Keystone Applied Intelligence Applied AI engineering

Provana AcuteCare: Clinical Copilot with Guardrails

Boston AI Tinkerers Generative UI Hackathon | May 9, 2026

Prototype disclaimer. This is a hackathon prototype, built in a weekend on GPT-4o and CopilotKit, not a retained Keystone evaluation artifact. Governance terms used below ("hash-chained", "tamper-evident", "append-only") describe the prototype's implemented and design behavior; they should not be read as a retained Keystone evaluation result.

What we built

A clinical AI copilot that detects acute care scenarios from natural language input, generates the appropriate workflow interface at runtime, and enforces clinical scope of practice through a governance layer.

Three protocols implemented: sepsis, stroke, and pediatric fever. Each protocol renders a dynamic card with patient-specific context (vitals, allergies, checklist items, medication orders). The system mutates protocols when patient data requires it. A documented penicillin allergy causes the sepsis card to cross out Pip-Tazo and substitute Meropenem, with cross-reactivity reasoning visible.

Built in six hours at the Boston AI Tinkerers Generative UI Hackathon with Sai Gopal Jarabana. I contributed the governance layer. Sai built the dynamic clinical UI generation and protocol engine.

My contribution: the governance layer

Role-based access control

Three clinical roles enforce scope of practice: Nurse, Doctor, and Attending. Every action attempt is checked against the role at the moment of execution, not at login. A nurse cannot order antibiotics (requires Doctor). Only an Attending can authorize tPA or activate massive transfusion protocol.

Four governance outcomes

  • SERVE. Protocol renders with all checks passed. Clinician is authorized for the requested action.
  • BLOCK. Clinician attempts an action outside their scope. Denied inline with reason shown. Logged.
  • ROUTE. Clinician escalates an action to a higher role via the approval pathway. Audit shows ROUTED outcome.
  • MUTATE. Patient context (allergies, contraindications) modifies protocol recommendations automatically. Penicillin allergy swaps Pip-Tazo for Meropenem with cross-reactivity reasoning visible.

Audit trail

Every governance decision is logged with role, action, timestamp, and reason. Append-only, tamper-resistant design pattern. Visible in the demo UI on demand.

Integration

Bootstrapped from my governed-incident-agent scaffold. Adapted the RBAC model from OHS workplace safety roles (operator, supervisor, admin) to clinical roles (nurse, doctor, attending). Wired the protocol card components to the governance action pipeline through a ProtocolRenderer bridge that passes governance hooks to each card type.

Portability observation from one prototype

The prototype reused the same role and action control structure, roles, permissions, evidence thresholds, and outcomes, across two domains (workplace safety and acute-care medicine) without structural changes during this implementation. The controller does not need to know whether it is governing a confined space rescue procedure or a sepsis antibiotic order; the domain lives in the data and the UI. This is an engineering observation from one prototype, not evidence of general domain portability.

It is consistent with Keystone's broader working hypothesis that a governance control loop can be structured independently of domain, though that hypothesis needs testing across more than one prototype.

Tech stack

  • CopilotKit 1.56.5 (react-core, react-ui, runtime)
  • Next.js 16
  • TypeScript
  • Zustand (governance event store)
  • OpenAI GPT-4o (via CopilotKit runtime adapter)
  • Tailwind CSS

Repos