WorkAutonomous Agents · Compliance AI2026
A compliance-grade multi-agent platform whose every decision can be reconstructed — and verified by an auditor who trusts nothing but the mathematics.
Delivered by our founding team at AIM Inc., for Ontario pharmacy claims
4
Specialised agents
P-384 HSM
Signing key
Append-only
Evidence chain
None
Verifier backend
The challenge
When a regulator audits a claim months later, how do you prove it was justified at the time it was billed — with evidence an adversarial third party will accept without having to trust the system that generated it?
What we built
Four specialised agents run in sequence under orchestration — consent compliance, claims analysis, forensic review, attestation authoring — each emitting a hash-chained receipt the next agent verifies before proceeding. A redaction boundary after the first agent means the model never handles patient-identifying data downstream. The pharmacist stays the legal trust anchor: the pipeline pauses at a briefing card and nothing seals without an explicit human decision. The cryptographic path contains no LLM at all — HSM-backed ECDSA signing, trusted timestamps, an append-only SQL ledger — and an anonymous in-browser verifier lets an auditor re-check any packet against a published public key, with no backend and no login.
Key engineering
The decisions that made it work
Supervisor-orchestrated agent chain
Four agents, each specialised and verifying its predecessor's receipt before acting.
Human-in-the-loop gate
High-risk actions pause for an informed, recorded human decision — autonomy without unaccountability.
Zero-LLM crypto path
Signing, hashing, redaction and ledger writes are deterministic code, physically separated from the model.
Trustless verification
A static verifier runs the whole chain check in the auditor's browser. They trust the mathematics, not our uptime.
The results
What actually changed
- 1
Four specialised agents in production orchestration, each decision reconstructable in an audit
- 2
PHI never reaches the model past the redaction boundary — an allow-list that fails closed
- 3
Evidence verifiable by a third party with no backend, no login and no trust in the host
What it doesn't do
It deliberately does not submit claims to the regulator — it sits upstream of the pharmacist's own submission. Scope creep into submission would change the regulatory posture entirely, and knowing where a system must stop is part of building one.
Stack
- Python
- FastAPI
- LangGraph
- Azure OpenAI
- Azure SQL Ledger
- Azure Key Vault (HSM)
- ECDSA P-384
- RFC 3161
- Document Intelligence
- Next.js
Tell us the pain point. We'll tell you honestly what AI can do about it.
A founder replies within 24 hours. If the answer is 'AI is wrong for this', you'll hear that too — free either way.