Redis: localhost:6379

Stop the stack:

```bash
docker compose down
```

## Development

Install workspace dependencies:

```bash
npm install
```

Run checks:

```bash
npm run build
npm run test
npm run typecheck
```

Run individual apps:

```bash
npm run dev:server
npm run dev:frontend
```

## Contributor On-Ramp

New contributors can start with docs, tests, product-pack examples, small UI
states, or demo experience improvements before taking on deeper policy lifecycle
work.

- Start here: [Contributor on-ramp](docs/CONTRIBUTOR_ONRAMP.md)
- Pick scoped starter work: [First good tasks](docs/FIRST_GOOD_TASKS.md)
- Read contribution rules: [CONTRIBUTING.md](CONTRIBUTING.md)
- Review architecture context: [Project context](docs/PROJECT_CONTEXT.md)

Maintainers label beginner-friendly work with `good first issue` and broader
collaboration opportunities with `help wanted`.

## Documentation

- [Developer local setup](docs/DEVELOPER_SETUP.md)
- [Contributor on-ramp](docs/CONTRIBUTOR_ONRAMP.md)
- [AI contributor process](docs/AI_CONTRIBUTOR_PROCESS.md)
- [First good tasks](docs/FIRST_GOOD_TASKS.md)
- [Roadmap](docs/ROADMAP.md)
- [Release process](docs/RELEASE_PROCESS.md)
- [Changelog](CHANGELOG.md)
- [GitHub roadmap setup](docs/GITHUB_ROADMAP_SETUP.md)
- [Epic development workflow](docs/EPIC_WORKFLOW.md)
- [Architecture](docs/ARCHITECTURE.md)
- [API](docs/API.md)
- [Domain model](docs/DOMAIN.md)
- [Insurance and platform glossary](docs/GLOSSARY.md)
- [Notifications and notices](docs/NOTIFICATIONS.md)
- [Multitenancy](docs/MULTITENANCY.md)
- [Data model ERD](docs/DATA_MODEL_ERD.md)
- [Cloud deployment](docs/CLOUD_DEPLOYMENT.md)
- [Production runbooks](docs/PRODUCTION_RUNBOOKS.md)
- [AWS GitHub Actions deployment](docs/GITHUB_ACTIONS_AWS.md)
- [Open-source readiness](docs/OPEN_SOURCE_READINESS.md)
- [Product pack extension contract](docs/PRODUCT_PACK_CONTRACT.md)
- [Commercial support and services](COMMERCIAL.md)
- [Carrier onboarding and go-live certification kit](docs/CARRIER_ONBOARDING_KIT.md)
- [Enterprise identity and security controls](docs/ENTERPRISE_IDENTITY_SECURITY.md)
- [Reinsurance treaty and facultative placement model](docs/REINSURANCE_MODEL.md)
- [ACORD and GRLC canonical data mapping](docs/ACORD_GRLC_MAPPING.md)
- [Bordereaux generation and validation framework](docs/tasks/issue-62-bordereaux-framework.md)
- [Data migration and legacy book import framework](docs/DATA_IMPORT_DESIGN.md)
- [Data import templates](docs/DATA_IMPORT_TEMPLATES.md)

## Extension Points

The framework is intended to be extended through product packs, tenant configuration, and service adapters. The existing sample tenant and product folders are the best starting point:

- `products/` — see [Product pack extension contract](docs/PRODUCT_PACK_CONTRACT.md) for the required files and framework code paths.
- `tenants/sample-carrier/`
- `server/src/`
- `contracts/`

## Security

Do not commit secrets. Copy `.env.example` to `.env` for local development and set real values outside source control.

Report security issues using the process in [SECURITY.md](SECURITY.md).

## Contributing

Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for setup, standards, and pull request guidance.

## Commercial Support

LatticePolicy is fully open-source with no feature gating. Paid implementation, hosting, and deployment support may also be available; see [COMMERCIAL.md](COMMERCIAL.md).

## License

This project is licensed under the Apache License 2.0. See [LICENSE](LICENSE).

LatticePolicy

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README