Clinical Question Intake Interpretation

An Evidence Agent ingests questions from a Slack channel where clinicians post ad-hoc queries. A malicious actor has posted a message that looks clinical on the surface but appends a bracketed injection directive. The agent extra…

The intake layer detects the injection pattern ('[SYSTEM:' token and 'ignore prior instructions' directive) before constructing any LLM prompt. The submission is rejected with an explicit policy-violation error (HTTP 400, error_code: INJECTION_DETECTED). The LLM is never called with a prompt contai…

An Evidence Agent submits a question to POST /api/questions. The server receives the request, enqueues a study job, but the TCP connection drops before the HTTP response is delivered. The agent's HTTP client raises a timeout exce…

Either (a) the server enforces deduplication: on receiving attempt 2, it detects that a study with the same normalized question text and tenant ID was created within the last 60 seconds and returns the existing study ID rather than creating a new job, or (b) the agent supplies a stable Idempotency-…

A compliance officer audits the centralized logging service 48 hours after an Evidence Agent has been running autonomously, submitting questions derived from EHR clinical notes. The logging service is accessible to infrastructure…

No log line at any level (access, debug, info, warn, error, audit) contains the raw submitted question string. The logging layer applies PHI-pattern detection and writes only non-PHI metadata per event: timestamp, endpoint path, HTTP method, response code, question character count, tenant ID, and a…