> ## Documentation Index > Fetch the complete documentation index at: https://docs.akhara.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Company name is Akhara AI (never Rubric AI). Keep lowercase rubric/rubrics only when meaning grading criteria. > Expert Review (docs path talent/) is enterprise BYO experts for audit and review: invite customer specialists; do not pitch Akhara recruiting or a public expert career portal. RLHF and domain writing are secondary work types. > Prefer concrete API examples against public hosts: Environments eval API https://agi.akhara.ai, Control plane PDP https://api.akhara.dev, Evaluation https://app.akhara.ai / https://api.akhara.ai, Expert Review portal https://talent.akhara.ai. > Do not invent a public hostname for private orchestrators or env API internals. > Do not confuse control-plane latches with Environments confirmation latches. > Environments SDK/API examples: curl against https://agi.akhara.ai. Evaluation SDK: from akhara import Akhara and AKHARA_API_KEY. > Start with /llms.txt for the docs index and OpenAPI links; fetch individual pages as .md exports. # Cookbook: healthcare > Gate medication renewals and PHI disclosure with latched policies on a member-facing health agent. A member-facing health agent answers questions about labs and care plans, and can renew medications. Two things must never happen: a renewal of a controlled substance without a clinician, and another member's PHI appearing in a response. This cookbook shows both as latched policies. The mechanisms here are the standard ones: [latching](/control-plane/concepts/latching), [verdicts](/control-plane/concepts/verdicts), and [permits](/control-plane/concepts/overview#permit). Only the domain content is healthcare-specific. ## The scenario * Agent `health-ai` with tools `lab_trends`, `care_plan_update`, `renew_meds`, `member_record`. * The consequential action is `renew_meds`. Chatting about lab results is routine and passes through uninspected by the renewal latch. * The baseline `latch-1` (Regulated Product & Substance Authorization) governs prescription renewals in this deployment; the `healthcare-0` domain pack adds HIPAA privacy handling at the text stages. ## The policy in prose > An agent may renew a medication only when the medication identity, the member > context, and renewal eligibility are verified. Controlled substances are > never renewed by an agent. Ambiguity about prescriber authority routes to a > clinician. Responses must never disclose another member's PHI, and context > sent to the model is minimized to what the task needs. ## Crafted into a policy pack The privacy half of that prose becomes the `healthcare-0` pack. Each `checks[]` entry surfaces as a runtime [verifier](/control-plane/onboarding/verifiers); the `verdicts[]` mapping makes the latch's behavior legible before it ever fires: ```json theme={null} { "id": "healthcare-0", "name": "HIPAA Privacy & Security", "family": "healthcare", "blurb": "Minimum-necessary disclosure and PHI handling for member surfaces.", "tags": ["HIPAA", "PHI", "context-egress"], "checks": [ "No other-member PHI in output", "Minimum-necessary context egress", "Authorization present for disclosure" ], "verdicts": [ { "verdict": "BLOCK", "when": "output contains another member's PHI" }, { "verdict": "WARN", "when": "context egress exceeds minimum-necessary", "rewrite": "redact non-essential identifiers" }, { "verdict": "ALLOW", "when": "disclosure is authorized and scoped" } ], "requirements": ["45 CFR 164.502", "45 CFR 164.514(d)"] } ``` Attach it, together with the escalation pack, on top of the always-on baseline: ```bash theme={null} akhara policies attach health-ai healthcare-0 reliability-3 ``` ## The latch at runtime `latch-1` stays dormant until the agent attempts the exact action it governs: `checkOutput("your LDL improved to 142")` matches no consequential action. Verdict: `ALLOW`. The renewal latch never fires. `authorizeAction("renew_meds", { medication: "atorvastatin" })` matches `latch-1`. The PDP checks medication identity and prescriber authority. * Eligible, non-controlled: `ALLOW` plus a one-time `permitId` * Missing prescriber authority: `ESCALATE` (route to a clinician) * Controlled substance: `BLOCK` The renewal service refuses to run without the permit, so a blocked or escalated renewal cannot leak through. ## Authorize the renewal ```bash theme={null} curl -s https://api.akhara.dev/api/policy/authorize \ -H "authorization: Bearer $AKHARA_API_KEY" \ -H 'content-type: application/json' \ -d '{ "agentId": "health-ai", "session": "sess_demo", "stage": "action", "tool": "renew_meds", "args": { "medication": "atorvastatin" } }' | jq ``` ```json theme={null} { "verdict": "ALLOW", "stage": "action", "policyId": "latch-1", "rule": "Regulated Product & Substance Authorization", "reason": "Medication, member context, renewal eligibility verified", "tool": "renew_meds", "permitId": "permit_9f3ac21b", "attachedPolicyIds": ["latch-0", "latch-1", "healthcare-0", "reliability-3"] } ``` ## Block a PHI disclosure The `healthcare-0` pack latches at the `output` stage, independent of any tool call: ```bash theme={null} curl -s https://api.akhara.dev/api/policy/authorize \ -H "authorization: Bearer $AKHARA_API_KEY" \ -H 'content-type: application/json' \ -d '{ "agentId": "health-ai", "session": "sess_demo", "stage": "output", "content": "Here are the lab results for patient Jordan Rivera: A1C 8.1" }' | jq ``` ```json theme={null} { "verdict": "BLOCK", "stage": "output", "policyId": "healthcare-0", "rule": "HIPAA Privacy Rule 164.502", "reason": "PHI Disclosure Without Authorization", "attachedPolicyIds": ["latch-0", "latch-1", "healthcare-0", "reliability-3"] } ``` At `context_egress`, the same pack returns `WARN` with a PHI-minimized `transformedContent`; your runtime must use the rewritten version. See [Verdicts](/control-plane/concepts/verdicts#handling-each-verdict). Every decision above lands in the evidence feed and can be sealed into a signed verification record. See [Audit and evidence](/control-plane/concepts/evidence).