Self-initiated concept · Healthcare AI · Two weeks
Agent Control Plane
How a hospital supervises 41 AI agents without watching all of them.
A concept for bringing AI agents on the way a hospital brings on a clinician: a written job, named people accountable, and privileges earned on evidence.
The prototype is best on a desktop browser. Source on GitHubAttune, Lakeshore Health and everyone in it are fictional, and all data is mock.
- Role
- Solo: research, product, design system, brand and front-end build
- Timeline
- Two weeks
- Scope
- 7 roles · 15 epics · 55 frames
- Shipped
- A working prototype · about 1,700 automated tests
(opens full size)Approving every action doesn’t keep patients safe
Hospitals are starting to use AI agents that don’t just suggest things; they do them. The usual safety net is a person approving every action. That doesn’t hold up: in one recent study, people caught only about one in five bad agent actions, and with dozens of agents, approving everything turns into rubber-stamping.
Hospitals already know how to trust someone new. It’s how they bring on a clinician: a defined scope, supervision, and privileges earned on evidence that can be taken away. So I built the whole product around that idea.
“Plan-level oversight lowers the odds of a problematic action by 76%; runtime interception catches about 1 in 5 bad actions.”
Research notes · Chen et al. 2026 (preprint)
“Clinicians show strong automation bias; explanations raise acceptance whether the AI is right or wrong.”
Research notes · Jabbour et al., JAMA 2023; Bansal et al., CHI 2021
“…start in a shadow-like mode, then ‘earn’ autonomy.”
Research notes · UCHealth
Seven people, seven jobs, one agent
Seven people use it, each with a different job. Marcus owns the agents and supervises them day to day, and Priya signs for what each one is allowed to do. Dana runs the AI program, Sam enforces the technical limits and Dr. Lee chairs the review board. Pharmacists like Ana never open the console; they work with the agent from inside the medical record. Jordan, in risk, can rebuild anything an agent did.
The permissions are real in the prototype: switch to Jordan and every control that changes something is locked, with the reason.
Agent owner
Marcus
Owns 20 medication agents and supervises them by exception.
Clinical sponsor
Priya
Signs each privilege on the evidence and co-signs every resume.
AI program lead
Dana
Starts every agent from an approved intake and keeps the survey evidence complete.
Technical owner
Sam
Turns what an agent must never do into hard stops at the gateway.
AI review board chair
Dr. Lee
Decides from a packet that shows the whole job, the tested limits and the conditions.
Pharmacist
Ana
Reviews agent drafts in the medical record and flags a problem in one action.
Never opens the console
Risk manager
Jordan
Reconstructs any action, read only: what the agent saw, which policies decided and who signed.
Who hands off to whom
- Dana to Marcus: Starting onboarding asks Marcus for the job
- Marcus to Sam: The never list becomes hard stops
- Sam to Priya: The final set comes to Priya for review
- Dana to Dr. Lee: The committee packet
- Ana to Marcus: A flag from the medical record
- Marcus to Priya: A resume needs both
The life of one agent, from approval to step-down
This is Med Rec Agent, which drafts each patient’s home medication list, at a mock hospital with forty-one agents across five divisions. Every screen below is the working prototype, captured as each person sees it.
Approved
The hospital’s AI committee approves the request, and Dana starts onboarding from that approval. No agent goes live without four named people who answer for it.
(opens full size)Onboarding from the approved request, as Dana Onboarding Med Rec Agent, as Dana: the details carried over from the approved request, and the four named people who answer for it
Limits
Marcus writes down what it must never do, starting with never changing a dose. Sam turns each line into a hard stop outside the AI, tested against the last 30 days: it would have blocked 7 of 1,204.
(opens full size)Tools and hard stops, as Sam Tools and hard stops, as Sam: the never list turned into hard stops, each tested against the last 30 days
Earned
For three weeks it works in shadow, doing the job without anything reaching a patient. It meets two targets and just misses the third, so Priya can still move it up, but only with a written reason.
(opens full size)The shadow scorecard, as Priya The shadow scorecard, as Priya: three weeks of evidence against the three targets
Supervised where they work
Pharmacists review the agent’s drafts right in the medical record. When something looks off, Ana flags it in one action, and the flag reaches Marcus.
(opens full size)In the medical record, as Ana The medical record, as Ana: the agent’s draft in a side panel, with a flag one action away
Stop easy, resume deliberate
Marcus pauses it in one action, and the screen first shows exactly what happens: drafts go back to pharmacists and nothing is lost. By noon there’s a fix, but it stays paused until Priya agrees too.
(opens full size)Pausing, with the impact first, as Marcus Pausing Med Rec Agent, as Marcus: what pausing does, shown before it is confirmed
Trust drops by rule
When pharmacists kept editing more than 15% of its drafts for three days, the agent dropped back to shadow by rule. Nothing climbs back up without someone signing for it.
(opens full size)The automatic step-down, as Priya Med Rec Agent, as Priya: the notice that admission med rec stepped down to Shadow by rule
(opens full size)
(opens full size)
(opens full size)
(opens full size)
(opens full size)
(opens full size)Three decisions shaped all of it
Each one gave something up on purpose. Here is what I weighed, what I chose and what it cost.
Decision 1 of 3
How an agent earns trust
Trade-off: More work up front, a lot less checking after
(opens full size)Signing a privilege, as Priya Decision 2 of 3
How to protect people’s attention
Trade-off: Less colour at a glance, so the colour that does appear is believed
Compare the five directions
(opens full size)Countersign, the design system this decision produced: colour only where a person is needed Decision 3 of 3
How to stop and restart
Trade-off: Slower recovery, on purpose
(opens full size)Resuming Med Rec Agent, as Priya
Quiet by default: colour only where a person is needed
I explored five visual directions from one brief: live agent operations, dense and important, never overwhelming. The first followed my brief exactly, and it broke. On a crowded screen, the row you’d selected looked like one more problem.
So I judged every direction on the same real, crowded screens. The winner, Countersign, keeps everything healthy grey and spends colour, a shape and a word only where a person is needed. It grew into a system of 26 primitives and 10 product components, in light and dark.
Five directions from one brief
(opens full size)Ledger · precise
The brief as written: cool slate, and one indigo for selection, action and review
(opens full size)Ward Round · fast to read
Legibility first: larger type, every figure in mono, warm stone neutrals
(opens full size)Countersign · accountableChosen
Accountability first: hairlines, review in its own teal, the signer on every row
(opens full size)Linen · calm
Calm and tonal: no lines, and only the selection lifts off the page
(opens full size)Handover · calm + accountable
A remix: Linen’s surfaces, Ward Round’s selection, Countersign’s accountability
Judged on the same real, crowded screens
(opens full size)Ledger 
(opens full size)Ward Round 
(opens full size)Countersign 
(opens full size)Linen 
(opens full size)Handover
Stress test: 20 agents at 1440 × 900, the same data and selected row in every direction
Same crowded screen
Ledger
(opens full size)Countersign
(opens full size)Colour means something
- IndigoThe primary action, and “current” or “selected”
- TealA review is waiting for a person
- AmberWarning: needs attention soon
- RedCritical: needs a person now
- GreyEverything healthy
Every status pairs colour, a shape and a word, so it reads in greyscale. Dashed means no data, never healthy.
How it stays whole
- The system is the easy path: every value a screen needs is a token, and every repeated piece is a component with a name people and AI can find.
- The rules are written where people and AI read them: in the instructions every Claude Code session loads, and synced to a Claude Design project.
- Machines check what reviews miss: a debt audit that fails the build if a count rises, layer rules in the linter, and 100 screens compared pixel for pixel.
- One owner, open contribution: the designer owns what components mean and how they’re named, and anyone can add one by following the contribution guide.
(opens full size)Attune, a mark that moves
Attune is the fictional company behind the product. Its mark is four pebbles that move like partners: they dance once when you arrive, then settle into the still mark. The motion kit has six motions, each for a moment in the work, from a quiet pulse while evidence refreshes to a wave that passes context on.
I made the mark and its motion with AI tools, then ported only what the product uses into code, so the still mark matches the kit to the digit.
First helloArriving in the workspace
Six motions, one for each moment in the work
The product’s own wordmark stays AIMS, as designed.
Prototyped in code, built like a product
I spent most of my time on research and defining the problem before designing a single screen. That shaped the vision, requirements and roadmap, then 21 epics with their user stories, and only then the screens.
I built it in code with Claude Code, phase by phase, as a real product: a typed mock hospital where every action checks permissions and writes the audit log, and a guided tour whose narration is data that drives the real screens. The design system is synced to Claude Design, so its rules travel with it. AI sped up every step, but I made the calls and signed off on each one, the same rule the product enforces.
How I got here
- ResearchAgent oversight, automation bias, alarm fatigue
- VisionBring on an agent the way a hospital brings on a clinician
- PRDRequirements and the permission matrix
- RoadmapSafe at Draft, earned autonomy, then scale
- Epics and stories21 epics; E1 to E15 designed and built
- Design system briefQuiet by default; colour only where a human is needed
- Explorations5 design system directions, 4 board layouts
- 55 framesHigh-fidelity screens at 1440 px
- 14 build phasesEach phase from Phase 1 on was a reviewed pull request
How it’s checked
- Unit tests
- 1,395
- End-to-end tests
- 320
- Accessibility
- A WCAG 2.1 AA check on every screen
- Visual check
- 100 screens compared pixel for pixel
What I’d test with real staff
I haven’t tested it with hospital staff, so I checked what I could. Every screen traces back to a user story, building it exposed contradictions in my own designs, which I fixed and logged, and every screen passes an accessibility check.
On a real team, this is who I’d put it in front of before anything gets built, what I’d ask them, and what I’d measure.
Want a sprint like this for your product?
Book a free callHiring for product design?