The tiers are analytic perspectives, not successive maturity levels (Figure 1 and Table 2). Tier 1 describes general orchestration and execution control functions. Tier 2 describes how those functions are configured through clinical knowledge, data semantics, risk requirements, and institutional clinical workflows. Tier 3 comprises evaluation and refinement practices applied to both. A component can have a tier 1 mechanism and a tier 2 configuration; for example, a generic validation hook can enforce a clinical allergy-check requirement. Provenance and reconstructibility apply across all 3 tiers.

Tier 1 comprises general mechanisms governing agent execution across domains [16,17]. We organize these into the following five components: (1) system prompts define roles, constraints, and reasoning norms; (2) tool definitions expose external capabilities through structured schemas, including FHIR queries and calculators [6] (benchmark comparisons suggest that abstracting low-level implementation details can improve performance [5]); (3) output schemas constrain responses and support downstream validation; (4) control flow sequences model interactions, tool use, and actions through single-turn execution, multistep loops, planning, or reflection [18,19]; and (5) memory architecture governs state retention and access within and across authorized tasks.

Memory requires explicit scope: within-episode memory retains current observations and pending actions; longitudinal patient memory links authorized encounters for one person; and cross-case memory spans patients or independent cases. Cross-case benchmark notebooks [7] do not establish that reusing patient-specific content across production cases is appropriate; such content requires a defined purpose and access boundary. Teams should report namespaces, read and write permissions, retention, reset conditions, and protections against retrieval from the wrong patient. Fixed-configuration evaluation should freeze the initial memory snapshot and prespecify permitted updates, including within-episode changes. Studies allowing cross-case learning during evaluation should separately report the adaptive protocol, case order, update sources, and exposure to test feedback.

Generic verification operates across tool interfaces, output schemas, and control flow through schema validation, permission checks, execution checks, and error handling. The guides-and-sensors distinction separates feedforward guidance before actions from feedback during or after execution, although components may serve both functions [11]. Tier 2 specifies clinical requirements, including patient and encounter matching, clinical prerequisites, and required clinician approval. Tier 3 evaluates the contributions, interactions, and failure modes of these mechanisms and their clinical configurations.

A harness design choice belongs to tier 2 when its specification or evaluation depends on clinical semantics, clinical consequences, or institutional clinical workflows. These functions need not be unique to medicine: membership depends on the clinical requirements governing a general mechanism, rather than clinical use alone. The 5 proposed categories are revisable, and their effects require empirical testing.

Clinical knowledge integration addresses mismatches between natural language clinical concepts, coded terminologies, and institutional data structures [5]. Candidate implementations include code-aware tool definitions, prompt-level references, and retrieval-augmented coding lookups [20-22]. Design choices should balance context length from inline references against latency from dynamic lookup. Implementations should return a selected code or an explicit unresolved status, with terminology version, source, and candidate alternatives. Evaluation should assess code and resource selection, relevant record recall, unsupported mappings, and ambiguity handling, distinguishing retrieval success from clinically valid interpretation.

Differential reasoning structure addresses premature closure in diagnostic and therapeutic reasoning. Analyses and simulation studies motivate testing structured alternatives, uncertainty labeling, and multiagent critique to counter anchoring [23-25]. Their independent contributions require controlled evaluation. Implementations can require a concise clinical output recording candidate diagnoses or interpretations, supporting or conflicting findings, uncertainty, and the next information need. This output does not require private chain-of-thought, and its fluency does not establish reasoning quality. Clinician-adjudicated evaluation should assess omitted alternatives, premature closure, unnecessary testing, and escalation appropriateness.

Missing data and temporal handling address whether information exists, when it was recorded, and whether it remains valid for the task [6]. Five states should be distinguished: not measured, supported by explicit evidence that measurement was not performed; not retrieved, when retrieval was omitted, failed, or incomplete; not documented, when no record is found within a verified documentation and search scope; not applicable, when the item is irrelevant under specified clinical or task conditions; and temporally invalid, when an available value fails the applicable temporal validity criteria. These states may overlap, and unresolved status should remain explicit. An empty query result establishes only that no matching record was returned within the queried scope. Wrappers should record query status, patient and encounter identifiers, units, measurement and retrieval timestamps, and applicable validity rules, explicitly marking unavailable fields. Prespecified rules should route unresolved missingness to clarification, further retrieval, or escalation. Evaluation should assess state classification and subsequent handling, separately reporting retrieval failures, temporally invalid data use, encounter mismatches, and unsupported inference from absent records [5,6].

Safety verification gates apply clinical criteria to actions with different consequences and constraints. Preaction checks verify patient and encounter identity, clinical prerequisites, relevant allergies or interactions, and required human approval. Intra-action checks enforce permissions and action constraints and recheck mutable state as needed. Postaction checks reconcile the intended change with execution status and authoritative electronic health record (EHR) state. A time-out does not establish failure: uncertain execution status should be recorded as unknown and authoritative state reconciled before retrying. These checks extend clinical decision support principles [26,27]. EHR-integrated evidence indicates sensitivity to prompt and input framing [28], while safety frameworks support evaluating safety separately from utility [29].

Clinical workflow alignment addresses institution-specific conventions while distinguishing configurable defaults from mandatory requirements. Morning laboratory timing may be configurable where policy permits; convenience defaults must not override required approvals or safety prohibitions. Workflow-specific wrappers should distinguish hold from discontinue and identify the intended active order to be changed [5]. Implementations may use policy-constrained defaults, disambiguating tool interfaces, and locally validated examples. Document each rule’s configurable or mandatory status, its basis in local convention, clinical policy, or applicable legal or regulatory requirements, and its responsible owner, source, version, and effective date. Evaluate order selection, handoff completion, policy adherence, and clinician correction burden. Validate defaults locally rather than presenting them as universal clinical rules.

An execution trace comprises time-ordered, observable artifacts from an agent episode: application visible model inputs and outputs, tool calls and observations, retrieval results, structured states, memory updates, action proposals, authorization and execution records, receipts, and state transitions. Private chain-of-thought is not required, and generated explanations do not establish faithful access to latent reasoning or a validated causal account. Report capture scope, omissions, and logging failures. The primary analysis unit is a task episode with a defined patient or case, starting state, goal, and stopping rule. Nested action events support localization; repeated episodes from the same patient or task template may be dependent.

Figure 2 presents the proposed workflow from baseline specification through failure localization, classification and mechanism formulation, controlled comparison, outcome and safety reassessment, and transfer testing [15]. Freeze the baseline model, harness, tools, data snapshot, and environment; separate development and test cases at the patient and task template levels where applicable. Prespecify important failures, severity categories, denominators, and acceptance criteria with clinical and operational experts. Analyze successful and failed episodes to identify the first relevant deviation and downstream consequences. Use an explicit codebook, double code a subset, report agreement, and adjudicate disagreements; automated clustering requires clinical review. Sequential redesign uses development cases. If held-out feedback informs modification, use a fresh holdout for confirmatory evaluation.

Compare baseline and modified configurations on the same held-out cases, holding other settings fixed. Repeat stochastic runs and report paired effects and uncertainty accounting for clustered episodes. Single-component ablations estimate conditional effects; suspected dependencies warrant factorial comparisons, such as timestamp availability crossed with validity gating. Report all configurations and interaction estimates with uncertainty on a prespecified outcome scale. Sensitivity analyses assess robustness to thresholds, time windows, and resource limits rather than isolate component contributions. When model adaptation also changes, cross base versus adapted models with baseline versus modified harnesses. If component comparisons are infeasible, limit attribution to the combined modification. Evidence supporting mechanism-specific improvement should include fewer targeted failures among eligible cases, the predicted trace change, and effects assessed against prespecified criteria. Report counts, denominators, unsuccessful interventions, and residual failures; aggregate success alone is insufficient.

Evaluation should distinguish task success against the task specification, clinical correctness of interpretation and actions, process safety against identity and action constraints, and operational reliability through tool failures, time-outs, duplication, latency, and recovery. Report events in each relevant domain. Correct final output does not erase wrong-patient retrieval, unauthorized actions, or other process safety failures. Assess unsafe proposals and executed actions, appropriate and inappropriate blocks, unauthorized attempts, confirmed state verification failures, and indeterminate outcomes, using counts, rates, exposure denominators, and uncertainty. Distinguish interception, execution, and observed harm, and classify near misses using prespecified criteria. Grade potential severity by plausible harm and reversibility separately from observed consequences. Report high-severity failures separately and examine relevant high-risk subgroups and edge cases. Prespecified serious events should trigger investigation and, where warranted, restriction or suspension pending review. Zero observed serious events do not establish safety. Transfer testing proceeds only when prespecified improvement and safety criteria are met.

Transfer tests should vary task structure, data environment, or institutional workflow while retaining the hypothesized failure mechanism. Candidate settings include read-only FHIR retrieval [4], conditional EHR ordering [5,6], and interactive diagnostic encounters [7]. A temporal validity intervention could transfer across laboratory-dependent medication tasks, whereas a local wrapper may require another site. Freeze each evaluated configuration, prespecify memory initialization and permitted updates, and prevent unintended cross-case contamination and test feedback leakage. Distinguish unchanged transfer from transfer requiring local reconfiguration. Compare against task-specific baselines, reporting targeted failure counts, eligible case denominators, paired effects, and uncertainty. Evidence supporting generalization should include sustained targeted failure reduction and the predicted trace change while meeting prespecified benefit and safety criteria. Without transfer testing, restrict claims to the evaluated setting.

Consider a hypothetical clinician request to review a low potassium alert and prepare any indicated replacement order under the hospital’s protocol for approval. Tier 1 provides general retrieval and draft action interfaces, structured outputs, episode memory, and a controller that blocks execution pending approval. The EHR and authorization service remain external dependencies.

Tier 2 configures patient-scoped retrieval and draft orders, maps laboratory tests to local codes, and retrieves results, units, time stamps, renal function data, relevant medications, and existing replacement orders. Differential support considers current abnormality, historical results, and conflicting evidence. Missing data or uncertain timing triggers review. Safety gates enforce protocol constraints and block unsupported or duplicate orders. Before executing an approved action, checks reconfirm patient and encounter identity and current orders; postaction checks verify the intended EHR change. Local defaults cannot override mandatory requirements.

If a clinician intercepts a stale result proposal before execution, tier 3 records a temporal validity failure and an intercepted potentially unsafe proposal, even if the final recommendation is appropriate. An omitted measurement time stamp is a hypothesized mechanism. A proposed factorial comparison would cross time stamp availability with validity gating on held-out cases, holding the model and remaining configuration fixed. Evaluation would assess targeted failures, missed alerts, and unnecessary escalations; transfer testing would use another laboratory-dependent medication task. This is an illustrative design and evaluation proposal, not treatment guidance or empirical validation.

Provenance should support retrospective reconstruction of agent-mediated decisions [30]. For clinical agents, we propose the following recording requirements. Link each episode to the model provider, version, and decoding settings; harness commit and configuration; available and invoked tools, versions, and schemas; retrieved clinical content or accessible versioned references; measurement and retrieval times; missingness states; and memory snapshots or versioned updates. Record clinical validity criteria and whether retrieved data satisfied them at the decision time, together with safety gate identifiers, rule versions, and pass, fail, not evaluated, or unknown outcomes. Distinguish recommended, authorized, attempted, executed, failed, and execution unknown actions, retaining the authorizer, authorization time, action correlation identifiers, and relevant preaction and postaction state. Reconcile authoritative state after an uncertain write before retrying [31]. Hashes can help verify retained content’s integrity but cannot recover missing content; references support reconstruction only while the specified versions remain accessible. Document reconstruction gaps. Reconstructing the observed sequence and available evidence does not guarantee exact replay, particularly with stochastic models or changing external services.

We propose layered retention: compact event records for consequential episodes, with richer, time-limited diagnostic capture for approved investigations or sampled evaluation. Store necessary patient data or versioned references within controlled institutional systems, planning for episode volume, payload size, retention duration, and source version availability. Apply least privilege access, encryption, access auditing, purpose restrictions, and retention and deletion schedules; assess vendor access and data residency before transmitting traces. The United States Health Insurance Portability and Accountability Act security rule addresses access, audit, integrity, and transmission safeguards [32], while the European Union’s General Data Protection Regulation emphasizes purpose limitation, data minimization, and storage limitation [33]. Applicable duties and retention periods require local determination; this design is not a compliance guarantee.

Deidentification and pseudonymization may leave reidentification risks in clinical narratives. Prefer local analysis of protected traces and share reviewed taxonomies, aggregate counts, or synthetic examples when raw sharing is unjustified. Sampling and incomplete capture may miss rare unsafe trajectories; report capture coverage, dropped events, and logging failures alongside performance. Where required provenance is unavailable, document the gap and limit the affected action scope; absent logs do not establish safe execution.

Harness durability is a hypothesis about continuing needs for governed behavior, not a settled prediction about implementation. Medical training environments illustrate that model adaptation can improve task capability [34]. Parameter-efficient methods such as low-rank adaptation train additional parameters while keeping base-model weights fixed [35] and therefore belong to model adaptation under our boundary rule. Instruction tuning likewise constitutes model adaptation, whereas retrieval orchestration and execution time control belong to the harness; underlying services and institutional policies should be reported separately. Reduced training cost alone does not establish clinical safety or resolve data governance requirements.

Hybrid systems should separately version the base model, adapter, training data specification, retrieval configuration, and controller. For example, a local adapter may learn order terminology while the harness applies current policy and obtains approval. If training absorbs a prompt rule, document the function’s relocation and reassess the system without double counting the change as an independent harness effect. A factorial comparison crossing base versus adapted models with baseline versus modified harnesses can assess complementarity and safety regressions. Externally hosted APIs are one deployment option, not a universal constraint on health systems. Future domain-specific models, tool learning, policy engines, and dynamically generated workflows may shift these boundaries. Regardless of how functions are distributed across learned models and execution time components, clinical systems require accountable, auditable governance.

Teams should specify tier 1 interfaces, identify tier 2 clinical requirements, and establish a tier 3 evaluation and incident response plan. Report harness components as explicitly as model identity, bound component attribution and generalization by the available comparisons, and provide versioned artifacts where disclosure is permitted. Table 3 proposes a minimum reporting set, not a validated reporting standard. These proposals complement clinical AI governance and life cycle guidance [14,36].