Hospital Patient Autonomy Agent

Grandma wants to leave hospital NOW. Doctor says its a bad idea and she could die without proper treatment. This agent provides patients with the why and risks of their decisions.

Comment

Inspiration

Every ops incident steals 30 focused minutes from an engineer — and the most dangerous "incident queue" in the world is a hospital discharge decision. Discharge instructions exist; a usable surface for shared decision-making — especially the against-medical-advice (AMA) conversation — does not. Agents can automate both. But agentic automation in healthcare kills people when it's wrong, or when the judge of "correct" is itself wrong. So we built the guardrails first, and made them the product.

What it does

SENTINEL watches a live ops event stream and, with zero human intervention, plans with Claude, acts through a policy-gated tool registry, verifies by re-inspecting the actual state that fired the event, self-corrects when the first fix is insufficient, and escalates NEEDS-HUMAN when policy or retries say stop. Measured: detect → verified fix in ~10s; the full two-incident golden path in 67 seconds, hands off.

CONCORD turns one ambient clinician-patient conversation into one decision state, rendered to two audiences at once — clinical density for the clinician, large-print plain language for the patient. Every risk claim is fail-closed grounded to a curated evidence table; unverified numbers are withheld, visibly; artifacts (a large-print patient plan + a capacity-documented AMA/SDM note with a full provenance block) stay locked until a teach-back gate verifies comprehension and a human attests capacity. The patient can tap her choice and watch both pages update through the same shared state. The tool informs and documents; the clinician and patient decide. It never advises autonomously.

The shared doctrine — "Sentinel gates": the model proposes, deterministic gates dispose, nothing fails silently — is the whole point. We stage a honeypot live: our own model calls waiting "perfectly safe," and the grounding gate blocks it on stage.

How we built it

  • Loop engine (~100 lines): plan → act → observe → verify → correct, streamed to a glass-box UI over SSE. Claude (claude-haiku-4-5) plans with a 10s hard timeout falling back to deterministic runbooks — the demo cannot hang on a model call.
  • Pomerium (live): self-hosted identity-aware proxy; PPL route policy DENIES prod-db restarts — the blocked action on stage is a real 403 from a real proxy. Our MCP endpoint (7 TDD tests) routes every external tools/call through the same proxy: Pomerium's MCP-guardrail pattern, self-hosted.
  • Nexla (live): CONCORD's evidence corpus is a governed data product — webhook source → NexSet #435636 — pulled at boot; the grounding gate trusts only what the governed pipeline delivers. (We decoded the nexla_rest connector type from Nexla's own CLI.)
  • Akash (live ×2): both agents are deployed and serving on Akash right now (DSEQ 1784321934915 and 1784325010856), bid on the open marketplace at $5.32/mo each.
  • Everything flips live↔local by env flag, and the UI labels tell the truth at all times.

Challenges we ran into

  • Apple-Silicon build → ImagePullBackOff on Akash (providers are x86_64): rebuilt --platform linux/amd64; the pod self-healed on the same tag.
  • The $1 trial escrow ceiling silently killed our second deployment's bids — diagnosed via bid-window resets, fixed with sponsor credits.
  • Nexla's webhook ingest URL is cluster-scoped and undocumented — the answer was inside the venue's own CLI zip (source_type: nexla_rest; the minted per-source API key carries the ingest URL).
  • Honesty engineering: session-token 401s, offline mode, fallback labels — the demo is wifi-proof and every pane says what's real.

Accomplishments that we're proud of

Two agents, both live on decentralized compute; three sponsor products load-bearing (not logo-washed); a policy layer the model cannot bypass; 13 automated gate checks + 7 MCP tests + a stopwatch-graded rehearsal harness; and a healthcare surface whose refusal to show an unverified number is the feature. For counsel: every clinical note carries an evidence-corpus fingerprint, an AI-involvement disclosure, and the full timestamped gate log.

What we learned

Verification is the moat: state re-inspection beats model vibes; evidence tables beat prompt claims; and a gate that publicly blocks your own model is worth more than any capability demo.

What's next

Graduated tool trust (autonomy earned per tool), Nexla row/column RBAC on the evidence product, a clinician sign-off workflow as the only path to verified: true quantities, multi-provider Akash failover, and physician-blind validation (our LostBench / HealthCraft research lineage) before any deployment talk.

Built With

Share this project:

Updates