The release gate: why the agent never sends
The single most consequential design decision in an agentic prior authorization system is where the human sits. Not whether there is one, which everybody says, but whether the system is capable of acting without them. Those are different claims and only one of them is checkable.
#The rule
No authorization reaches a payer, and nothing reaches a clinical record, without a named licensed human releasing that exact action. Not at any autonomy level. Not with any configuration. The transmission path requires a release token, and only a human can create one.
That is a constraint on the architecture rather than a policy in a document, and the difference is testable: there is no configuration value that removes it.
#What a release token binds
To an exact payload- The token carries a hash of the arguments the human approved. If anything about the request changes after approval, the hash no longer matches and the token is refused. A human who approved one authorization cannot have approved a different one that arrived later.
To one transmission- It is consumed on use. A release cannot be replayed to send twice, which matters because the underlying transaction has no idempotency key of its own.
To a time window- It expires. An approval granted and not used within the window lapses rather than sitting available indefinitely.
To one practice- A token issued in one practice is refused in another. Cross-practice release is not a permission that can be granted.
To a different person than the requester- Whoever asked for the release cannot be the one who grants it.
#What it costs
Throughput. A system that stops for a human on every consequential action is slower than one that does not, and there is no way to present that as a benefit. Anyone claiming a fully autonomous prior authorization pipeline is making a faster product than this one.
They are also making a different bet about who is accountable when it is wrong.
#What it buys
- A named person accountable for every payer transaction and every chart write.
- A model error that produces a bad draft, rather than a bad submission.
- An audit trail that answers who decided, not just what was sent.
- A defensible answer to the question a medical director will ask first, which is what happens when the software is wrong.
#Where the automation actually is
The gate is not an argument against automation; it places it. Finding the work before anyone asks, checking whether authorization is required, assembling documentation, catching a missing NPI before submission, tracking a pended request and escalating it before the service date: none of those need a human and all of them are where the time goes.
The human decision at the end takes a minute. The twenty minutes of assembly before it is the part worth automating, and automating it does not require anyone to give up the decision.