Skip to content

Osti

An open-source runtime authorization, workflow-resolution, and audit layer for clinical AI agents.

Code Video Cerebral Valley

Core trick

A proxy checks each proposed agent action against patient context and policy, and resumes only the exact action a routed human approves.

Tags

healthsecurityagents

Description

An open-source runtime authorization, workflow-resolution, and audit layer for clinical AI agents. Osti sits between an AI agent and clinical systems, checks every proposed action against patient context and organizational policy, routes legitimate exceptions to the correct human, and resumes only the exact action that person approves.
dristichandra/abridgehackathon-ria-drish★ 00 forksTypeScriptApache-2.0Created Jul 18, 2026 · last push Jul 19, 2026

README excerpt

# OSTI — Operational Safety Layer for Trusted Intelligence

**A runtime safety proxy that makes clinical AI agents safe to deploy.**

Built for *The Future of Agentic AI in Healthcare* (Abridge × Anthropic × Lightspeed), July 2026.

---

## The problem

Hospitals want AI agents to handle clinical busywork, but nobody can answer the
question that actually blocks deployment: *is this agent safe to let loose on a
patient's chart?* Agents drift across steps, get tricked by hidden instructions,
and can leak PHI — and if one makes a wrong-patient error, the clinician is on the
hook. Increased oversight is the single thing physicians most want before they'll
trust these tools.

## What OSTI does

OSTI sits between an AI agent and the clinical systems it touches. Every action the
agent takes — read a chart, draft a referral, submit, send data out — passes through
OSTI first, which allows, blocks, or flags it against declarative safety policies and
writes a plain-English audit trail of every decision.

Three policies enforced at runtime:
- **Patient-identity consistency** — every action in a session must concern the same
  patient. Identity drift between steps is blocked. *(This is a clinical-correctness
  property, not just content filtering.)*
- **Action scope** — read and draft are allowed; submit and send are forbidden without
  a human. The agent proposes; a human disposes.
- **PHI egress control** — patient data cannot leave through any non-allowlisted endpoint.

## The demo

An

Team