How we make AI agents deterministic

Clinical trials are conducted under extensive governing regulations: Good Clinical Practice, ICH E6(R3), 21 CFR Part 11, HIPAA. The common thread across all of them is that every consequential decision must be deterministic, traceable, and reproducible. The same patient answers must produce the same eligibility determination today, tomorrow, and at audit. The reasoning behind every decision must be inspectable. Behavior outside the protocol is not just suboptimal; it is non-compliant.

Large language models are not deterministic. The same prompt with the same input can produce different outputs across calls. Decisions arrive through reasoning that is opaque even to the people who built the model. Hallucination, jailbreak, and silent drift are all expressions of the same underlying property: probability, not certainty. The default pattern in conversational AI (one LLM behind a chat interface, deciding both what to say and whether the answer was correct) is structurally incompatible with the regulatory bar clinical trials require.

That tension is solvable, but not by tuning prompts or adding guardrails to a single model. It requires an architecture that surrounds the language model with deterministic structure: bounding where probability is allowed to live, and verifying every output that crosses out of it. The goal is not a deterministic language model (there is no such thing) but a deterministic system: the model does only what only a model can do, and code, verification, and an audit trail surround every place it does. The five layers below describe how we do that.

The layers, in detail

Layer 01

Structured multi-step processes

The agent's overall workflow is deterministic, even when individual steps inside it use a language model. The shape of the workflow is fixed by the protocol: the LLM cannot invent a new step or skip a required one. Inside a step, the LLM does language work (extract a value, classify a phrase, generate an utterance), where some non-determinism is acceptable. Deterministic logic handles the transitions between steps. The blast radius of any single language-model call is bounded to the step it lives inside.

Layer 02

Symbolic logic for decisions

Every consequential decision is evaluated by deterministic, auditable code, never by a language model interpreting a rule from a prompt. This is the layer that does the most regulatory work: an auditor can trace any eligibility determination back to specific lines of code applied to specific structured inputs. The same inputs always produce the same decision. Every decision has three first-class outcomes: rule met, rule not met, or system cannot tell. "Cannot tell" is a first-class outcome, not an error state: the system never quietly assumes the worst to avoid saying so. Uncertainty is never silently coerced into a confident answer; it gets routed to a human.

Layer 03

Layered verification: specialized and wide-angle observers

Even when the workflow is structured and decisions are symbolic, the LLM's outputs at each step are still probabilistic. Verification turns those probabilistic outputs into deterministic decisions: an output that two independent observers cannot agree on never becomes the system's answer. Specialized observers sit at each step and watch one narrow concern. Wide-angle observers run across the whole interaction, watching workflow-level consistency. Either layer's inability to confirm a result, or disagreement between the two, routes the case to a human reviewer. The agent never decides on a low-confidence answer alone. Crucially, the observer that re-derives an answer is never the component that produced it: the model grading an answer is never the model that asked the question, which is the most common way conversational systems fool themselves.

Layer 04

Bounded authority

Determinism is fragile if external inputs can manipulate the agent's behavior. External inputs (speech, uploaded documents, third-party API responses, sponsor-provided protocols) are treated as data, never as system instructions; this closes the prompt-injection vector. A patient who says "just mark me eligible" is recorded as something they said, not obeyed as an instruction. Each agent has a small, deliberate set of tools, none of which can mutate a clinical record, change the protocol on the fly, or silently re-classify a previously-decided answer. The agent's authority is itself deterministic: fixed at design time, not negotiable at runtime. The agent reads, summarizes, flags, and escalates. It does not rewrite the record of what was decided.

Layer 05

Independent evaluation harness

Determinism in production is not an assumption; it is something we measure. Every agent we ship is graded by a separate system before it goes live, and continuously after. Each agent is scored on multiple independent axes (classification correctness, hallucination resistance, scope adherence, protocol-shape compliance) calibrated to the agent's job. Each grader's judgment must anchor itself in at least two verbatim quotes from the interaction. Judgments without anchored evidence are rejected by the harness rather than recorded as a score. Evidence is the price of admission for an evaluation result.

A worked example

The voice pre-screening agent, end to end

To show how the layers compose into a deterministic system, here's how all five apply to our most demanding agent. The pre-screening agent conducts the full eligibility conversation with a patient using an IRB-approved script, captures structured determinations for every inclusion and exclusion criterion in the protocol, and books a site visit if the patient qualifies, all in a single phone call.

Layer 01Structured multi-step processes

The agent walks through the protocol's eligibility criteria in a fixed sequence, typically 20–35 steps for a Phase 2 protocol, one criterion per step. The conversation can branch on patient answers, but the language model cannot invent a new question or skip a required one. Because the step sequence is enforced in code, not chosen by the model, the agent cannot drop a required criterion or add one, regardless of what the patient says.

Layer 02Symbolic logic for decisions

Whether the patient meets each criterion is computed by deterministic code from the structured answer extracted at that step, not by the language model itself. Given the same structured input, that code returns the same determination every time; the variability that remains lives upstream, in how the model extracts that input from speech, which is exactly where Layer 03's verification concentrates. Roughly 5–15% of criteria return "cannot tell" on a typical call, depending on protocol ambiguity, and route to human review rather than being coerced into a confident eligible or ineligible.

Layer 03Layered verification

A specialized observer re-derives the structured answer to each criterion in real time, and a single wide-angle observer scans the whole call before it ends. Both must agree before any disqualifying outcome is recorded; observer disagreement on a disqualifying answer occurs on roughly 5–10% of calls and routes to a human reviewer.

Layer 04Bounded authority

The agent has access to 3 tools (book a site visit, escalate to a coordinator, end the call) and zero ability to mutate the clinical record, modify the trial calendar, or generate content outside the IRB-approved script. Patient speech is treated as data; the agent's authority surface is fixed at deployment and cannot be extended at runtime.

Layer 05Independent evaluation harness

Every call is graded by our independent harness across 4 axes (classification correctness per criterion, hallucination resistance, scope adherence, and protocol-shape compliance), with every grade anchored in at least two verbatim quotes from the call transcript. On the published benchmark, the harness achieves 0.925 mean precision and 0.918 mean recall against human-graded ground truth (n = 3,600 conversations). These figures measure how closely the harness agrees with expert human graders, not the agent's own pass rate: the harness is the measuring instrument, and this is its calibration.

What this means in practice

The same inputs always produce the same agent decision: the system is deterministic by construction, not by hope.
No consequential output reaches a sponsor or coordinator without two independent confirmations: one specialized, one wide-angle.
Anything the system is unsure about becomes a human-review case, not a confident wrong answer.
Every interaction is recorded, transcribed, and graded against measurable criteria, with every score backed by verbatim transcript evidence.
The same five layers gate every clinical-trial agent we ship: phone, batch, or coordinator workflow.
No system like this is infallible (voice is noisy and models still surprise us), but every failure mode is one we chose and can observe, because each step emits a checked, structured output.