Your data went somewhere. We can show you exactly where.
AI agents are useful because they can reach everything. In a hospital, that is the problem. OpaqAI puts a field-level boundary between agents and patient records — and hands the owner of that data a readable, signed log of every crossing.
Agents ask per field. Policy answers per field.
The record stays on the owner's side. The agent stays on its side. Every request crosses one boundary, where policy decides — pass, mask, or block. A refusal is normal operation, not an alert.
A log the data's owner can read.
Every crossing produces a signed line a person can read — not a trace only an engineer can parse. Blocked lines represent the system doing its job.
| TIME (UTC) | AGENT | FIELD | DECISION | SIGNATURE |
|---|---|---|---|---|
| 2026-07-30 14:02:11 | scheduler | patient/128/appointment.start | PASSED | sig:9f3a…c1 |
| 2026-07-30 14:02:11 | scheduler | patient/128/diagnosis.code | MASKED | sig:b21c…7e |
| 2026-07-30 14:02:12 | trial-matcher | patient/128/biomarker.egfr | PASSED | sig:5d90…a4 |
| 2026-07-30 14:02:12 | indexer | patient/128/national_id | BLOCKED | policy:min-necessary |
The Integrity Matrix
Field-level, not app-level
Grants are written per field and per purpose. An agent that needs a start date never sees a salary — or a diagnosis. App-level access is how over-sharing happens.
Readable by the owner
Every crossing produces a signed line a person can read. When compliance asks who saw what, the answer is a log, not an investigation.
Built for compromised agents
Assume the agent is persuadable. Prompt injection changes what an agent asks for — not what the boundary lets through. The boundary holds regardless.
Oncology first.
Cancer care runs on the most sensitive records in medicine, shared across the largest care teams. Tumor boards, trial matching, registry reporting — every workflow needs some of the record and none needs all of it.
Why Oncology| WORKFLOW | NEEDS | NEVER NEEDS |
|---|---|---|
| tumor-board | staging, pathology, imaging reads | SSN, financial class |
| trial-matcher | diagnosis, biomarkers, prior lines | identifiers, free-text notes |
| registry | coded diagnosis, staging, vitals | psychotherapy notes |
| prior-auth | regimen, diagnosis code | full chart export |
See your agents' first week of crossings.
We deploy alongside your existing FHIR infrastructure, register your agents, and hand you the log. Most teams learn something from the first day of it.