Healthcare Intelligence Operating System roadmap for agents, events, registries, clinical workflows, and governed deployment.

FHIR

SNOMED

LOINC

RxNorm

ICD-10

CPT

payer policy

clinical guidelines

synthetic-fast-router

enterprise-reasoning-synthetic

future-clinical-model

Safety and architecture contract

• Capabilities:
• Exit criteria: Central policy gate is referenced by sensitive APIs., NO-GO boundaries are visible in docs and APIs., No direct LLM-to-database access is encoded as an invariant., Starter registries and event names are versioned.
• Blocked until: No customer PHI, production connector, or clinical action can enter this phase.

Governance backbone

• Capabilities: SCRIMED Event Mesh, Agent Identity Registry, Agent Registry, Prompt Registry, Policy Registry, Model Registry, Evaluation Registry, Zero-Trust Audit Ledger
• Exit criteria: Every agent and model route has an identity, owner, version, policy, and audit event., Event envelopes are deterministic and replayable., Registry changes require approval records.
• Blocked until: Registry mutation APIs have RBAC, AAL2, audit, and rollback controls.

Tool and runtime plane

• Capabilities: Secure MCP Gateway, CodeMode Runtime for agents, SQL/FHIR Query Validation Middleware, Secure RAG/Data Ingestion Pipeline
• Exit criteria: All tool calls require scoped identity and policy checks., CodeMode runs in sandboxed, time-limited, network-restricted execution., SQL and FHIR queries are validated before execution., RAG ingestion preserves document structure and evidence links.
• Blocked until: No production system of record receives writes or unreviewed tool calls.

Clinical and data workflows

• Capabilities: Clinical Workflow Orchestrator, FHIR Validation Agent, Imaging Integration Layer, Clinical QA Engine, Human-in-the-loop Clinical Safety Sandbox
• Exit criteria: Clinical outputs carry evidence, confidence, limitations, and escalation criteria., FHIR validation rejects unsafe or profile-invalid payloads., Imaging is metadata/report-first and no-PHI until approved., Human review remains mandatory for protected clinical workflows.
• Blocked until: Clinical governance approves reviewer roles, escalation criteria, and workflow-specific risk rubrics.

Operations intelligence

• Capabilities: Configuration Drift Agent, AI Cost Intelligence Agent, Observability Platform, Autonomous Remediation Agent
• Exit criteria: SLOs, traces, model costs, registry drift, and deployment drift are observable., Autonomous remediation creates reviewed proposals, not live mutations., Cost and provider anomaly events are routed to human owners.
• Blocked until: No remediation action can mutate production without deployment approval pipeline signoff.

Deployment platform

• Capabilities: Infrastructure-as-Code Engine, Kubernetes Deployment Engine, Deployment Approval Pipeline
• Exit criteria: Terraform or equivalent IaC can reproduce approved environments., Kubernetes manifests are signed, scanned, policy-checked, and rollback-ready., Deployment approval pipeline blocks unsafe releases.
• Blocked until: Secrets, PHI stores, live connectors, and production clusters have separate approval tracks.

Outcome learning

• Capabilities: Continuous Outcome Learning Engine
• Exit criteria: Outcome signals are consented, de-identified or approved, and evidence-linked., Learning updates create evaluation tasks, not automatic clinical behavior changes., Regression and bias checks pass before policy or prompt promotion.
• Blocked until: No live patient outcome learning can run without legal, privacy, clinical, and customer approval.

SCRIMED Event Mesh

• Interfaces: publishEvent(envelope), subscribe(topic, consumer), replay(correlationId), deadLetter(eventId)
• Events: event.mesh.event.accepted, event.mesh.event.replayed, event.mesh.dead_letter.created
• Controls: schema validation, idempotency, tenant boundary, immutable hash, dead-letter owner
• Human gate: Human review required before event replay can trigger any protected workflow.
• Blocked autonomy: protected side effects from replay, cross-tenant event reuse, PHI-bearing public events

Agent Identity Registry

• Interfaces: registerAgent(), issueAgentRunIdentity(), revokeAgentIdentity(), getAgentTrustScore()
• Events: agent.identity.registered, agent.identity.versioned, agent.identity.revoked, agent.identity.trust_score.updated
• Controls: least privilege, AAL2 operator approval, version pinning, revocation, audit trail
• Human gate: Security owner approval required for new protected-tool scopes.
• Blocked autonomy: anonymous agent runs, unversioned tools, self-granted permissions

Secure MCP Gateway

• Interfaces: listTools(identity), authorizeToolCall(), executeTool(), revokeToolGrant()
• Events: mcp.tool.requested, mcp.tool.authorized, mcp.tool.denied, mcp.tool.result_recorded
• Controls: OAuth/OIDC, scoped tokens, tool allowlist, revocation, prompt-injection filter, result redaction
• Human gate: Human approval required for protected tools, connector writes, patient-facing actions, and payer actions.
• Blocked autonomy: unpermissioned tools, EHR writeback, payer submission, patient outreach

CodeMode Runtime for agents

• Interfaces: createCodeRun(), validateArtifact(), approveArtifact(), discardRun()
• Events: codemode.run.started, codemode.artifact.created, codemode.artifact.validated, codemode.run.quarantined
• Controls: sandbox isolation, no secret injection, artifact hash, malware scan placeholder, human approval
• Human gate: Human owner approval required before generated code, SQL, or FHIR transforms affect any workflow.
• Blocked autonomy: direct database execution, network egress by default, secret access, production mutation

Clinical Workflow Orchestrator

• Interfaces: startWorkflow(), advanceState(), requestReview(), rollbackWorkflow()
• Events: clinical.workflow.started, clinical.workflow.review_required, clinical.workflow.blocked, clinical.workflow.rollback_requested
• Controls: state machine, human clinical review, evidence cards, rollback, no live-care authority
• Human gate: Human owner review is required; this capability cannot create diagnosis, treatment, prescribing, outreach, payer, EHR, or production connector authority.
• Blocked autonomy: diagnosis, treatment, prescribing, triage replacement, patient instructions

Agent Registry

• Interfaces: registerAgentVersion(), approveAgentVersion(), deprecateAgentVersion(), listApprovedAgents()
• Events: registry.agent.created, registry.agent.approved, registry.agent.deprecated
• Controls: owner approval, version pinning, tool scope validation, eval gate
• Human gate: Platform and domain owner approval required before agent promotion.
• Blocked autonomy: self-promotion, unapproved tools, unreviewed clinical agent release

Prompt Registry

• Interfaces: registerPrompt(), promotePrompt(), rollbackPrompt(), bindPromptEval()
• Events: registry.prompt.created, registry.prompt.promoted, registry.prompt.rollback
• Controls: template validation, injection checks, reviewer signoff, rollback
• Human gate: Prompt promotion requires domain owner review for clinical, payer, or security workflows.
• Blocked autonomy: silent prompt edits, unreviewed clinical prompts, prompt bypassing policy

Policy Registry

• Interfaces: evaluatePolicy(), registerPolicy(), promotePolicy(), explainDecision()
• Events: registry.policy.created, policy.decision.allowed, policy.decision.denied, policy.decision.review_required
• Controls: versioning, decision logging, least privilege, most restrictive rule, appeal path
• Human gate: Policy changes require security, clinical, or operations owner approval based on scope.
• Blocked autonomy: policy self-modification, unlogged allow decisions, policy bypass

Model Registry

• Interfaces: registerModel(), approveModelRoute(), selectModelRoute(), rollbackModelVersion()
• Events: registry.model.created, model.route.selected, model.route.blocked, model.version.rollback
• Controls: provider contract, data-use policy, cost guardrail, fallback, eval baseline
• Human gate: Model approval requires privacy, security, and domain owner review.
• Blocked autonomy: unlogged external model calls, PHI routing without approval, single-provider hard dependency

Evaluation Registry

• Interfaces: registerEvalSuite(), runEval(), recordReviewerOutcome(), blockReleaseOnFailure()
• Events: registry.eval.created, eval.run.started, eval.run.completed, eval.release_block.created
• Controls: no PHI fixtures, regression threshold, human reviewer labels, bias checks, drift checks
• Human gate: Clinical-risk eval changes require clinical governance review.
• Blocked autonomy: leaderboard-only approval, unreviewed clinical eval promotion, PHI in fixtures

FHIR Validation Agent

• Interfaces: validateFhirResource(), explainFhirError(), proposeFhirTransform(), createInteroperabilityReview()
• Events: fhir.validation.requested, fhir.validation.passed, fhir.validation.failed, fhir.transform.proposed
• Controls: FHIR profile validation, terminology validation, consent/purpose check, LLM output cannot execute direct SQL or direct system-of-record queries; all access must pass through validation middleware, MCP policy, scoped identity, and audit.
• Human gate: Interoperability owner review required before production FHIR transforms or connector activation.
• Blocked autonomy: FHIR writeback, profile bypass, terminology guessing, live patient mutation

Imaging Integration Layer

• Interfaces: validateDicomMetadata(), ingestSyntheticImagingReport(), queueImagingReview(), recordImagingEvidence()
• Events: imaging.metadata.validated, imaging.report.ingested, imaging.review.required, imaging.inference.blocked
• Controls: DICOM tag minimization, no pixel PHI by default, specialist review, GPU job policy, model card
• Human gate: Radiology or domain specialist review required before any imaging interpretation is released.
• Blocked autonomy: diagnostic imaging interpretation, PACS writeback, pixel data ingestion without approval, unreviewed inference

Configuration Drift Agent

• Interfaces: captureConfigSnapshot(), compareDesiredState(), openDriftReview(), blockUnsafeDeployment()
• Events: drift.snapshot.created, drift.detected, drift.review_required, drift.deployment_blocked
• Controls: read-only collection, secret redaction, severity scoring, owner routing
• Human gate: Platform owner approval required before drift remediation applies.
• Blocked autonomy: automatic production config changes, secret logging, unreviewed policy mutation

AI Cost Intelligence Agent

• Interfaces: recordUsage(), evaluateBudget(), forecastCost(), recommendRouteChange()
• Events: cost.usage.recorded, cost.threshold.warning, cost.threshold.blocked, cost.route_recommendation.created
• Controls: provider kill switch, budget thresholds, tenant quotas, safe error messages, usage anomaly detection
• Human gate: Finance/platform owner approval required before budget or provider-route changes.
• Blocked autonomy: uncapped provider calls, silent provider changes, budget bypass

Observability Platform

• Interfaces: recordTrace(), recordMetric(), recordLogEvent(), openIncident()
• Events: observability.trace.recorded, observability.metric.recorded, observability.alert.opened
• Controls: PHI redaction, trace correlation, SLOs, alert routing, retention policy
• Human gate: Incident owner review required for safety or production-impacting alerts.
• Blocked autonomy: PHI log retention, unreviewed alert suppression, blind production changes

Autonomous Remediation Agent

• Interfaces: draftRemediationPlan(), estimateBlastRadius(), requestApproval(), recordRemediationOutcome()
• Events: remediation.plan.created, remediation.approval_requested, remediation.execution_blocked, remediation.outcome.recorded
• Controls: human approval, blast-radius analysis, rollback plan, change window, no autonomous production mutation
• Human gate: Deployment owner approval required before any remediation executes.
• Blocked autonomy: self-healing production mutation, security policy changes, clinical workflow changes

Clinical QA Engine

• Interfaces: runClinicalQA(), scoreClinicalDraft(), createReviewTask(), recordReviewerDisposition()
• Events: clinical.qa.started, clinical.qa.failed, clinical.qa.passed_review_gated, clinical.qa.review_required
• Controls: citation checks, missing-data checks, bias checks, human review, clinical risk rubric
• Human gate: Human owner review is required; this capability cannot create diagnosis, treatment, prescribing, outreach, payer, EHR, or production connector authority.
• Blocked autonomy: final clinical decision, patient advice, uncited medical claims, review bypass

Continuous Outcome Learning Engine

• Interfaces: recordOutcomeSignal(), detectOutcomePattern(), proposeEvalUpdate(), requestPolicyOrPromptReview()
• Events: outcome.signal.recorded, outcome.pattern.detected, outcome.eval_update.proposed, outcome.learning_blocked
• Controls: consent/data-use approval, de-identification, bias monitoring, human review, release gates
• Human gate: Clinical governance approval required before outcome-derived changes affect workflows.
• Blocked autonomy: automatic clinical learning, PHI outcome ingestion without approval, unreviewed prompt/model promotion

Infrastructure-as-Code Engine

• Interfaces: planInfrastructure(), scanIaCPlan(), approveIaCChange(), applyIaCChange()
• Events: iac.plan.created, iac.plan.scanned, iac.approval_required, iac.apply.blocked
• Controls: state locking, secret separation, policy-as-code, approval, rollback
• Human gate: Infrastructure owner approval required before apply.
• Blocked autonomy: unapproved apply, secret hardcoding, production drift mutation

Kubernetes Deployment Engine

• Interfaces: renderManifests(), scanImage(), runCanary(), rollbackDeployment()
• Events: k8s.manifest.rendered, k8s.image.scanned, k8s.canary.started, k8s.rollback.requested
• Controls: image signing, SBOM, resource limits, network policy, admission control, rollback
• Human gate: Deployment owner approval required before cluster mutation.
• Blocked autonomy: unapproved cluster mutation, unsigned images, unbounded GPU jobs, PHI workload without approval

Zero-Trust Audit Ledger

• Interfaces: appendAuditEvent(), verifyAuditChain(), exportAuditPacket(), quarantineAuditGap()
• Events: audit.event.appended, audit.chain.verified, audit.gap.detected, audit.packet.exported
• Controls: append-only, hash chain, tenant boundary, retention, export redaction
• Human gate: Compliance/security owner review required for audit gaps or export packets.
• Blocked autonomy: audit deletion, raw PHI audit payloads, unaudited protected action

SQL/FHIR Query Validation Middleware

• Interfaces: validateSql(), validateFhirSearch(), explainQueryRisk(), denyUnsafeQuery()
• Events: query.validation.requested, query.validation.passed, query.validation.denied, query.validation.review_required
• Controls: LLM output cannot execute direct SQL or direct system-of-record queries; all access must pass through validation middleware, MCP policy, scoped identity, and audit., parameterization, read/write classification, row/tenant policy, rate limit
• Human gate: Data owner approval required before high-risk queries or any write-like operation.
• Blocked autonomy: direct SQL execution, cross-tenant query, write query, PHI extraction without approval

Deployment Approval Pipeline

• Interfaces: createReleaseCandidate(), evaluateReleaseGate(), approveDeployment(), rollbackRelease()
• Events: deployment.candidate.created, deployment.gate.failed, deployment.approved, deployment.rollback.started
• Controls: CI checks, secret scanning, SBOM, eval gates, manual approval, rollback
• Human gate: Release owner approval required before protected environment promotion.
• Blocked autonomy: unapproved production deploy, failed eval promotion, missing rollback

Secure RAG/Data Ingestion Pipeline

• Interfaces: ingestDocument(), extractStructure(), redactSensitiveData(), indexEvidenceChunk(), verifyCitation()
• Events: rag.ingestion.started, rag.structure.extracted, rag.redaction.applied, rag.indexing.blocked
• Controls: PHI detection, malware scan placeholder, prompt-injection detection, source provenance, citation verification
• Human gate: Data owner approval required before indexing customer or clinical corpora.
• Blocked autonomy: unapproved PHI indexing, structure-stripping ingestion, citationless retrieval, RAG poisoning

Human-in-the-loop Clinical Safety Sandbox

• Interfaces: createSandboxCase(), requestClinicalReview(), recordReviewerDecision(), promoteSandboxFindingToEval()
• Events: sandbox.case.created, sandbox.review.requested, sandbox.decision.recorded, sandbox.finding.promoted_to_eval
• Controls: no-PHI fixtures, reviewer identity, clinical risk label, evidence card, escalation criteria
• Human gate: Human owner review is required; this capability cannot create diagnosis, treatment, prescribing, outreach, payer, EHR, or production connector authority.
• Blocked autonomy: live patient care, diagnosis, treatment, prescribing, patient outreach

Clinical Intake Agent

• Allowed tools: synthetic-context-reader, evidence-card-builder, review-queue-writer
• Denied tools: ehr-writeback, patient-messaging, diagnosis-finalizer
• Evidence: source references, missing-data checklist, risk label, reviewer queue
• Escalation: Escalate any clinical ambiguity, PHI-like input, or protected action to clinical review.

FHIR Validation Agent

• Allowed tools: fhir-profile-validator, terminology-checker, validation-report-writer
• Denied tools: fhir-writeback, production-ehr-search, patient-merge
• Evidence: resource type, profile, terminology result, validation errors
• Escalation: Escalate profile conflicts, live connector requests, or write-like operations to interoperability owner.

Imaging Integration Agent

• Allowed tools: dicom-metadata-validator, imaging-report-parser, specialist-review-queue
• Denied tools: pacs-writeback, diagnostic-finalizer, pixel-data-ingestion
• Evidence: modality, report source, comparison status, specialist review requirement
• Escalation: Escalate all interpretation-like findings to radiology or domain specialist review.

Clinical QA Agent

• Allowed tools: clinical-robustness-scorecard, citation-checker, risk-rubric-evaluator
• Denied tools: clinical-finalizer, patient-facing-publisher, orders
• Evidence: citations, limitations, confidence, review status, clinical risk level
• Escalation: Escalate any failed or high-risk scorecard to clinical governance review.

Patient Engagement Agent

• Allowed tools: approved-education-library, plain-language-checker, review-queue-writer
• Denied tools: patient-messaging, treatment-advice, appointment-scheduler
• Evidence: general education label, source references, language level, reviewer signoff state
• Escalation: Escalate patient-specific context, outreach requests, or treatment language to qualified human review.

Configuration Drift Agent

• Allowed tools: config-snapshot-reader, drift-diff-engine, owner-router
• Denied tools: secret-reader, production-mutator, policy-editor
• Evidence: desired state hash, observed state hash, severity, owner
• Escalation: Escalate high-severity drift to platform owner and deployment pipeline.

AI Cost Intelligence Agent

• Allowed tools: usage-meter, budget-policy-evaluator, cost-dashboard-writer
• Denied tools: provider-route-mutator, budget-overrider, secret-reader
• Evidence: model route, tokens, estimated cost, tenant quota, threshold decision
• Escalation: Escalate threshold breaches to finance/platform owner.

Autonomous Remediation Agent

• Allowed tools: incident-reader, blast-radius-estimator, rollback-plan-builder
• Denied tools: production-mutator, cluster-admin, policy-editor
• Evidence: incident trace, blast radius, rollback, approval owner
• Escalation: Escalate all execution requests to deployment approval pipeline.