WorkAutonomous Agents · Compliance AI2026

A compliance-grade multi-agent platform whose every decision can be reconstructed — and verified by an auditor who trusts nothing but the mathematics.

Delivered by our founding team at AIM Inc., for Ontario pharmacy claims

4

Specialised agents

P-384 HSM

Signing key

Append-only

Evidence chain

None

Verifier backend

The challenge

When a regulator audits a claim months later, how do you prove it was justified at the time it was billed — with evidence an adversarial third party will accept without having to trust the system that generated it?

What we built

Four specialised agents run in sequence under orchestration — consent compliance, claims analysis, forensic review, attestation authoring — each emitting a hash-chained receipt the next agent verifies before proceeding. A redaction boundary after the first agent means the model never handles patient-identifying data downstream. The pharmacist stays the legal trust anchor: the pipeline pauses at a briefing card and nothing seals without an explicit human decision. The cryptographic path contains no LLM at all — HSM-backed ECDSA signing, trusted timestamps, an append-only SQL ledger — and an anonymous in-browser verifier lets an auditor re-check any packet against a published public key, with no backend and no login.

Key engineering

The decisions that made it work

Supervisor-orchestrated agent chain

Four agents, each specialised and verifying its predecessor's receipt before acting.

Human-in-the-loop gate

High-risk actions pause for an informed, recorded human decision — autonomy without unaccountability.

Zero-LLM crypto path

Signing, hashing, redaction and ledger writes are deterministic code, physically separated from the model.

Trustless verification

A static verifier runs the whole chain check in the auditor's browser. They trust the mathematics, not our uptime.

The results

What actually changed

  • 1

    Four specialised agents in production orchestration, each decision reconstructable in an audit

  • 2

    PHI never reaches the model past the redaction boundary — an allow-list that fails closed

  • 3

    Evidence verifiable by a third party with no backend, no login and no trust in the host

What it doesn't do

It deliberately does not submit claims to the regulator — it sits upstream of the pharmacist's own submission. Scope creep into submission would change the regulatory posture entirely, and knowing where a system must stop is part of building one.

Stack

  • Python
  • FastAPI
  • LangGraph
  • Azure OpenAI
  • Azure SQL Ledger
  • Azure Key Vault (HSM)
  • ECDSA P-384
  • RFC 3161
  • Document Intelligence
  • Next.js

Tell us the pain point. We'll tell you honestly what AI can do about it.

A founder replies within 24 hours. If the answer is 'AI is wrong for this', you'll hear that too — free either way.