Technology for a more productive NHS
Leva compares what an NHS pathway says should happen with what operational records show has happened. It identifies exceptions, prepares only permitted administrative responses and routes clinical judgement to clinicians.
Working synthetic demonstrator. No NHS deployment or outcome is claimed.
The problem
Operational teams work across fragmented systems, incomplete pathway states, competing priorities and manual coordination. Important issues can be visible without the next action happening quickly enough.
A worked NHS scenario
We are starting with follow-up integrity — reviews a clinician intended that have not been booked. This is one case, worked through end to end.
Case P10042 at Northstar University Hospitals NHS Trust — a fictional Trust, invented for this demonstration. There is no patient name, deliberately. Everything below is synthetic and the demonstrator runs it end to end.
A clinician records that this patient should be seen again, and the interval is written down. Booking it is a separate task, in a separate system, done by a separate team.
The review falls due on 10 July 2026. Nothing happens, because nothing is watching for the absence of an appointment.
As at 15 July 2026 the record is examined and no appointment can be matched to the intended review. Two recorded facts compared — not an inference about the patient.
An administrative task is assembled from a fixed, pre-authorised list, with the evidence that triggered it attached. Nothing outside that list can be proposed.
Asked to decide that this patient should be seen sooner, the system refuses, records the refusal and routes it to a clinician. Priority, suitability and eligibility are never decided here.
The material action stops and waits for a named role. Only once a person approves does it run, and policy is checked again before it does.
The outcome is watched against a deadline. Here the appointment still does not appear, so the system says so rather than closing the case. Every step above is written to a tamper evident record.
The finding is the comparison: a review was due by 10 July 2026, and as at 15 July 2026 no appointment could be matched to it. That is an operational fact about a record, and it is all the system claims to know.
How it works
Seven stages. Two of them are the reason an NHS organisation could let software do any of this at all.
State is projected from the event history on every read rather than stored and mutated.
Deterministic detectors for delay, missing prerequisite, stale dependency, non-response, conflict, and a review expected by a recorded date with no matching booking.
Only catalogued actions may be proposed. The planner cannot invent one.
Deny by default. Uncatalogued, clinical or insufficiently evidenced proposals are refused.
One named role for bounded action, two for higher impact, and they cannot be the same person.
A repeated call has one effect. External systems are simulated in the demonstrator.
Bounded retries, compensating action on partial failure, escalation on the rest.
What it produces
Not a log written after the fact. The record is how the system works: each row states what was decided, on whose authority, and what evidence supported it — and is hashed to the row above.
The extract alongside includes a refusal. Asked to do something that would set clinical priority, the policy engine declined and routed it to a clinician. That is the architecture working, and it is written to the same ledger as everything else.
How the authority model works| Seq | Elapsed | Class | Event | Outcome | Record |
|---|---|---|---|---|---|
| 1 | 02:00 | — | Constraint detected | A required step was never requested | 483ebcaa7a |
| 2 | 02:00 | A | Authority decision | Permitted — the system may act | 1379694e61 |
| 3 | 02:00 | A | Action executed | Carried out against a simulated system | d8a0e68e1e |
| 4 | 02:00 | — | Outcome confirmed | Resolved | 28b3c4492c |
| 5 | 04:00 | — | Constraint detected | A freed appointment slot could be reused | d870e2155f |
| 6 | 04:00 | C | Authority decision | Refused by policy | 7ab389e453 |
| 7 | 04:00 | — | Escalated | Refused: outside what the system may decide | 279457f872 |
| 8 | 04:00 | — | Constraint detected | A freed appointment slot could be reused | f92b227b7e |
| 9 | 04:00 | C | Authority decision | Refused by policy | db7fa0a79b |
| 10 | 04:00 | — | Escalated | Refused: outside what the system may decide | 20c191f736 |
| 11 | 06:00 | C | Authority decision | Stopped, waiting for a named person | 3959679732 |
| 12 | 06:00 | C | Approval requested | Waiting for a named person | a435fe7ca2 |
| 13 | 08:00 | C | Approval decision | Waiting for a second signature | 86bb60db5b |
| 14 | 08:00 | C | Approval decision | Approved by a named role | 1a513aa460 |
Where the boundary sits
Interpreting state, identifying constraints, assembling a candidate response with its evidence attached.
Named roles. Two signatures where impact is higher. An expired approval is never treated as consent.
Diagnosis, treatment, priority, suitability and eligibility are routed, never decided by software.
Safety does not depend on asking a model to behave.
Where AI fits
The demonstrator running today is deterministic: fixed rules, the same output every time, no model involved at any point. That is what makes the execution and authority controls provable rather than asserted.
The research we intend to do next tests whether AI reasoning inside those same controls adds measurable value — a model that may interpret messy inputs and assemble candidate actions, and that still cannot grant itself authority, still must abstain when the evidence is thin, and is removed if it costs more than it returns. The controls come first. The model works inside them or not at all.
What the model would and would not be allowed to doEvidence
Mechanics you can exercise now and check against the test suite: detection, policy enforcement, approval, execution, monitoring, recovery and a tamper evident record.
Operational arithmetic whose inputs are stated defaults rather than measurements, shown next to the figures they produce.
Everything about real data, real workflows, real adoption and real effect. None of it established, none of it claimed.
No economic figures appear on this site. The demonstrator exposes the assumptions and the arithmetic together, so a reviewer can change a load bearing assumption and watch the number move. A figure without its assumptions is not evidence.
No NHS deployment, integration, partner, customer, pilot, certification, saving or patient outcome. None of these is claimed and none exists.
The control boundary is set out on Safety, the open questions and what would falsify them on Research.
Collaborate
We are speaking with NHS operational leaders, clinical safety specialists, information governance professionals, evaluators and health economists to shape a credible route from synthetic demonstration to real world evidence. Review of the demonstrator takes about 25 minutes and is by individual invitation.