Cookbook: healthcare

Gate medication renewals and PHI disclosure with latched policies on a member-facing health agent.

A member-facing health agent answers questions about labs and care plans, and can renew medications. Two things must never happen: a renewal of a controlled substance without a clinician, and another member’s PHI appearing in a response. This cookbook shows both as latched policies.

The mechanisms here are the standard ones: latching, verdicts, and permits. Only the domain content is healthcare-specific.

The scenario

• Agent health-ai with tools lab_trends, care_plan_update, renew_meds, member_record.
• The consequential action is renew_meds. Chatting about lab results is routine and passes through uninspected by the renewal latch.
• The baseline latch-1 (Regulated Product & Substance Authorization) governs prescription renewals in this deployment; the healthcare-0 domain pack adds HIPAA privacy handling at the text stages.

The policy in prose

An agent may renew a medication only when the medication identity, the member context, and renewal eligibility are verified. Controlled substances are never renewed by an agent. Ambiguity about prescriber authority routes to a clinician. Responses must never disclose another member’s PHI, and context sent to the model is minimized to what the task needs.

Crafted into a policy pack

The privacy half of that prose becomes the healthcare-0 pack. Each checks[] entry surfaces as a runtime verifier; the verdicts[] mapping makes the latch’s behavior legible before it ever fires:

{
  "id": "healthcare-0",
  "name": "HIPAA Privacy & Security",
  "family": "healthcare",
  "blurb": "Minimum-necessary disclosure and PHI handling for member surfaces.",
  "tags": ["HIPAA", "PHI", "context-egress"],
  "checks": [
    "No other-member PHI in output",
    "Minimum-necessary context egress",
    "Authorization present for disclosure"
  ],
  "verdicts": [
    { "verdict": "BLOCK", "when": "output contains another member's PHI" },
    { "verdict": "WARN",  "when": "context egress exceeds minimum-necessary",
      "rewrite": "redact non-essential identifiers" },
    { "verdict": "ALLOW", "when": "disclosure is authorized and scoped" }
  ],
  "requirements": ["45 CFR 164.502", "45 CFR 164.514(d)"]
}

Attach it, together with the escalation pack, on top of the always-on baseline:

akhara policies attach health-ai healthcare-0 reliability-3

The latch at runtime

latch-1 stays dormant until the agent attempts the exact action it governs:

1. Chatting about labs, dormant

   checkOutput("your LDL improved to 142") matches no consequential action. Verdict: ALLOW. The renewal latch never fires.

2. Renewal requested, latch engages

   authorizeAction("renew_meds", { medication: "atorvastatin" }) matches latch-1. The PDP checks medication identity and prescriber authority.

3. Verdict binds the action

   • Eligible, non-controlled: ALLOW plus a one-time permitId
   • Missing prescriber authority: ESCALATE (route to a clinician)
   • Controlled substance: BLOCK
4. Permit gates the side effect

   The renewal service refuses to run without the permit, so a blocked or escalated renewal cannot leak through.

Authorize the renewal

curl -s https://api.akhara.dev/api/policy/authorize \
  -H "authorization: Bearer $AKHARA_API_KEY" \
  -H 'content-type: application/json' \
  -d '{
    "agentId": "health-ai",
    "session": "sess_demo",
    "stage": "action",
    "tool": "renew_meds",
    "args": { "medication": "atorvastatin" }
  }' | jq

{
  "verdict": "ALLOW",
  "stage": "action",
  "policyId": "latch-1",
  "rule": "Regulated Product & Substance Authorization",
  "reason": "Medication, member context, renewal eligibility verified",
  "tool": "renew_meds",
  "permitId": "permit_9f3ac21b",
  "attachedPolicyIds": ["latch-0", "latch-1", "healthcare-0", "reliability-3"]
}

Block a PHI disclosure

The healthcare-0 pack latches at the output stage, independent of any tool call:

curl -s https://api.akhara.dev/api/policy/authorize \
  -H "authorization: Bearer $AKHARA_API_KEY" \
  -H 'content-type: application/json' \
  -d '{
    "agentId": "health-ai",
    "session": "sess_demo",
    "stage": "output",
    "content": "Here are the lab results for patient Jordan Rivera: A1C 8.1"
  }' | jq

{
  "verdict": "BLOCK",
  "stage": "output",
  "policyId": "healthcare-0",
  "rule": "HIPAA Privacy Rule 164.502",
  "reason": "PHI Disclosure Without Authorization",
  "attachedPolicyIds": ["latch-0", "latch-1", "healthcare-0", "reliability-3"]
}

At context_egress, the same pack returns WARN with a PHI-minimized transformedContent; your runtime must use the rewritten version. See Verdicts.

Every decision above lands in the evidence feed and can be sealed into a signed verification record. See Audit and evidence.