A CISO will not sign a group chat. Build a locked case file with isolated writers.
The multi-agent system that survives an audit is a locked case file. Isolated specialists write named fields. A gate can refuse the next hop. A record can prove who wrote what, and whether anyone changed it later. If you cannot point at those four properties, you do not have a regulated workflow. You have a transcript that happens to touch PHI.
Yesterday I said most crews are one unfinished agent wearing extra nameplates, and that this architecture assumes you already passed the test. Independence. Parallelism that pays for the extra hop. A real model difference, not two hats on the same weights. A human gate that is a control, not a witness. This post is the graph that remains after that filter. Prior authorization is still the packet I will walk, because it is the shape I have sat with: eligibility, clinical criteria, coding, a determination letter a nurse will sign. The desks already exist. Mapping them onto agents is only legal if the interfaces already exist too.
The constraint that defines this class is not “we have four specialists.” It is that the packet contains PHI, the letter is a signed determination, a crash mid-packet cannot pretend the eligibility call never happened, and the clinical agent must not hold the eligibility agent’s credentials. A CISO will ask which component wrote the ICD code. An auditor will ask whether the log can be altered by anyone with database access. Operations will ask why a 40-minute human wait died with the process and restaged the conversation from turn one. Phoenix can show you a span for the first question. It cannot answer the other two. I wrote that gap in July. It is still the gap.
The architecture that holds those constraints is a supervisor on a blackboard, not a committee in a channel. LangGraph 1.2.11, shipped August 11, is the graph I would start with if the team does not already live in CrewAI. CrewAI Flows at 1.15.16, shipped August 14, is the same idea if the path is already the artifact and the roles are already in the file. Either way the supervisor is a router. It reads a typed packet, picks the next specialist, and waits for a structured write. It does not ask anyone to discuss. The shared state is a Pydantic object that looks like the case file: member token, eligibility decision, clinical finding, codes, letter draft, gate results, approval record. Agents read fields. They write fields. They never receive another agent’s chain of thought “for context.” That last habit is how you reprint the minutes at every seat and how you leak a clinical argument into a coding sandbox that should never have seen it.
Isolation is the reason the second agent exists. Personality is not. Each specialist runs in its own sandbox with its own tool list and its own vaulted credentials. Eligibility can query the membership system and the benefit file. It cannot open the chart. Clinical can retrieve the policy language and the clinical packet after eligibility has posted a decision. It cannot write to the claims system of record. Coding receives the approved criteria object, not the member’s full record. Infisical Agent Vault or Harbor SDK still sit under this the way they did in July: the agent requests a tool, the proxy injects the secret, the model never sees the key. Docker, or an equivalent process jail, keeps a hallucinated shell command inside the specialist that issued it. If two specialists can reach the same production credential, you did not split the work. You copied a login.
Durable execution is the layer teams skip until the first crash on step 37. Restate’s server is at v1.7.4, released August 18. The Python SDK is 1.0.4, shipped August 14. Wrap each hop as a Restate handler. Eligibility completes, the journal records the decision, clinical starts from that object. If the process dies while a reviewer has had the letter open for 40 minutes, Restate wakes up still waiting. It does not re-call eligibility and it does not invent a second letter. LangGraph’s Postgres checkpointer is the lighter substitute when the hops are short and you do not want a sidecar yet. I would take the checkpointer for a pilot that finishes in seconds. I would take Restate the first time a human wait or a downstream outage can outlive the process. Hermes and OpenClaw already built their own versions of this inside the runtime. A regulated multi-agent graph that sits on LangGraph or CrewAI does not get that for free. You add it, or you explain to operations why the packet restarted.
The validation gate is what makes the next hop legal. Schema first. If the specialist cannot produce a document the next node will accept, the write never lands on the blackboard. DeepEval 4.1.8, released August 12, is the assertion layer I would put on every hop that generates language a human might later sign. Faithfulness against the retrieved policy. A checklist metric for the fields the determination requires. A hard fail if a denial has no citation. This is the same assert_test() shape I covered in June, pointed at a packet instead of a RAG answer. Custom assertions are fine if you do not want another model in the gate. A deterministic checklist on required keys is often the better first test. Fail means refuse. It does not mean spawn a critic agent to restate the miss.
The human interrupt sits after the automated gate, and only on irreversible work: send the letter, write the determination to the system of record, fire a notice the member will see. LangGraph’s interrupt() still pauses and resumes. The escrow around it, timeouts, escalation, the approval payload as a typed schema, is still yours. I said that in July. A reviewer who signs a structured finding is a control. A reviewer who reads five agents argue and then signs anyway is a witness.
The audit record is not the LangGraph checkpoint and it is not a Phoenix trace. Those are debug. The record an auditor can use is the append-only event I specified on July 27: timestamp, agent identity, tool, redacted input, redacted output, hash of the previous event. Postgres with a trigger that rejects UPDATE and DELETE is enough. Redaction runs before the write, not as a masking rule you remember later. Every state-changing tool carries its reversal in the same transaction, or it is marked irreversible and cannot fire without the interrupt. Phoenix and Langfuse still earn their keep for engineers. Hand either one to a regulator as evidence and you will spend the rest of the meeting talking about who can write to the trace store.
Where this flexes is the parts you can swap without breaking the class. CrewAI Flows instead of LangGraph if the team already thinks in @start and @router and you do not want a second orchestration model. Skip Restate until the first wait or the first crash you cannot afford to replay; the Postgres checkpointer covers the short path. Swap DeepEval for a pile of schema tests if the outputs are structured enough that a second model in the gate is wasted money. Keep the Microsoft Agent Framework Handoff pattern if the shop is already on that SDK, and leave GroupChat and Magentic off the case file. The fixed parts do not flex. Blackboard, not chat. Isolation of credentials and data. A gate that can refuse. A hash-chained record. A human only where the action cannot be undone. Drop any one of those and you are back to yesterday’s theater with better furniture.
What it costs is mostly discipline, then tokens, then a sidecar. Every new tool needs rollback semantics before it ships, not after the first bad write. Every extra specialist is another context assembly and another chance to drop the finding that mattered; budget the hops or the p99 will surprise the operations lead. Restate is a service you have to run. HITL is an SLA you have to staff. Someone in the room has to walk a CISO through the graph without calling a transcript an audit trail. I would not stand this up as a three-person experiment against a live determination queue. I would stand the smallest version of it against a replay of last month’s packets, with the send gate wired to a sink.
The starting point is smaller than the org chart. One supervisor. Two specialists: eligibility and the letter. One packet schema. One DeepEval or checklist gate on the letter. One interrupt() before anything leaves the building. One hashed append-only log. Add clinical when eligibility’s interface is stable enough that clinical can consume a decision object and walk away. Add coding when clinical’s finding is a document, not a vibe. Do not start with five agents and a shared transcript. That design fails yesterday’s test on purpose.
Thursday I will look at DSPy 3.3.0, which treats the coordination itself as something a compiler should search. Tonight the question is plainer. Can you name the field each specialist is allowed to write, the credential it is forbidden to hold, and the check that stops the next hop? If you cannot, do not draw the graph. Finish the single agent until the leftover work has an interface.
If this was useful, forward it to one engineer who needs less noise in their feed.