EWS CareAgent
Governed agentic AI, evidence-backed retrieval and controlled actions
A production-shaped engineering demonstrator for healthcare operations. CareAgent combines permission-aware retrieval, grounded answers with citations, a deterministic appointment workflow, and explicit approval before consequential actions. All data is synthetic. It is not a clinical system and does not replace clinicians.
The Challenge
The engineering problem
Generic assistants invent facts, skip provenance, and treat the model as a security boundary. Healthcare operations need answers grounded in approved knowledge, a predictable workflow, and a clear split between suggestion and action — without coupling the application to a single model vendor.
Solution
What EWS built
CareAgent keeps authorization, retrieval filtering, approval, and tool execution in application code. The model may propose. The application decides. Phases 0–7 are closed: hybrid retrieval, a deterministic appointment-support workflow, adversarial safety tests on synthetic data, provider abstraction, and a React product UI. Default generation is a local synthesizer. Hosted OpenAI live evaluation has not been executed.
Product experience
Working software
Selected application views. These are product screens, not conceptual placeholders.
Security by Design
The model may propose. The application decides.
- Authorization before model context
- Permission-aware retrieval
- Separate data and authority paths
- Explicit approval for consequential actions
- Re-authorization before execution
- Auditability
- Fail-closed behaviour
Technical evidence
Supporting diagrams
Architecture
How the system is composed
Two paths stay separate: what a user is allowed to see, and what a user is allowed to do. Unauthorized content must not enter model context.
Data path
What the user is allowed to see
User / Application
Ask or workflow request
Identity & Authorization
RBAC / ACL before context
Permission-Aware Retrieval
Only authorized candidates
Hybrid RRF + Reranking
Selected retrieval: hybrid-rrf-rerank
Grounded Generation
Local synthesizer by default
Guardrails / Output Validation
Structured output firewall
Evidence + Citations
Reviewable approved sources
Authority path
What the user is allowed to do
Tool Proposal
Model or workflow suggests an action
Policy / Ownership
Closed registry and object checks
Human Approval
Explicit, time-bound decision
Re-Authorization
Permissions checked again
Idempotent Execution
Application-owned tools
Audit
Trace of proposal, decision, result
Capabilities
What was implemented
Grounded answers with citations
Responses are labelled when grounded and linked to approved sources the reviewer can open.
Permission-aware retrieval
Authorization happens before model context. Unauthorized chunks are not sent to generation.
Hybrid retrieval
Phase 3 selected hybrid RRF plus reranking over embedding-only lookup, based on retrieval evaluations.
Deterministic appointment workflow
Appointment support is an application workflow, not an open-ended autonomous agent loop. LangGraph was rejected.
Approval before consequential actions
High-risk writes wait in an awaiting-approval state. Nothing is submitted until a reviewer approves.
Provider boundary
Local synthesizer is the default. An OpenAI adapter exists and is gated. Dockerized Ollama is an opt-in local option.
Engineering decisions
Choices that matter
Application owns authority
Prompts are not a security boundary. Identity, ACL, approval, and execution stay in deterministic code.
Separate data and authority paths
Seeing evidence and executing a tool are different controls. A grounded answer does not imply permission to act.
Hybrid retrieval over vector-only search
Operational language is precise. Lexical plus vector retrieval, then reranking, was selected on measured evidence.
Fail closed
Missing evidence, failed authorization, or uncertain actions abstain or deny rather than invent a safe-looking answer.
Technology
Stack by layer
Evidence
What we can stand behind
Closed implementation baseline
Phases 0–7 are closed, including a React product UI for Ask, evidence, decision trace, approvals, evaluations, and system status.
Retrieval selection
hybrid-rrf-rerank was selected in Phase 3 from measured retrieval evaluations. Historical metrics are retained in the project; they are not republished here as marketing scores.
Synthetic safety testing
Phase 5 ran 50 synthetic adversarial scenarios. That is an engineering harness, not a clinical or regulatory result.
What this is not
Not hospital production, not clinical decision support, not a medical device, not HIPAA or GDPR certified, and not real PHI. AegeanCare is a fictional reference network.
Related capabilities
Related EWS Capabilities
Discuss a similar project
Start from the workflow, the constraints, and the systems that have to stay authoritative.
Discuss a Similar Project