Proxi GUIDE manual
Browse
On this page

Governance

Control principles

The authority, evidence, and control boundaries that govern every SOP.

GoverningSource: 01_Architecture_and_Control_Principles.md

Status: Governing architecture, v0.1

1. Absolute authority boundary — SETTLED#

LLM output is always input data or presentation. It is never a decision, command, recommendation, workflow transition, permission, attestation, or closure artifact.

AI may:

  • Transcribe voice and documents.
  • Extract candidate facts.
  • Convert unstructured material into proposed structured fields.
  • Summarize selected evidence.
  • Render deterministic outcomes into understandable language.
  • Ask questions selected by deterministic rules.
  • Translate and adapt approved content to the recipient.

AI may not:

  • Promote a candidate fact to authoritative state by itself.
  • Determine urgency, risk, GUIDE tier, eligibility, billability, or role assignment.
  • Select a referral, care intervention, or medication change.
  • Send PHI, schedule, prescribe, close a loop, close a case, or release instructions.
  • Determine what clinical content a patient or caregiver should receive.

2. Control-plane separation#

The system contains four planes:

  1. Evidence plane — raw inputs, source documents, candidate facts, canonical facts, timestamps, provenance, and staleness.
  2. Decision plane — versioned deterministic rules that evaluate canonical facts and produce outcomes, required actors, SLAs, and evidence requirements.
  3. Authority plane — beneficiary/caregiver choices and licensed-human decisions captured as structured inputs.
  4. Execution plane — deterministic services that transmit, schedule, update, notify, escalate, or close only when prerequisites are satisfied.

The AI conversation/rendering layer sits outside the authority chain. It may receive an approved payload and express it; it may not alter the payload's meaning or permitted action.

3. Fact-state model#

Every material fact has one of the following states:

  • OBSERVED_RAW
  • CANDIDATE_EXTRACTED
  • PENDING_VERIFICATION
  • CANONICAL_CONFIRMED
  • CONFLICTED
  • STALE
  • RETRACTED
  • SUPERSEDED

Unknown is a first-class state. Missing information must never be converted to false, normal, not applicable, or resolved without evidence.

4. Decision replayability#

Every outcome stores:

decision_id
care_space_id
canonical_input_ids
rule_id
rule_version
rule_outcome
required_authority
human_decision, if applicable
execution_status
communication_payload_id
timestamps
GUIDE_service_evidence_reference

The same canonical facts evaluated under the same rule version must produce the same rule outcome.

5. No silent mutation#

  • Care plans are compiled into immutable versions.
  • Medication states are event-sourced.
  • Referrals and coordination actions move through explicit states.
  • Human decisions create new events; they do not rewrite history.
  • Corrections supersede prior facts while preserving provenance.

6. Human pop-up contract#

Human judgment is a prepared narrow act, not the first data-gathering stage. Before a navigator, clinician, privacy/compliance owner, or other authorized reviewer enters, software/AI and lower-cost permitted staff should retrieve the available facts, preserve every source and contradiction, identify what remains missing, state the exact question, and prepare the communication or decision packet. The human then performs only the clarification, relationship work, examination, interpretation, judgment, attestation, or choice-confirmation that requires that person's authority or human presence.

This preparation rule does not let AI decide which clinical facts are true or sufficient. The clinician sees the source material and unknowns, may request more information, and personally elicits or examines anything whose collection is itself part of clinical practice. An emergency or a real-time human-service requirement is never delayed while a packet is perfected.

Every human task contains:

  • Rule ID/version and escalation reason.
  • Exact unresolved facts and conflicts.
  • Original source links.
  • Automated actions already attempted.
  • Allowed decisions for that role.
  • Prohibited actions for that role.
  • SLA and consequence of nonresponse.
  • Prepared communication, if applicable.
  • Required closure evidence.

“Review the chart” is not a valid task definition.

Human review is assigned by the authority required for the specific act, not by a blanket “human in the loop” or “compliance review” label. A clinical or medical act goes to the clinician authorized for that act. A privacy, legal, billing, program-integrity, or compliance act goes to that subject-matter owner when the governing requirement requires case-specific review. A routine act may proceed under an approved policy and complete evidence when case-specific review is not required; unusual, conflicting, restricted, or unsupported facts route to the appropriate exception owner. Compliance personnel do not bless clinical decisions, and clinicians do not substitute for privacy or legal authority.

6.1 Policy governance is not routine case work#

Privacy, disclosure, outreach, program, billing, quality, data, and compliance policies are approved before the routine case path is activated. Deterministic software applies those approved policies to complete, source-attributed facts. AI may extract, normalize, compare, summarize, and identify missing or conflicting facts; AI does not decide the permitted outcome.

The routine software result is one of the approved dispositions for that policy, such as proceed, restrict, hold for a named missing fact, use a named alternate route, or stop. Software also enforces required fields, recipient and purpose limits, permission scope and expiry, suppression and revocation, roster eligibility, coverage, route tests, deadlines, retries, evidence sufficiency, duplication controls, and approved matching constraints where the applicable policy defines them.

A missing fact is not a policy judgment. It routes to the least-cost permitted person who can obtain or clarify it: Philippine L1 for administrative evidence and Puerto Rico L2 for beneficiary/caregiver preference, permission, relationship, or required human GUIDE work. A verified situation that no approved rule covers is a policy gap. Software holds only the affected act and sends the exact uncovered fact pattern and proposed action to the named policy owner. The policy owner does not perform outreach, education, referral coordination, scheduling, relationship work, or clinical care merely because the case exposed the gap.

A policy owner enters an individual case only when a controlling requirement expressly mandates case-specific human review or when an approved policy-gap procedure authorizes a bounded case disposition. Otherwise, the owner’s work is design-time policy approval, change control, audit, and correction of the reusable rule—not repetitive approval of clean transactions.

6.2 Clinic-grade procedure language#

Proxi procedures use the compact operating style of high-quality ambulatory and health-center guidance: name the real performer, state one observable action, state the expected return, and state what proves completion. A workforce category alone is not a procedure. “Navigator,” “service owner,” “provider,” “specialist,” “supports,” “coordinates,” or “owns” is incomplete unless the same step immediately states what that person does here and what observable output the person or workflow receives.

Each reviewer-facing human step must state, in this order:

  1. When: the observable trigger, timing, and facts that must already be present.
  2. Purpose / beneficiary or caregiver value: why the contact or intervention is useful now and what useful result it is intended to produce.
  3. Who: the canonical workforce category and the exact capacity used in this step.
  4. Prepared inputs: the source-linked packet, unknowns, prior automation, and exact question delivered before human work begins.
  5. Expected work: an active verb, a specific object, and the method or authority used. A task summary may name the bounded arc, but every executable numbered line states one observable action.
  6. Boundary: what this person may not decide, infer, disclose, prescribe, or substitute for.
  7. Person-facing act: what is explained, asked, confirmed, demonstrated, or chosen with the beneficiary or caregiver.
  8. Required return: the disposition, instruction, correction, acceptance, refusal, or next action that must be sent back to the workflow.
  9. Completion evidence: the named record, source, signer or performer, date/time, communication result, and still-unresolved facts.
  10. Failure route: the retry, due time, backup performer, stop condition, and fail-safe when the required return does not arrive.

Use “before / during / after” only when that sequence helps the worker perform the procedure. Separate sourced requirements from Proxi operating choices. Keep conditional alternatives under the same canonical roster family and display only the alternative actually triggered or, in a design view, one concise conditional assignment. Do not manufacture several apparent people by expanding one uncertain role into every possible specialty or outside endpoint.

Compact sentence form:

When [trigger], to produce [beneficiary/caregiver value], the [canonical performer in exact capacity] performs [specific act] using [prepared inputs]. The performer does not [authority boundary]. The step is complete only when [required observable output], evidenced by [record]; otherwise [retry or escalation].

The detailed SOP is the executable source of truth for all ten fields. A condensed sequence diagram is a review aid: it must show at least the canonical performer, expected work, entry condition, useful purpose or result, completion evidence, and an exact link to the source procedure. A root sequence may summarize possible lanes only when it is visibly labeled as a non-executable overview; a nested procedure must show the triggered lane without implying that every possible specialty enters the case.

This is an adopted Proxi drafting standard, not a CMS requirement. Its design basis is the ambulatory process, follow-up, referral, outpatient safety, health-IT safety, and health-center operating guidance recorded as SRC-AHRQ-AMB-LAB, SRC-AHRQ-HL-UPT6, SRC-AHRQ-HL-UPT21, SRC-CDC-OUTPATIENT-CHECKLIST, SRC-ONC-SAFER-2025, and SRC-HRSA-QIQA-CH10.

7. External communication#

  • V1 outbound PHI packets are human-released.
  • Outside providers should receive communication through their existing workflow: TEFCA/FHIR, EHR inbox, Direct secure messaging, or fax fallback.
  • Routine updates send deltas, not full-chart dumps.
  • Delivery is not receipt; receipt is not agreement; agreement is not implementation; implementation is not closure.

8. GUIDE service evidence#

Silent automation does not constitute a furnished GUIDE service. Each claimed service month must link to an actual qualifying service record with:

  • Service type and date.
  • Performing actor and organization.
  • Patient/caregiver/provider interaction or completed care action.
  • Outcome, including a documented no-change result when appropriate, and any applicable plan/medication/referral delta.
  • Required transmission and receipt evidence.
  • Applicable navigator-contact status.

For a contact-based service, cadence may determine that a conversation is due, but billing and a target duration may not determine its content. Before proactive outreach, the team must be able to name the person-specific reason, service to be furnished, expected beneficiary/caregiver result, and why the person's participation is needed. The actual record must preserve what was addressed, declined, and not asked. Duration, a completed template, or silence cannot convert unasked domains into no-change outcomes or additional service credit.

One actual interaction or completed care action may support more than one GUIDE service obligation. Its paid human minutes are counted once, while its evidence may be linked to every service that its actual content separately furnished. Merely mentioning another service, opening a downstream task, or making the infrastructure available does not create that service credit. CMS does not prescribe separate minute blocks for each service, but a DCMP cannot be billed for a month in which no GUIDE care-delivery service was provided.

Beneficiary eligibility/alignment, monthly DCMP billability, and longitudinal compliance with the full GUIDE service package are separate questions. There is no public CMS quota requiring a beneficiary to receive every service domain, or any fixed number of distinct domains, each month. The public monthly claim floor is one actually furnished non-respite GUIDE care-delivery service, overlaid by the tier's contact cadence. A compliant required touchpoint may itself be the qualifying monthly service; a low-complexity dyad or RCC off-contact month may instead use an actual non-contact service while the applicable quarterly or bimonthly cadence remains current. One no-service month means no DCMP for that month, not immediate loss of alignment; eight consecutive months without either a DCMP or GUIDE Respite Services claim is a current CMS claims-based unalignment condition.

Philippine administrative pursuit may support this record but is not, by default, the qualifying GUIDE service.