cs.AIAug 20, 2026

Agentic Governance and Adversarial Verification for Policy-Constrained LLM Healthcare Appeal Generation

Authors: Harshil Lodhiya, Alex McManus, Reese Walker

Organizations: Sliced Health, Woodstock, GA, United States

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Claim denial management costs U.S. healthcare approximately $260 billion annually in administrative overhead. Large Language Models (LLMs) and Retrieval-Augmented Generation (RAG) can produce fluent clinical text, but single-agent architectures fail in high-stakes healthcare: they introduce unsupported clinical details and lose the logical structure of hierarchical payer policy. We propose AGVF (Agentic Governance and Adversarial Verification Framework), a multi-agent architecture for medical-necessity appeal generation under explicit policy and evidence constraints. AGVF models appeal synthesis as a Constrained Markov Decision Process (CMDP) over five agents: policy formalization, evidence retrieval, gap analysis, adversarial critique, and gated synthesis. We prove that refinement over a fixed policy constraint graph monotonically reduces evidence-deficiency and terminates with either a complete satisfying frontier or a localized evidence gap. A deterministic citation- grounding gate prevents assertions without admissible evidence from entering shared state. We provide a reference implementation and validate it on 1,000 synthetic appeal cases parameterized from de-identified public hospital discharge data. The validation confirms zero citation-grounding violations across all AGVF cases and monotone deficiency reduction in every episode; ablating the gate raises violations to 100%, confirming it is load-bearing. The study uses no real patient records and does not measure clinical efficacy. AGVF thus contributes a theory-backed agentic architecture and verified reference implementation for policy-constrained LLM generation in healthcare.

Figures & tables

Figure 1. Naive single-agent RAG pipeline and its structural failure modes. Block diagram of a naive retrieval-augmented generation pipeline showing how retrieval, generation, and post-hoc review can lead to hallucinated claims, fragmented policy context, weak adversarial review, and limited auditability.
Figure 2. AGVF multi-agent architecture and adversarial refinement loop. Architecture diagram showing policy ingestion, evidence retrieval, gap analysis, adversarial critique, and gated synthesis coordinated through an iterative refinement loop.
Figure 3. Message flow for a single AGVF refinement round. The orchestrator mediates every exchange; solid arrows are control/request messages and dashed arrows are returned artifacts. The deterministic citation gate G\mathbb{G} sits inside the Synthesis Agent, and an empty weakness set (or exhausting the budget NN ) exits the loop to HITL review. Sequence-style diagram in which an orchestrator calls policy, retrieval, gap-analysis, synthesis, and critic agents, receives typed artifacts, and routes either another refinement round or a human review handoff.
ComponentImplemented in reported validationFuture production extension
Policy graphHand-authored JSON Boolean graphsAutomated policy-to-graph extraction and expert validation
RetrievalExact-key lookup over synthetic oracle-labeled poolsDense, sparse, hierarchical, or graph retrieval with span verification
SynthesisMock LLM text plus deterministic citation gateReal LLM synthesis with semantic entailment verification
CriticDeterministic gap critic returning Δ(s)\Delta(s)Role-specialized LLM adversarial critic with boundary checks
Regulatory checksChecklist interface onlyJurisdiction-specific statutory template validation
Audit traceIn-memory transition traceDurable evidence-span audit package and HITL workflow
Table 1. Reference implementation fidelity relative to the AGVF architecture.
Figure 4. Citation-grounding gate ablation across 1,000 synthetic cases per arm. (a) mean fabricated unsupported assertions per case; (b) share of cases with any citation-grounding violation. AGVF, RAG, and AGVF −- Critic show zero violations; removing the gate (AGVF −- Gates) yields 2.0 fabricated assertions/case and a 100% violation rate. Synthetic data, mock LLM. Two-panel bar chart showing zero citation-grounding violations for AGVF, RAG, and AGVF without critic, and complete violation under the no-gate ablation with two fabricated assertions per case.
Figure 5. Deficiency D(s)D(s) by refinement round over 1,000 AGVF cases, with 25th–75th and 10th–90th percentile bands. Mean DD falls 11.1→1.6811.1\rightarrow 1.68 ; D(s)D(s) is non-increasing in 100% of cases (Theorem 3.2 , under Assumptions 1 – 3 ). Synthetic data. Line chart with uncertainty bands showing mean deficiency decreasing monotonically over AGVF refinement rounds across the synthetic benchmark.
Figure 6. Termination outcomes per arm. AGVF: 39.6% solved ( D=0D=0 ), 60.4% finite evidence gaps, no infeasible states. RAG produces 40 exclusion-blocked ( D=∞D=\infty ) cases. Synthetic data. Stacked bar chart comparing termination outcomes by arm, with AGVF split between solved and finite-gap cases and RAG including a small exclusion-blocked segment.
Figure 7. Component contribution as change from full AGVF. Gate removal: +100+100 pp citation-grounding violations, +2.0+2.0 fabricated assertions/case. Critic removal: no effect on this synthetic, mock-LLM configuration (expected—see § 5 , Ablation). Synthetic data. Bar chart showing that removing the gate increases citation violations and fabricated assertions, while removing the critic has no measurable effect in the deterministic synthetic configuration.
More in this topic

AI Agent Governance

AI agent governance studies how to authorize, constrain, monitor, and hold autonomous and multi-agent systems accountable.

See all 445 papers

Explore similar work

CardsList
Jun 28, 2026

PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents

LLM agents handle user requests on behalf of organizations through tool calls and must follow the company policies stated in their system prompts. Prior work approaches this as a safeguarding problem -- external checks that block non-compliant agent actions. We argue that policy adherence is a broader problem: real workflows unfold across many turns, require explicit user confirmation and prerequisite reads, and hinge on the content of the dialogue rather than on any single argument value. Meeting this bar requires (i) full conversation context, (ii) self-reasoning over the policy and the current dialogue, and (iii) conversation-specific remediation that guides the agent's next turn -- three capabilities that prior safeguard work has often underestimated. We introduce POLICYGUARD, a sub-agent verifier that shares the agent's view of the dialogue, reasons over the policy in context, and provides actionable feedback for the agent's next turn. On tau^2-BENCH airline across three vendors (GPT-5.4, Claude Sonnet 4.6, Gemini 2.5 Pro) with four trials per setting, POLICYGUARD improves PASS4 by +12.0 / +6.0 / +12.0 pp. Per-call analyses show POLICYGUARD achieves higher policy-violation recall while blocking roughly half as often as argument-level guards.

Seongjae Kang, Taehyung Yu, Sung Ju Hwang

KAIST

Tool-Augmented Language Model AgentsLLM GuardrailsLLM Agent EvaluationLLM Agent VerificationLLM Agent Safety
AskPDF
Aug 31, 2026

GPAgentBench-2K: Benchmarking Large Language Model Agents in Complex Clinical Action Space

Large Language Models (LLMs) show great potential as clinical agents, yet existing benchmarks reduce clinical workflows to static predictions or unconstrained Markov Decision Processes (MDPs) with coarse action sets. To address this, we introduce GPAgentBench-2K, the first Constrained MDP (CMDP) LLM-agent benchmark for primary-care clinical decision-making, constructed from expert-validated records of real-world GP encounters. Our environment models a full spectrum of six foundational clinical actions, imposes a topological workflow prior over the action space, and operationalizes safety-informed abstention as a first-class outcome. Evaluating 16 state-of-the-art LLMs reveals a significant performance degradation as the action space scales. Crucially, we uncover a clinical quality-safety gap: even frontier models with the highest diagnosis accuracy violate safety constraints in over half of high-risk cases. Finally, we establish a reference point using Constrained Group Relative Policy Optimization (C-GRPO), and show that while explicitly modeling constraints improves performance over unconstrained RL methods, it remains far from clinically acceptable safety.

Boqi Chen, Xudong Liu, Yunke Ao +2

ETH Zurich · MBZUAI · University of Toronto

HealthcareConstrained RLAI Agent Safety BenchmarksClinical Language Model EvaluationAgent Benchmarks
AskPDF
Mar 30, 2026

Courtroom-Style Multi-Agent Debate with Progressive RAG and Role-Switching for Controversial Claim Verification

Large language models (LLMs) remain unreliable for high-stakes claim verification due to hallucinations and shallow reasoning. While retrieval-augmented generation (RAG) and multi-agent debate (MAD) address this, they are limited by one-pass retrieval and unstructured debate dynamics. We propose a courtroom-style multi-agent framework, PROClaim, that reformulates verification as a structured, adversarial deliberation. Our approach integrates specialized roles (e.g., Plaintiff, Defense, Judge) with Progressive RAG (P-RAG) to dynamically expand and refine the evidence pool during the debate. Furthermore, we employ evidence negotiation, self-reflection, and heterogeneous multi-judge aggregation to enforce calibration, robustness, and diversity. In zero-shot evaluations on the Check-COVID benchmark, PROClaim achieves 81.7% accuracy, outperforming standard multi-agent debate by 10.0 percentage points, with P-RAG driving the primary performance gains (+7.5 pp). We ultimately demonstrate that structural deliberation and model heterogeneity effectively mitigate systematic biases, providing a robust foundation for reliable claim verification. Our code and data are publicly available at https://github.com/mnc13/PROClaim.

Masnun Nuha Chowdhury, Nusrat Jahan Beg, Umme Hunny Khan +3

Systems and Software Lab (SSL), Department of Computer Science and Engineering, Islamic University of Technology, Dhaka, Bangladesh

Claim VerificationMulti-Agent DebateMulti-Agent LLMsRetrieval-Augmented Generation
AskPDF