Start with the systems
already running.
It runs on the systems you have today
The integration layer begins with the interfaces and records a plan already operates. Below, one synthetic authorization request arrives twice—once as X12 278 and once as FHIR—and is normalized into one governed record. The trace illustrates the contract our engineers establish around identity, provenance, and reconciliation.
It runs under rules you set
A health plan cannot place an unconstrained agent near a coverage decision, and legal is right to refuse. Governance is not a module bolted alongside the AI — it is the condition of the AI existing at all, so it lives in the substrate every workflow is built on. Below, three model calls cross the gate: one passes, one is refused fail-closed, and the adverse one holds until a licensed physician signs.
It leaves a record that outlives the engagement
Independent review requires the original decision context: who decided, which policy governed, and what evidence was available. Building that record as the work happens makes reviewability part of the operating system. Below, the record assembles: each entry seals to the previous hash, the same date answers differently on the validAt and knownAt axes, and the chain re-verifies offline from the record and a public key alone.
A dashboard is not a control.
Observability makes behavior visible. A control plane makes policy operational. The question a plan is actually asking is not whether an agent can do the work — it is what happens at the moment one of them tries to do something it should never have been able to do. Below, that moment, four times.
A control is defined by when it acts.
Four classes, in the order they touch a run. Three of them can stop something. The fourth is the one most estates already have, and it is the one that reports what happened after it happened — which is worth having, and is not a control.
What each control class actually doespreventive · inline · gate · continuous
- PreventiveWhen Before the model runs
The action is not available to be taken — no tool, no scope, no route.
Named in a typed registry, or not reachable
Yes - InlineUsually missingWhen While the model works
Blocks mid-run and hands back a correction signal instead of a finished mistake.
Enforced at construction, not at review
Yes - GateWhen Before anything is released
Withholds release until a named human in a named role signs the disposition.
Withheld until a person signs
Yes - ContinuousWhen After the action
Detects and records. By the time it fires, the thing has already happened.
Evidence, after the fact
No — detects only
The inline class is the one an estate is most likely to be missing, because it is the only one that requires the verification to run inside the loop rather than around it. An inventory of agents, a dashboard of their behaviour and a compliance report are all fourth-class instruments: they make the run legible, and none of them was ever in a position to refuse it.
A check performed by the thing being checked is not a check. The verifier is either a deterministic tool or a different model lineage, and the disposition belongs to a named human in a named role — the same separation of duties an auditor already expects everywhere else in the plan.
Deterministic checks and model-based checks are not alternatives. Schema, policy, access and lineage are decided by code, because those answers must be the same every time. Intent and business logic need judgement. A control plane that runs only one of the two is missing the half it finds inconvenient.
The model should be the easiest thing to replace.
A foundation model is a fine place to start and a poor place to become structurally dependent. Where data is regulated, the durable answer is a model boundary the enterprise controls—client-hosted or approved managed capacity—with governed data use and a tested replacement path.
- The model is a component
- Typed interfaces keep model choice replaceable rather than turning one provider into a structural dependency. A reviewed model change follows the same evaluation and release path as any other production component.
- Inside the approved deployment boundary
- The workload can use client-hosted infrastructure or approved managed services, with identity, data movement, tenancy, and administrative control defined against the enterprise architecture.
- Data governed where it is used
- Fine-tuning, retrieval, and small-model work follow the agreed data boundary, retention policy, provider terms, and evidence requirements for the workload.
- Economics the enterprise can govern
- Workload budgets, model routing, capacity choices, and approval thresholds make operating cost visible and controllable alongside quality and risk.
The engineers who set the boundary have sat on the other side of it — running security and compliance functions, and being audited rather than only reading the report afterwards. It is the difference between a control that satisfies a questionnaire and one that holds when somebody tests it.
Start with the systems already running.
The governed layer attaches to the systems you already run and reads and writes through typed tools, preserving systems of record while adding orchestration, controls, and evidence at the operating boundary.
- No data migration. Your systems keep their records.
- No replatform. Core admin remains the system of record.
- No rip-and-replace of the UM platform.
- No PHI moved out of your environment to make any of it work.
What ‘connects to your systems’ actually means
A production connector begins with an explicit contract for sources, permissions, limits, failure behavior, and evidence.
X12 EDI, behind your clearinghouse
837, 835, 270 and 271, 278 — consumed and produced on the transport you already run.
We sit behind the clearinghouse you already run.
FHIR R4 and the CMS-0057-F APIs
Coverage requirements discovery, documentation templates and the prior-auth API, where a plan has stood them up.
Where a plan has not stood them up, standing them up is in scope — not a prerequisite for starting.
HL7v2 feeds
ADT and results consumed in the dialect the sender already emits.
The sender is not asked to change. Dialect handling is ours, per feed.
SFTP batch and flat files
The real interface to most core platforms. Landing zone, schema pinned per file, checksum per drop, replay on failure.
A nightly file does not become a real-time feed because an agent reads it.
Read replicas and change data capture cover reporting; screen-level automation is the last resort, and is still a typed tool with a recorded before and after. Every attachment runs read-only in shadow first, and promotion is signed by the plan.
What follows is the same workflow at four depths of trust: running alongside your current path and writing nothing, then writing to its own store, then writing back on your signature. Nothing is replaced at any point — the systems of record stay where they are.
It extends well past prior auth.
Once the connectors, authority gates, evidence chain, and human-review machinery are established, subsequent workflows begin from a reviewed technical foundation. Prior auth, claims & appeals, and the voice channel demonstrate reusable patterns; each new production boundary is still fitted to the client estate, evaluated, approved, and released on its own evidence.
Deeper: the first workflow · how a past decision is rebuilt · why it compounds