System and method for creating employee benefit booklets / guides

A multi-tenant employee benefit automation system comprising:

• one or more processors;
• and
• one or more non-transitory memories storing instructions that, when executed by the one or more processors, provide:
• an identity and tenant-permission service configured to authenticate users, associate each user with a tenant organization, create tenant-scoped security contexts, and enforce tenant-specific permissions for companies, plans, documents, carrier invites, employer decisions, employee enrollment records, review actions, output types, and publication actions;
• a source-document ingestion service configured to receive uploaded or imported benefit source documents and store each received document as an electronically stored source object comprising file bytes or storage object key, source-object identifier, tenant identifier, company identifier, plan-year identifier, document-type identifier, original filename, upload timestamp, uploader identifier, parser status, and cryptographic hash calculated from the file bytes;
• a parsing service configured to convert source objects into source segments comprising addressable pages, paragraphs, lines, tables, table rows, table cells, headings, footnotes, coordinate regions, rate-tier rows, benefit rows, text spans, or image regions and to store segment metadata comprising page numbers, row identifiers, column identifiers, character offsets, coordinate values, extracted text, parser version, and source-document hash;
• a sample-matching service configured to generate numerical vector representations from extracted text, table labels, layout metadata, carrier identifiers, plan identifiers, coverage-line identifiers, or field candidates and retrieve one or more matched samples from a sample repository of previously processed benefit documents using vector similarity and at least one of carrier similarity, plan-type similarity, form-layout similarity, schema-version compatibility, tenant permission, or reviewer-quality score;
• an extraction-instruction service configured to assemble target source text, target segment identifiers, matched sample text, matched sample structured data, expected schema field identifiers, permitted data types, normalization rules, and constraints requiring values to be taken from the target source object or another approved origin rather than from matched sample values;
• an extraction model interface configured to provide the assembled extraction instructions to an extraction model and receive candidate structured benefit data comprising field names, field values, data types, proposed source locations, and confidence information;
• a validation and review service configured to compare candidate field values against target source segments, normalize field values, assign confidence values, create source anchors, detect matched-sample leakage conditions, create source-anchor coverage-map records, and route unsupported fields, conflicting fields, missing fields, leakage-suspected fields, schema-invalid fields, rate-invalid fields, or fields having confidence values below configured thresholds to a review queue;
• an approved normalized benefit data store configured to store approved plan, carrier, coverage, rate, contribution, eligibility, compliance, cost, source-anchor, confidence, reviewer-status, version, tenant, company, plan-year, source-anchor coverage-map, and source-document hash data;
• a renewal dependency graph service configured to link source objects, source anchors, approved normalized benefit records, carrier responses, spreadsheet scenarios, generated output components, compliance templates, enrollment screens, publication links, and manifest records and to determine downstream effects of source, rate, contribution, template, approval, or publication changes;
• output services configured to generate at least two output types from the approved normalized benefit data store, the output types selected from benefit booklets, annual legal notices, wrap summary plan description documents, premium-only-plan documents, broker compensation disclosures, request-for-proposal artifacts, spreadsheet artifacts, enrollment sites, microsites, translations, quick response code linked pages, customer relationship management records, election sheets, premium breakdown sheets, carrier termination letters, and flipbooks;
• and
• a manifest, audit, and publication service configured to generate manifest data records linking generated outputs to source-object identifiers, source-document hashes, source anchors, source-anchor coverage-map records, approved-record versions, schema versions, template versions, reviewer approvals, output hashes, publication links, user identifiers, timestamps, access permissions, and dependency-graph status, wherein a publication gate prevents serving, exporting, or linking a generated output when a required field or component remains unsupported, leakage-suspected, unresolved, stale, expired, revoked, or inconsistent with a current manifest state.

A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors of an employee benefit automation platform, cause the one or more processors to perform operations comprising:

• maintaining, for a tenant organization, company, and plan year, an approved normalized benefit record comprising approved benefit fields, rate fields, contribution fields, eligibility fields, compliance fields, source anchors, confidence values, reviewer status, source-document hashes, and an approved-record version identifier;
• maintaining a source-anchor coverage map that identifies, for required employee-facing, employer-facing, carrier-facing, or agency-facing values, whether each required value is supported by a source anchor, user-entered origin, imported origin, computed origin, template-derived origin, review-approved exception, or unresolved status;
• generating, from the approved normalized benefit record, at least one publication artifact selected from an enrollment site, microsite, benefit booklet, dynamic online spreadsheet, request-for-proposal package, employee election sheet, premium breakdown sheet, legal notice, compliance document, translated output, or quick response code linked page;
• creating a manifest data record for the at least one publication artifact, the manifest data record identifying source-document hashes, source anchors, source-anchor coverage-map version, approved-record version identifier, schema version, template version, rate-calculation rule version where applicable, spreadsheet scenario version where applicable, translation-rule-set version where applicable, generated-output identifier, output hash, publication setting, and access scope;
• creating or validating a publication access record, signed link, employee token, employer token, carrier token, or authenticated session based on the tenant organization, company, user scope, employee scope where applicable, carrier invite scope where applicable, approved-record version identifier, manifest data record, publication setting, expiration time, revocation status, password requirement, device restriction, network restriction, token hash, or cryptographic signature;
• receiving a request to access the at least one publication artifact;
• evaluating a publication gate that compares current source-document hash, current approved-record version, current source-anchor coverage-map version, current schema version, current template version, current rate-calculation rule version, current spreadsheet scenario version, current translation-rule-set version, current review-queue state, current legal-notice template status, current publication setting, and current access-token status to corresponding values in the manifest data record and publication access record;
• and
• preventing access to a required value or component of the at least one publication artifact when the publication gate identifies the required value or component as lacking a source anchor or approved origin, unresolved in a review queue, leakage-suspected, stale, expired, revoked, outside the permitted access scope, or inconsistent with the manifest data record.