How to read this page
- Every step is one screen, or one moment, in a real run. The label under the title names where it happens, and the step reads in the same order each time: what is happening, the evidence, and then what to look for in it.
- Screenshots are real pictures of the Munitas console, the web app that people open in a browser. Click any picture to enlarge it.
- Every name of a person, patient or card holder in the example data is invented, and every screenshot is unedited apart from being cropped to the part that matters.
Words used on this page
- Organisation
- A company or hospital group that uses Munitas. Each organisation sees only its own data.
- Department
- A team inside an organisation that owns some of its data, such as Cardiology.
- Custodian
- A person who holds the data custodian role, which allows deciding who may read data. A custodian decides for the departments they are an approver for.
- Agent
- A program registered on Munitas, with a named owner, that Munitas runs on somebody’s behalf instead of a person reading data directly.
- Version of an agent
- One uploaded and sealed copy of an agent’s code. Uploading again makes a new version, and the older ones stay.
- Sealed
- Finished and closed for good, so that it can never be edited.
- Deploy
- To make one version of an agent the one that runs when somebody starts a run. Only one version of an agent is active at a time.
- Risk level
- One of the levels an organisation writes for how carefully it holds its agents, from the least strict to the most strict. A level says whether a change that lets an agent do more needs a second approver, how often the agent must be confirmed as still needed, and whether an agent at that level may be deployed at all. The person who registers an agent proposes a level, and the AI risk owner confirms it.
- Widening
- A change that lets an agent do more than the version before it: a new tool, a new external host, more data, or a different model. A widening has to be approved before the version can be deployed.
- Approved tools list
- A list, written by the AI risk owner, of tools the organisation has approved in advance. Each entry names one tool, says what it does, how far it is approved, the highest risk level it is approved for, the conditions, a reason and the date it must be looked at again. A new version of an agent that adds only listed tools does not wait for the people who would otherwise decide it.
- AI risk owner
- The one person who answers for how the organisation holds its AI agents. The role writes the risk levels and the approved tools list, confirms the level of each agent, and gives the second approval on a change to an agent where its level asks for one.
- Dataset
- A named collection of records, such as a table of patient admissions.
- Version
- One sealed state of a dataset. Changing the contents means making a new version, never editing an old one.
The organisation decides which tools need no request
Every time a data engineer uploads a new version of an AI agent, Munitas compares it with the version before it. If the new version lets the agent do more, for example by adding a tool, the change has to be approved before the version can be put to work. In a large organisation that means a stream of requests for tools that are routine and safe, and people who approve a stream stop reading it. So the organisation writes a list of tools it has approved in advance. A new version that adds only those tools does not wait for the people who would otherwise decide it.
Okafor is the AI risk owner of the Health organisation: the one person who answers for how the organisation holds its AI agents. A tool is something an agent may do, such as reading a dataset or adding an item to a queue. The name of a tool is declared by whoever uploads the agent, so the list records the organisation's decision about a name. It does not check what the code behind the name does. Each row says what the tool does, how far it is approved, the highest risk level it is approved up to, the conditions and the reason, and the date by which somebody must look at it again. Four tools are pre-approved, which means nobody is asked when a version adds one. Five need the approval of the department that owns the agent, and not the officer.
Only the AI risk owner can change the list, and the platform refuses everybody else. Okafor adds a tenth tool. Reading the free times in the clinic's schedule changes nothing and shows nothing about a person, so it is pre-approved up to the highest level. Okafor writes why the tool is approved, a date within a year when somebody must look at it again, and a reason for the change to the list as a whole, because every change is kept with who made it, when and why.
Saving did not change version 1. It made version 2, and the line above the table says who wrote it, when, and why. A version of an agent that was registered earlier keeps the decision it was given. The new list applies to versions that are uploaded from now on.
Every earlier version of the list stays readable by everybody who is signed in. Anybody who asks later what was approved on a given day can be answered from the list as it was then, with the name of the person who wrote it.
A version that adds a listed tool is approved in advance
The followup-appointment-planner agent belongs to the Cardiology department. It plans follow-up appointments, and the organisation holds it at the level called High, which means that a change that lets the agent do more needs the approval of the department that owns it and, as a second approver, the AI risk owner. A new version that adds only a listed tool skips both.
Devi is a data engineer in the Health organisation. A version of an agent is one uploaded copy of its code, which Munitas seals, meaning finished and closed for good, so it can never be edited. The new version keeps the two tools of the version before it and adds the one Okafor has just put on the list. Devi types the names in the box for the tools the version may call.
The page lists what each new version changes compared with the version before it. The first sentence on the line for the tool is the platform's own note: it cannot know what a tool does, because the name is declared by whoever uploads the agent, so it treats an unknown tool as one that may act outside the platform. The second sentence is the organisation's decision: the tool is on the approved tools list, approved up to High, which is the level this agent is held at, so nobody is asked.
To deploy a version is to make it the one that runs when somebody starts a run. Devi pressed Deploy on the new version straight after uploading it. The older versions each still have a Deploy button, because an earlier approved version can be put back.
A listed tool that needs the department only asks one person
Some tools are routine but not harmless: they create something that a person then acts on. The organisation approves those in advance only for the department that owns the agent to decide, and does not ask the officer each time.
The new tool prepares a letter that names a follow-up appointment, and leaves it as a draft for a member of staff to check and send. Okafor's list approves it up to High, on the condition that a member of staff reads and sends every letter and the agent never sends one.
Hartley is a data custodian for the Cardiology department, which means a person who may decide who reads its data and approve changes to agents it owns. Because the tool is on the list for the department alone, this agent's level asks for nobody else. The card names the one approval it waits for. Every decision is kept with its reason, who made it and when.
One decision was enough. The card lists the single approval, with who gave it, when and why. No decision by the AI risk owner was needed, and none is recorded.
A tool approved only up to a lower level is decided by two people
An entry on the list is approved up to a risk level. The higher a level, the more an agent can affect people, so a tool approved only up to a lower level does not cover an agent held at a higher one.
The new tool leaves a reminder, built from a fixed and neutral wording, for the clinic's own notification service to pick up. Okafor's list approves it up to Moderate, one level below High. The planning agent is held at High, so the list does not cover it.
Because the list does not cover this agent's level, the card has no line about the approved tools list, and the version waits for two people. Hartley has already approved for the department. The second approval belongs to the AI risk owner. Okafor writes a reason.
The card now carries both decisions. Each names the person, the date and time, and the reason in that person's own words.
A tool that is not on the list is decided one case at a time
Some tools are never approved in advance, because the harm if they go wrong is greater than the cost of looking. They are decided for each version by named people, who write why.
The new tool lets the agent write a text message and send it to a patient. That tool is not on Okafor's list, and the list deliberately holds only the fixed-wording version of it. The agent is held at High, so the version waits for the department and for the AI risk owner.
Hartley approved for Cardiology, saying that patients should be reminded and that whether the agent may write the text itself is for the AI risk owner. Okafor refuses, and writes why: a text can show health information on a lock screen, and the fixed-wording tool on the list is enough.
Devi sees the result on the agent's page. The Deploy button is grey and says why, in the platform's own words. The version stays sealed in the list, so there is a permanent record that it was submitted and refused. The agent keeps running as the version that was already active.
The radiology-intake-triage agent ranks incoming radiology requests for review. It belongs to the Radiology department. The new version adds a tool that pages the on-call radiologist. It keeps only that tool, so it also drops the tool the earlier version had.
Okonjo is a data custodian for the Radiology department. At the level this agent is held at, the department's approval is the only one asked. The card lists one thing that widens the agent, the tool, and others that narrow it, which need no approval. A paging tool is not on this organisation's list: a page that fires on studies that need no action can teach people to ignore pages. Okonjo writes that Radiology will decide again once the rate of false alerts has been measured. How a paging service decides whom to page, and how often, belongs to that service and is outside Munitas. The box shows the last lines of what was typed, and the whole reason is recorded and shown in the next picture.
The Refused tab lists every version that was refused, newest first. The radiology version carries Okonjo's reason in full, and the planning agent's version carries Okafor's. A refusal is as permanent as an approval: it is kept with the person, the date and the reason.
