AuthFlow AI: Governed Prior Authorization on UiPath

• 

  screen shot of case 2 suspend resume trail.

• 

  AuthFlow AI Architecture

Inspiration

Prior authorization is one of healthcare's most expensive and frustrating bottlenecks. When a clinician requests a procedure, the request enters a slow, manual review against a payer's medical-necessity policy. Staff chase missing documentation, reviewers re-read the same notes, and genuinely borderline cases wait in the same queue as clean approvals. It is slow, costly, and error-prone, and the decisions directly affect patient care. We wanted to show that an agent could accelerate this work without taking the decision out of human hands.

What it does

AuthFlow AI models prior authorization as a governed, long-running business process on UiPath Maestro. An AI agent reads the clinical record against the payer's policy and judges each medical-necessity criterion. A BPMN process then routes the request down one of three paths:

• Ready: all criteria met. The process generates the submission packet and submits, with no human needed.
• Missing documentation: the record is incomplete or ambiguous. The process suspends, creates a task in UiPath Action Center for staff, and waits. When the documentation is provided, the process resumes, re-evaluates the now-complete record, and proceeds to approval.
• Escalate: the request is guideline-discordant. It is never auto-denied. It routes to a Medical Director review task for a clinical decision.

The principle is simple: agents accelerate the work, and clinicians keep the decisions. Every determination carries evidence, confidence, and a citation to the policy.

How we built it

The core is a two-layer coded agent (CriteriaMatch) built with LangChain and running natively on UiPath. The model judges each policy criterion (met, not met, missing, or uncertain) with evidence, rationale, confidence, and a policy citation. A deterministic routing layer, not the model, then maps those judgments to a branch, so the routing decision is auditable and reproducible rather than left to the model. The agent is published to the UiPath tenant and invoked by a Maestro BPMN process. Human steps run through UiPath Action Center. The model runs through the UiPath LLM Gateway, so no external API key is required.

Challenges we ran into

The suspend and resume loop was the hardest and most rewarding piece. Getting a Maestro process to pause at a human task, hand off to Action Center, and resume cleanly on completion required solving real platform problems: publishing the agent to the correct tenant feed so the process could resolve it at runtime, provisioning the Action Center service and licensing, and making the loop-back re-evaluate against updated documentation rather than repeating indefinitely. We also hardened the agent's routing so that inapplicable criteria, such as smoking-cessation counseling for a lifelong non-smoker, do not trigger false escalations.

Accomplishments that we're proud of

We validated all three branches end-to-end on UiPath Automation Cloud. The centerpiece is the missing-documentation flow: the agent flags the gap, the process suspends, a staff member supplies the documentation through Action Center, and the process resumes and approves on re-evaluation. This is a real working example of a process that handles complexity, survives interruptions, and keeps a human in the loop at exactly the right moment, not a slide, but a running system.

What we learned

The real value of agentic automation is not just the agent. It is the orchestration and governance around it: the process that survives interruptions, keeps a human in the loop at the right moment, and produces an auditable trail for every determination. UiPath Maestro provided that orchestration layer, and the coded agent provided the reasoning, with each doing what it does best. We also learned a great deal about the practical realities of deploying a coded agent on the platform: feed publishing, service provisioning, and gateway configuration.

What's next for AuthFlow AI: Governed Prior Authorization on UiPath

Next steps include ingesting real payer policies directly rather than a mock policy, adding an extraction agent to pull structured fields from raw clinical documents, and wiring the submission step to a live payer API or portal. A clinician-facing interface would sit over the UiPath orchestration, so staff work in a familiar UI while the governed process runs underneath. We would also add richer audit and analytics so utilization-management teams can see where requests stall and why. The architecture is designed so that swapping in a new policy or a new therapeutic area is a configuration change, not a rebuild.

Built with a coding agent

AuthFlow was built end-to-end with the help of a coding agent (Claude). It designed the two-layer agent architecture (model judges criteria, deterministic code derives the route), wired the BPMN process and its input/output mappings, and debugged the live platform integration, including agent publishing, Action Center provisioning, and the suspend-resume loop. Verifiable evidence is in the repository at docs/coding-agent-log.md, a dated, session-by-session engineering log of the build.

Built With

• action-center
• bpmn
• langchain
• langgraph
• python
• uipath
• uipath-maestro