GreenLight

Inspiration A drug works. 40 hospitals want to run the trial. It takes 9.4 months before the first patient gets a dose — not because of the science, because of paperwork. The number that got us: the same trial takes 78 days at one hospital and 313 at another. Same protocol, same rules. That's not medicine, that's coordination. What it does GreenLight runs a swarm of agents that does what a trial coordinator does — check what's missing, chase it, wait, check again — 40 hospitals at once.

One loop per hospital, diffing submitted docs against the regulator's checklist Loops spawn loops — each gap gets an agent; when it finds the real problem is deeper, it spawns a child It gets told no — denied a patient record, it re-plans and asks a human instead of crashing It remembers — one agent learns a coordinator answers Slack in 4h not email in 9 days; every future agent knows

How we built it

Nexla — 40 hospitals, 40 schemas → one object. This is what makes agents generic: one loop, N hospitals, zero site-specific code. Pomerium — every call policy-checked per identity, per document class, re-evaluated every time. Agents hold an identity, never a credential. AWS Bedrock — the plan → act → observe → self-correct loop. Sonnet for planners, Haiku for leaves. Context engine — shared memory the swarm reads and writes.

The invariant: a child can never hold more authority than its parent — enforced at the proxy, not by our code. Blast radius bounded by construction. What we didn't build: Pomerium's access log is the regulatory audit trail. Compliance fell out of the architecture. Challenges we ran into

Until Nexla normalized upstream, every agent needed site-specific logic — that's not a swarm, it's 40 scripts. We put a real service behind a real Pomerium policy so the 403 is genuine, not mocked. Teaching a loop to read a denial as signal rather than failure took the most iteration. [your actual 3am pain here]

Accomplishments that we're proud of

The most impressive thing it does is get told no — and handle it gracefully. That's a failure. Nobody expects that in a demo. A swarm a compliance officer would sign off on. Every other swarm demo hands N agents the same god-token. The swarm gets faster the longer it runs — memory compounds across sites.

What we learned

The industry already knows the answer. Best-practice guidance is: parallelize, track cycle times, escalate at 14 days. That's a control loop. They've known for a decade — they just don't have 600 coordinators. The hard part of swarms isn't the swarm, it's authority. It's an authz problem, not an AI problem. We checked our own stats: the famous "$8M/day" is contested. Tufts revised it to ~$540K/day. Still ~$97M of overhead per trial.

What's next for GreenLight

Protocol amendments — one upstream change silently invalidates docs across 40 sites; the swarm should catch it instantly. Real connectors (Veeva, Medidata, IRB portals) on synthetic data. The checklist is the only domain knowledge. Swap it for a building permit and it's the same product — permitting, credentialing, M&A diligence.

Trials are the wedge because the delay is measured in lives.

Built With

• awsbedrock
• nexa
• pomerium
• product-hunt