CareLoop

CareLoop takes referral, appointment, and records admin off family caregivers: models propose, deterministic policy authorizes, and independent reads verify every external action.

Comment

Inspiration

Family caregivers often become unpaid back-office coordinators. They track referrals, chase records, schedule appointments, monitor inboxes, and decide which administrative actions are safe to take — while already carrying the emotional work of caring for someone.

Most AI assistants can summarize that work or suggest what to do next. CareLoop tackles the harder problem: doing the administrative work end to end without letting the model silently invent authority, change a destination, duplicate an action after a failure, or treat confidence as permission.

CareLoop is built around one rule:

Models propose. Deterministic code authorizes. Independent reads verify what happened.

What CareLoop does

CareLoop is an autonomous care-administration agent for family caregivers.

From an incoming referral, records request, or administrative event, it can:

  • triage and structure the request;
  • gather the relevant evidence;
  • propose the next administrative action;
  • automatically allow, block, or require human approval for that exact action;
  • prepare external effects durably before execution;
  • perform authorized work;
  • recover safely when an external response is lost; and
  • independently read the destination system before declaring the task complete.

The goal is not another healthcare chatbot. The goal is to make routine administrative work disappear into the background and surface the caregiver only when a real authority decision is required.

Built with Strands Agents and AWS

Strands Agents SDK is the orchestration layer at the center of CareLoop.

An eight-node Strands graph built with GraphBuilder and MultiAgentBase moves each case through dispatch, triage, evidence gathering, planning, authorization, execution, reconciliation, and verification.

Two model-backed stages use Amazon Bedrock through Strands model abstractions:

  • Nova Micro for triage;
  • Nova 2 Lite for planning and extraction.

Model output is constrained into typed proposals. The model-backed stages deliberately do not own external-effect tools.

At execution time, CareLoop uses the Strands hook contract — including BeforeToolCallEvent, HookRegistry, and cancel_tool — together with a deterministic policy gate before an authorized effect can proceed.

The deployed system also uses:

  • Amazon EC2 for the application;
  • Amazon CloudFront for the public demo;
  • Amazon S3 as a real external document boundary;
  • AWS Distro for OpenTelemetry and Amazon Bedrock AgentCore Observability for trace evidence.

Authority is not prompt text

Every consequential value carries provenance and a trust level.

A destination extracted from an untrusted document cannot become trusted simply because the model repeats it confidently or a validator thinks it looks plausible.

CareLoop classifies arguments by what they control. Values such as dates can be validated, but authority-bearing arguments such as email recipients, upload destinations, access grantees, and granted roles receive stricter treatment.

The deterministic policy engine returns one of three outcomes:

ALLOW · DENY · REQUIRE_HUMAN

When human approval is required, the caregiver sees the exact normalized call before anything happens. Approval authorizes that call only; it does not promote hostile data into trusted data.

Durable execution and recovery

A successful tool response is not enough to prove that real-world work happened correctly.

Before an external effect is dispatched, CareLoop freezes its action identity and records a durable prepared command.

If the provider performs the action but the response is lost, CareLoop does not ask the model to create a new plan.

Instead it:

  1. restores the same prepared action;
  2. reconciles with the external system;
  3. performs an independent read;
  4. compares what exists with what was authorized; and
  5. settles the case only when they match.

Replayable and non-replayable effects are treated differently. An ambiguous email, for example, is not blindly sent again.

Proving the authority boundary matters

CareLoop includes a deterministic counterfactual evaluation designed to test whether the authorization layer is actually load-bearing.

The evaluation covers:

40 committed adversarial payloads × 2 delivery routes × 4 external-effect tools = 320 evaluated combinations

With the shipped policy:

0 / 320 unauthorized effects crossed the authority boundary.

With the same evaluation paths but the shipped policy replaced by an allow-all mutant:

320 / 320 effects executed.

These are not 320 independent attacks, and we do not claim universal prompt-injection immunity.

The important result is the counterfactual flip: when the deterministic authority layer is removed, the same evaluation paths produce the opposite outcome.

The public demo also includes a judge-visible malicious-document scenario where CareLoop deliberately supplies the dangerous proposal requested by the attacker and shows that the real policy boundary refuses it before any external action is prepared.

What judges can try

The public demo has four guided scenarios:

  1. Normal referral — CareLoop completes an administrative workflow and independently verifies the result.
  2. Malicious document — an attacker-requested destination is refused before execution.
  3. Human decision — the caregiver reviews and approves one exact external call.
  4. Recovery — CareLoop reconciles a prepared action after losing the provider response, without asking the model to plan again.

No signup, account, API key, or setup is required.

Challenges and what we learned

The hardest design question was deciding where model reasoning should end and system authority should begin.

We learned that once an agent can affect an external system, reliability is no longer only about better prompts or better model outputs.

Authority, provenance, idempotency, human consent, recovery, and settlement become product features.

Strands gives CareLoop flexible model-backed orchestration while the final right to act remains deterministic and inspectable.

Honest scope

CareLoop is an administrative prototype using synthetic care data.

  • Amazon S3 is a real AWS external boundary with create-once writes and fresh read-back verification.
  • The clinic is a separate synthetic DemoWorld HTTP service used to exercise booking and verification behavior.
  • Email and portal-grant effects are simulated.
  • CareLoop does not provide medical advice or clinical decision support.
  • It does not claim HIPAA compliance, production healthcare readiness, or real-patient validation.

A real-world pilot would require consented provider integrations, caregiver usability research, privacy/security review, and operational agreements with external systems.

Try CareLoop

Built With

Share this project:

Updates