Platform
Each stage below separates what exists in the demonstrator from what is synthetic, what needs funded research and what needs an NHS approved environment. Those are four different things and they are not interchangeable.
Seven stages. Each states its inputs, the rule it applies, the authority it needs and the record it leaves.
State is projected from the event history on every read rather than stored and mutated.
Deterministic detectors for delay, missing prerequisite, stale dependency, non-response, conflict, and a review expected by a recorded date with no matching booking.
Only catalogued actions may be proposed. The planner cannot invent one.
Deny by default. Uncatalogued, clinical or insufficiently evidenced proposals are refused.
One named role for bounded action, two for higher impact, and they cannot be the same person.
A repeated call has one effect. External systems are simulated in the demonstrator.
Bounded retries, compensating action on partial failure, escalation on the rest.
Real records from a seeded run, not an illustration. The same scenario at the same seed produces the same records in the same order.
| Seq | Elapsed | Class | Event | Outcome | Record |
|---|---|---|---|---|---|
| 1 | 02:00 | — | Constraint detected | A required step was never requested | 483ebcaa7a |
| 2 | 02:00 | A | Authority decision | Permitted — the system may act | 1379694e61 |
| 3 | 02:00 | A | Action executed | Carried out against a simulated system | d8a0e68e1e |
| 4 | 02:00 | — | Outcome confirmed | Resolved | 28b3c4492c |
| 5 | 04:00 | — | Constraint detected | A freed appointment slot could be reused | d870e2155f |
| 6 | 04:00 | C | Authority decision | Refused by policy | 7ab389e453 |
| 7 | 04:00 | — | Escalated | Refused: outside what the system may decide | 279457f872 |
| 8 | 04:00 | — | Constraint detected | A freed appointment slot could be reused | f92b227b7e |
| 9 | 04:00 | C | Authority decision | Refused by policy | db7fa0a79b |
| 10 | 04:00 | — | Escalated | Refused: outside what the system may decide | 20c191f736 |
| 11 | 06:00 | C | Authority decision | Stopped, waiting for a named person | 3959679732 |
| 12 | 06:00 | C | Approval requested | Waiting for a named person | a435fe7ca2 |
| 13 | 08:00 | C | Approval decision | Waiting for a second signature | 86bb60db5b |
| 14 | 08:00 | C | Approval decision | Approved by a named role | 1a513aa460 |
State is projected from an event history on every read rather than stored and mutated, so the same events always produce the same state and any point in a run can be rebuilt exactly.
Exists in the demonstrator
Deterministic projection and replay across seeded scenarios.
Synthetic or modelled
All events are invented. Volumes are small — five pathways, not five thousand.
Not built: needs research
Ingesting real pathway state that arrives late, out of order and contradictory across systems.
Requires an NHS approved environment
Any connection to a live source system.
Deterministic detectors identify delay, missing prerequisite, stale dependency, non-response, conflicting state, and a review that was expected by a recorded date with no matching booking — each carrying the facts that triggered it and an explicit uncertainty value.
Exists in the demonstrator
Seven detectors with reason codes, facts and stated uncertainty.
Synthetic or modelled
Thresholds are demonstrator defaults with no evidential basis, and are labelled as such.
Not built: needs research
Whether detectors transfer to real data, and what false positive rate is tolerable in a real workflow.
Requires an NHS approved environment
Calibration against observed baselines.
A planner assembles a response from the action catalogue, with its reason, its evidence and the authority it requires attached. It cannot invent an action that is not catalogued.
Exists in the demonstrator
Ranked proposals from a nine-action catalogue, each with evidence.
Synthetic or modelled
The catalogue is hand authored for one invented service.
Not built: needs research
AI assistance in interpretation and planning, inside the same policy controls, measured against the deterministic baseline.
Requires an NHS approved environment
A catalogue agreed with the organisation that will operate it.
The policy engine decides. Deny by default: anything uncatalogued, clinical or insufficiently evidenced is refused and recorded. An action’s class is a property of the catalogue, resolved at decision time.
Exists in the demonstrator
Five authority classes enforced; clinical and uncatalogued requests refused and audited.
Synthetic or modelled
The policy set is ours, not an organisation’s.
Not built: needs research
Where a real organisation is willing to place the boundary, and evidencing that it holds.
Requires an NHS approved environment
Agreement on delegated authority, with clinical safety and governance sign-off.
Permitted low-risk actions execute with idempotency controls so a repeated call has one effect. Everything else waits for named human approval, which can be given, refused, amended or allowed to expire.
Exists in the demonstrator
Idempotent execution, approval queue, separation of duties, expiry, rejection.
Synthetic or modelled
Every external system is a simulator implementing an interface.
Not built: needs research
Integration with real systems, and identity assurance for the people approving.
Requires an NHS approved environment
Any write to an operational system.
The system checks whether an action produced its expected outcome, retries within bounds, applies compensating action on partial failure and escalates what it cannot resolve to a named human.
Exists in the demonstrator
Outcome monitoring, bounded retry, compensation, SLA escalation, injected failure recovery.
Synthetic or modelled
Outcomes are compared against a no-action and a manual comparator built from stated assumptions.
Not built: needs research
Attributing operational change in a live service against a moving baseline.
Requires an NHS approved environment
Prospective evaluation with a declared comparator.
Every step appends to a tamper evident chain recording actor, authority class, evidence, policy version, input and output hashes, and outcome. Altering a record breaks verification from that point onward.
Exists in the demonstrator
Hash-chained records, verification, a tamper demonstration and a machine-readable evidence export.
Synthetic or modelled
In-memory for the demonstrator, with no retention policy.
Not built: needs research
Durable, access-controlled retention and external anchoring.
Requires an NHS approved environment
Records covering real people and real actions.
A clinician records that a patient should be reviewed by a certain date. The date passes and no appointment has been booked. Nothing fails loudly, so nothing surfaces — which is what makes it a good place to test whether software can find the exception without deciding anything clinical.
We are not claiming a universal diagnosis of NHS elective care. Every service is organised differently, and the teams doing this work already know where their own friction sits far better than we do.
What we are testing is narrower: that in some services, material manual coordination sits between an operational issue becoming visible and the next appropriate step happening — and that an execution layer restricted to a fixed, pre-authorised list of actions could reduce it without touching clinical judgement.
Leva Health's thesis is that material manual coordination sits between detecting a blocked pathway and resolving it, and that a controlled execution layer could close that gap.
In a synthetic scenario the demonstrator identifies a review that was expected by a recorded date and has no matching booking, prepares the permitted administrative response, and routes the cases it cannot resolve from the record to a named person rather than deciding them.
The problem, the published evidence, and what it does not show
Every label below is invented. It exists to show the shape of the problem, not to represent any real service or patient. Note where it stalls: not on a step that failed, but on one that never happened.
A detector that performs well on clean, well-ordered events may perform badly on all three of these. That is the central open question, and it has a real negative answer available.
Chasing an outstanding dependency, raising a coordination task, recording that a prerequisite is missing, escalating an overdue item to a named role, preparing a communication for approval.
Diagnosis, treatment, clinical priority, clinical suitability and eligibility. Routed to an authorised clinician and never decided by the system. A refusal here is the architecture working.
A request requiring clinical judgement is refused by the real policy engine and routed to a clinician, rather than by a scripted animation.
We are inviting NHS professionals to review the synthetic demonstrator and tell us where the workflow is unrealistic, where the authority boundaries sit wrongly, and what would need resolving before any evaluation. Review takes about 25 minutes and is by individual invitation.