Configuration schema

Generated from the live registry at build time. It cannot describe a capability the gateway does not enforce.

Configuration resolves through a cascade - fleet, then alliance, then practice - and every one of the 32 keys below declares which direction a lower layer may move it.

Direction, not just value

A key marked stricter may be tightened by a practice and never loosened. The linter refuses a proposal that would loosen one at authoring time, so an unsafe overlay cannot be written, let alone published.

#Sealed keys

Settable at fleet only, by a governed change. No alliance and no practice can weaken them. These are the safety floors.

Key	Value	Why it is sealed
`safety.human_gate_required`	`true`	The agent never sends. Every consequential action stops at a licensed human, at every autonomy level.
`safety.adverse_determination_requires_licensed_human`	`true`	An adverse or clinical determination is released by a licensed human. This one gate satisfies the state-law patchwork, CMS UM rules, and FDA CDS criterion 4.
`safety.audit_required`	`true`	Every PHI view and every governed action writes an audit event with purpose-of-use.
`safety.external_phi_max`	`"masked"`	An external A2A principal never receives unmasked PHI, whatever a practice would prefer.
`isolation.cross_practice`	`"never"`	A prior authorization belongs to exactly one practice. There is no configuration that widens this.
`safety.clinical_kb_is_config_not_rag`	`true`	Whether a code needs authorization is a lookup with a right answer. It is never generated.

#Every key

Key	Type	Default	Direction	Sealed
`safety.human_gate_required`	boolean	`true`	-	yes
`safety.adverse_determination_requires_licensed_human`	boolean	`true`	-	yes
`safety.audit_required`	boolean	`true`	-	yes
`safety.external_phi_max`	enum (none \| masked)	`"masked"`	-	yes
`isolation.cross_practice`	enum (never)	`"never"`	-	yes
`safety.clinical_kb_is_config_not_rag`	boolean	`true`	-	yes
`autonomy.ceiling`	enum (L0 \| L1 \| L2 \| L3 \| L4)	`"L3"`	stricter	-
`autonomy.external_ceiling`	enum (L0 \| L1 \| L2 \| L3 \| L4)	`"L1"`	stricter	-
`bounds.page_size`	integer	`50`	stricter	-
`bounds.max_rows`	integer	`500`	stricter	-
`budget.calls_per_min`	integer	`30`	free	-
`budget.practice_calls_per_min`	integer	`120`	free	-
`budget.calls_per_day`	integer	`5000`	free	-
`gate.ttl_minutes`	integer	`60`	stricter	-
`vendor.timeout_ms`	integer	`8000`	free	-
`knowledge.staleness_budget_days`	integer	`90`	stricter	-
`knowledge.serve_unverified`	boolean	`false`	stricter	-
`submission.default_urgency`	enum (standard \| expedited)	`"standard"`	free	-
`submission.duplicate_window_hours`	integer	`24`	free	-
`submission.poll_backoff_ms`	integer	`700`	free	-
`submission.auto_attach_documentation`	boolean	`true`	free	-
`denial.auto_triage`	boolean	`true`	free	-
`denial.triage_queue`	string	`"prior-auth-denial-review"`	free	-
`payers.enabled`	array	`["BCBSF","AETNA","UHC"]`	free	-
`model.id`	enum (deterministic-rules-v1 \| claude-sonnet-4-5-20250929 \| claude-opus-4-5-20251101)	`"deterministic-rules-v1"`	free	-
`model.confidence_floor`	integer	`70`	stricter	-
`ehr.mode`	enum (mock \| replay \| veradigm)	`"mock"`	free	-
`ehr.write_enabled`	boolean	`false`	free	-
`ehr.autonomous_status_comment`	boolean	`false`	free	-
`vendor.mode`	enum (mock \| replay \| live)	`"mock"`	free	-
`rail.preferred`	enum (278 \| pas)	`"278"`	free	-
`branding.practice_display_name`	string	`""`	free	-

#Purpose of each key

safety.human_gate_required: The agent never sends. Every consequential action stops at a licensed human, at every autonomy level.
safety.adverse_determination_requires_licensed_human: An adverse or clinical determination is released by a licensed human. This one gate satisfies the state-law patchwork, CMS UM rules, and FDA CDS criterion 4.
safety.audit_required: Every PHI view and every governed action writes an audit event with purpose-of-use.
safety.external_phi_max: An external A2A principal never receives unmasked PHI, whatever a practice would prefer.
isolation.cross_practice: A prior authorization belongs to exactly one practice. There is no configuration that widens this.
safety.clinical_kb_is_config_not_rag: Whether a code needs authorization is a lookup with a right answer. It is never generated.
autonomy.ceiling: A practice that wants its agents more conservative may say so. It cannot grant itself more autonomy than the fleet allows.
autonomy.external_ceiling: External A2A principals default lower than platform agents.
bounds.page_size: No list-all. A practice may page smaller.
bounds.max_rows: Hard ceiling on rows returned to an agent.
budget.calls_per_min: Per-principal call budget, per minute.
budget.practice_calls_per_min: Whole-practice call budget, so one runaway principal cannot exhaust the tenant.
budget.calls_per_day: Per-principal daily budget.
gate.ttl_minutes: How long a human release stays valid. A practice may shorten this; it may not extend it beyond the fleet default.
vendor.timeout_ms: Per-call vendor timeout. A call that hangs is a failure, not a wait.
knowledge.staleness_budget_days: How old a payer rule may be before it is served with a warning.
knowledge.serve_unverified: Whether an unverified rule may be returned at all. Default is no; a practice may not turn this on.
submission.default_urgency: Default urgency on a new request.
submission.duplicate_window_hours: How long the gateway refuses a byte-equivalent resubmission.
submission.poll_backoff_ms: Delay between polls of a pending authorization.
submission.auto_attach_documentation: Whether the agent attaches documentation it can locate.
denial.auto_triage: Whether denial triage runs automatically on an adverse determination.
denial.triage_queue: Which HITL queue receives denials.
payers.enabled: Payers this practice transacts with.
model.id: Which pinned model proposes. An unpinned id cannot be evaluated, so only allowlisted pins appear here.
model.confidence_floor: Percent. Below it a proposal is held for a human rather than acted on. A practice may raise this; it may never lower it.
ehr.mode: Which EHR adapter this practice talks to. The live adapter refuses to start without credentials and without verified field mappings.
ehr.write_enabled: Whether PriorAuth may write into this practice's chart at all. Off by default: a read connection is not consent to write. The practice owns the record and turns this on deliberately.
ehr.autonomous_status_comment: Whether a factual, AI-disclosed payer-status note may be written without a human release. Clinical assertions and referrals are gated regardless of this setting.
vendor.mode: Which clearinghouse adapter this practice talks to. Moving a practice to live is a config change with an audit trail, not a deploy. The live adapter refuses to start without credentials rather than falling back.
rail.preferred: Preferred transport. Two rails, permanently; PAS as payers turn it on.
branding.practice_display_name: Shown in the console.