# How must an instance bound indemnity scope to actual payment capacity?

**Date of Record:** 2026 November 2

**Scope:** Applies to contracts where one party indemnifies the other for specified losses, where the indemnity is uncapped or capped higher than the party's payment capacity. Does not apply to mutual or symmetrically collateralized indemnities.

## Core Distinction

An indemnity is a promise to pay for specified losses. The promise has a value only if it can be realized — if the indemnifying party's payment capacity is smaller than its promise, the excess is credit risk disguised as contractual protection.

**Invariant.** Indemnity is realizable if and only if `indemnity_cap <= liquid_assets + credit_facility + insurance_recovery`.

**Violation.** The **Paper Indemnity**. The indemnity clause promises full coverage, the indemnifying party's balance sheet cannot satisfy it, and when indemnity is invoked, the beneficiary receives a fraction of the promise and the remainder as an unsecured claim.

**Asymmetry.** The promise is visible in the contract; the capacity is visible in the balance sheet; the two are visible to different parties and rarely compared.

**Recorded elements.** The `indemnity-scope-receipt` (what losses are covered, capped or uncapped), the `capacity-receipt` (liquid assets plus facilities at the time of the indemnity), and the `insurance-recovery-signature` (what insurance actually pays) together make the realizability checkable.

## What Was Observed

**Signature.** Invoked indemnity paid at a fraction of the covered loss. The indemnifying party is solvent but not liquid; the beneficiary receives partial recovery plus an unsecured claim. Losses materialize as counterparty credit exposure, not as the security the indemnity was meant to provide.

**Trace.** Indemnity capped at $500 million (uncapped in the original). Indemnifying party has $50M liquid + $100M credit facility + $100M insurance = $250M realizable. A $500M loss is triggered. Beneficiary receives $250M and an unsecured claim for $250M that prices at a fraction.

**Why monitoring stays green.** The clause is in force. The indemnifying party is solvent. No system tracks the ratio of promise to capacity.

## Condition of Validity

The instance must ensure at least one holds before it treats indemnity as protection:

1. **Must cap by capacity.** `indemnity_cap <= liquid_assets + credit_facility + insurance_recovery`, verified at contract time and at indemnity event.
2. **Must re-verify capacity.** Capacity moves; a cap adequate at signing may be inadequate at the indemnity event.
3. **Must disclose the gap.** Where cap exceeds capacity, the gap is disclosed to the beneficiary as known credit exposure, not treated as protection.

## Decision Boundary

- Cap <= capacity: indemnity is realizable.
- Cap > capacity with disclosed gap: indemnity is partially realizable; the gap is credit exposure.
- Cap > capacity without disclosure: indemnity is notional in the gap; correct by disclosure or capacity increase.
- Uncapped indemnity: unbounded paper; the effective cap is the party's actual capacity.

## Operational Effect

The invariant couples a contractual figure to a balance sheet. The instance's correct posture is to cap by capacity, and to re-verify capacity at the indemnity event, not only at signing.

**Trap.** Add insurance. Insurance is part of capacity but is itself capped, and recovery can fail through exclusions, coverage disputes, or insurer default. Insurance counted alone substitutes one paper promise for another.

```python
from dataclasses import dataclass


class PaperIndemnityError(RuntimeError):
    """Raised when an indemnity scope exceeds the indemnifying party's realizable capacity."""


@dataclass(frozen=True)
class IndemnityGate:
    indemnity_cap: float
    liquid_assets: float
    credit_facility: float
    insurance_recovery_verified: float
    gap_disclosed: bool = False

    def verify(self) -> bool:
        capacity = self.liquid_assets + self.credit_facility + self.insurance_recovery_verified
        if self.indemnity_cap > capacity and not self.gap_disclosed:
            raise PaperIndemnityError(
                f"indemnity cap {self.indemnity_cap} > capacity {capacity}: "
                f"gap {self.indemnity_cap - capacity} is undisclosed credit exposure"
            )
        return True


def dispatch_indemnity_mode(gate: IndemnityGate) -> str:
    try:
        gate.verify()
    except PaperIndemnityError:
        return "cap-by-capacity-or-disclose-gap"
    return "indemnity-realizable"
```