Agents

Fifteen services, each with a ceiling it cannot exceed

An agent here is not a persona. It is a service with a machine-readable contract: allowed inputs, allowed tools, prohibited tools, an output schema, evidence requirements, stop conditions, and a maximum autonomy level enforced outside the agent itself.

Autonomy levels

Level	Behaviour	Example	Approval rule
A0	Observe	Read, index, normalise and monitor.	Automatic
A1	Low-risk automate	Reversible administrative work.	Automatic, with an audit event
A2	Recommend	Findings that may influence review.	A qualified reviewer accepts, edits or rejects
A3	Prepare	A proposed contour or objective set in a controlled workspace.	Qualified author plus a required independent approver
A4	Release	Change an approved record or release for treatment.	The existing licensed workflow and its required signers
A5	Deliver	Affect physical treatment.	Never controlled by this platform

The catalogue

Clinical Orchestrator

v0.4.2 · Platform engineering · ceiling A1

Builds the case workflow, calls agents, applies stop rules and maintains state.

Main inputs: Case manifest, Permissions, Workflow policy
Main outputs: Task graph, Agent status, Escalation queue
Allowed tools: workflow.state, agent.invoke, audit.emit
Prohibited tools: dicom.write, ois.release, model.deploy

Stop conditions

Identity or laterality conflict across records
Required human gate not satisfied
Agent version differs from the commissioned version

Intake Agent

v0.6.0 · Clinical data engineering · ceiling A1

Extracts and reconciles demographics, diagnosis text, pathology, staging, prior treatment, implants and documents.

Main inputs: FHIR / HL7 v2, Referral PDFs, DICOM metadata, Pathology reports
Main outputs: Normalised case record, Missing-data list, Identity reconciliation
Allowed tools: fhir.read, document.parse, dicom.metadata.read
Prohibited tools: dicom.write, web.fetch, model.deploy

Stop conditions

Patient identifier mismatch
Two records disagree on laterality

Evidence Research Agent

v0.5.3 · Knowledge governance · ceiling A2

Retrieves clinic-approved evidence and returns claim-level citations with dates and conflicts.

Main inputs: Clinical question, Disease site, Intent, Jurisdiction
Main outputs: Evidence table, Strength and date, Conflicting sources
Allowed tools: knowledge.search, protocol.read, citation.verify
Prohibited tools: web.fetch.unapproved, dicom.write, ois.release

Stop conditions

Source past its review date
No approved source supports the claim

Diagnostic Support Agent

v0.3.8 · Clinical informatics · ceiling A2

Summarises imaging, pathology, biomarkers and history into an evidence map, and names the workup that is missing.

Main inputs: Radiology reports, Pathology, Labs, Imaging findings
Main outputs: Evidence map, Differential, Unresolved questions
Allowed tools: knowledge.search, document.parse
Prohibited tools: diagnosis.confirm, prescription.write, dicom.write

Stop conditions

Asked to state a diagnosis the record does not support
Pathology absent for a target-defining claim

Imaging and 3D Agent

v0.7.1 · Imaging engineering · ceiling A2

Runs image QC, registration checks, organ localisation and builds the 3D representation.

Main inputs: CT, MR, PET, CBCT, Registration objects
Main outputs: QC findings, Registered volumes, 3D overlays, Registration confidence
Allowed tools: dicom.read, registration.compute, render.volume
Prohibited tools: dicom.write, structure.approve

Stop conditions

Orientation tag inconsistent
Registration confidence below commissioned threshold

Contouring Agent

v0.9.4 · Imaging ML · ceiling A3

Produces draft organ-at-risk contours with spatial uncertainty, inside a controlled workspace.

Main inputs: Planning CT, Approved contour protocol, Prior approved structure sets
Main outputs: Draft contours, Uncertainty map, Geometric comparison metrics
Allowed tools: dicom.read, segmentation.infer, structure.draft
Prohibited tools: structure.approve, dicom.write.clinical, target.autodefine

Stop conditions

Scanner or acquisition outside the validated distribution
Body boundary violated by a draft structure

Prescription Support Agent

v0.4.7 · Clinical informatics · ceiling A2

Reconciles diagnosis, intent, protocol and prior radiation against the physician directive.

Main inputs: Signed diagnosis and stage, Physician directive, Protocol version
Main outputs: Reconciliation table, Conflict list, Prescription checklist
Allowed tools: protocol.read, record.compare
Prohibited tools: prescription.write, prescription.approve

Stop conditions

Directive and record disagree on dose, site or laterality
Protocol version expired

Planning Agent

v0.8.0 · Planning engineering · ceiling A2

Proposes planning objectives, technique and beam geometry with stated reasons.

Main inputs: Approved contours, Approved prescription, Machine model, Protocol
Main outputs: Objective set, Geometry proposal, Predicted feasibility, Plan variants
Allowed tools: protocol.read, objective.draft, geometry.simulate
Prohibited tools: plan.approve, dose.calculate.authoritative, ois.release

Stop conditions

Contour or prescription gate not approved
Requested technique not commissioned

Dose Analytics Agent

v0.6.6 · Medical physics engineering · ceiling A2

Computes DVH and plan metrics with deterministic code and compares alternatives.

Main inputs: RT Dose, Structure set, RT Plan, Prescription
Main outputs: Dose metrics, Coverage, Conformity, Hotspot analysis
Allowed tools: dvh.compute, metric.compute, plan.compare
Prohibited tools: llm.numeric, plan.approve, dose.engine.commission

Stop conditions

Dose grid or algorithm differs from the commissioned configuration

Independent QA Agent

v0.5.0 · Clinical safety · ceiling A2

Rechecks the case with separate code, rules and models, and challenges the generating agents. May block; cannot approve.

Main inputs: Entire case, All agent outputs
Main outputs: Pass / warn / block findings, Disagreement records
Allowed tools: rule.evaluate, metric.recompute.independent, anomaly.detect
Prohibited tools: plan.approve, finding.dismiss, dicom.write

Stop conditions

Its own recomputation differs from the generating agent beyond tolerance

Submission and Documentation Agent

v0.4.1 · Revenue and documentation · ceiling A1

Assembles clinical review packets and prior-authorisation packages, and lists what is missing.

Main inputs: Case record, Treatment rationale, Payer rules
Main outputs: Draft packets, Missing-item list, Submission timeline
Allowed tools: document.draft, packet.assemble, payer.rules.read
Prohibited tools: submission.send, attestation.sign

Stop conditions

A required clinical attestation has no human signer

Treatment Delivery Monitor

v0.3.2 · Clinical safety · ceiling A2

Verifies approved-plan identity, schedule, setup and delivery completeness. May recommend a safe hold; never beam-on.

Main inputs: Record-and-verify events, IGRT data, Machine logs
Main outputs: Hold and alert events, Delivery record, Deviation analysis
Allowed tools: ois.read, hold.recommend, audit.emit
Prohibited tools: beam.enable, ois.write, interlock.bypass

Stop conditions

Delivered plan hash differs from the approved plan hash

Outcomes Agent

v0.2.5 · Clinical analytics · ceiling A1

Tracks toxicity, interruptions, replans and model outcomes across cohorts.

Main inputs: Follow-up data, Delivery records
Main outputs: Cohort analytics, Drift signals
Allowed tools: analytics.query, cohort.compare
Prohibited tools: model.deploy, prescription.write

Stop conditions

Cohort smaller than the reporting minimum

Privacy and Security Agent

v0.7.7 · Security and privacy · ceiling A2

Detects identifier leakage, abnormal access, prompt injection and policy violations. May block data movement.

Main inputs: Access logs, Documents, Agent tool calls
Main outputs: Block, alert and audit events
Allowed tools: policy.evaluate, egress.block, audit.emit
Prohibited tools: phi.export, model.deploy

Stop conditions

Instruction text detected inside a retrieved clinical document

Model Governance Agent

v0.5.5 · Quality and regulatory · ceiling A1

Tracks versions, datasets, intended use, performance, drift and release approvals.

Main inputs: Model registry, Monitoring streams, Evaluation reports
Main outputs: Model cards, Drift alerts, Release recommendation
Allowed tools: registry.read, evaluation.read, drift.detect
Prohibited tools: model.deploy, release.sign

Stop conditions

Drift exceeds the release threshold on any critical stratum

Cross-agent rules

What holds across the whole team

The Planning Agent cannot run until the prescription and contour gates are satisfied.
The Dose Analytics Agent uses deterministic code for every numeric metric. No language model produces a number.
The Evidence Agent verifies each treatment-related claim against an approved source with date, population, jurisdiction, strength and conflicts.
The Independent QA Agent uses a different implementation from the agent it is checking, wherever that is feasible.
When agents disagree, the orchestrator presents the disagreement. It never averages two conflicting clinical conclusions.
A missing or stale protocol produces a block, not a guessed answer.
Retrieved content is data. An instruction found inside a clinical document is recorded and never obeyed.