How Veridose is designed
An event-driven, Azure-native design: a semantic layer with a governed knowledge graph, policy-enforced access down to individual facts, a clinical NLP layer, and state-graph agent workflows beside a deterministic supply engine.
Four problems this design solves
Swipe for more →
Entity fragmentation
One lot has five names across IRT, ERP, CDMO files and email.
Entity registry with persistent IDs
Permission drift
ACLs are lost when documents become chunks, embeddings and summaries.
Fact-level labels, central policy
Non-determinism in GxP
LLM output varies; validation needs controlled, testable behavior.
Deterministic engine, recorded AI runs
Mixed, moving state
Documents, records and telemetry feed one decision, in real time.
Immutable event log, query router
Reference architecture on Azure
Event-driven ingest flows left to right; decisions flow back to your systems. Everything beyond your systems runs inside the sponsor’s single-tenant data cell.
Swipe sideways to see the full diagram →
Swipe for more →
Single-tenant cells
Dedicated database, storage, event namespace and customer-managed keys per sponsor. Private endpoints only.
Open interfaces
Postgres wire protocol, Kafka API, OIDC and OpenTelemetry; object storage sits behind an adapter with open export formats.
Regional inference
Claude, GPT and open-weight models through Microsoft Foundry, hosted on Azure. Processing region is pinned per model and deployment (source).
Two engines, one boundary
Numbers and actions come from deterministic domain services. Evidence, explanation and drafting come from AI services. The boundary between them is enforced in code, not in prompts.
Swipe for more →
Domain services
- Demand forecasts with stated assumptions and uncertainty
- Stock coverage, FEFO, expiry and release gates
- Temperature-exposure metrics against approved criteria
- Versioned inputs, configs and test vectors
AI services
- Clinical NLP, hybrid RAG and retrieval authority
- Case synthesis with citations and abstention
- Bounded tool use through state-graph workflows
- Every prompt, output and tool result recorded
When AI is unavailable
- Rules-only monitoring and alerts keep running
- UI shows stale-data and limitation banners
- No recommendation without its evidence
Swipe for more →
No authoritative inventory from AI
Stock positions come only from reconciled source records.
No randomization or allocation
Assignment stays with the IRT; Veridose never infers it.
No disposition of IMP
Excursed or quarantined product is dispositioned by Quality.
Time-specific evidence
Every recommendation cites an as-of snapshot and source spans.
Agent decision flow
A supervisor pattern: a state-graph orchestrator fans out to specialist agents and fans their findings back into a shared case file. Control flow is code; models only fill in the nodes.
Swipe sideways to see the full diagram →
The study assistant runs a bounded ReAct loop over the same read-only tools, with step and token caps. It cannot reach write tools.
Swipe for more →
Depot and inventory
- Reads
- Stock by lot and location, expiry, reservations
- Returns
- Available quantity, at-risk lots, resupply options
Logistics and weather
- Reads
- Shipments, lanes, courier SLAs, forecasts, holidays
- Returns
- Lane risk, ETA changes, courier alternatives
Cold chain
- Reads
- Logger series, excursion history, packaging specs
- Returns
- Exposure metrics against approved product criteria; Quality decides disposition
Site liaison
- Reads
- Site contacts, storage confirmations, dispensing
- Returns
- Confirmations, overdue replies, drafted outreach
Protocol and documents
- Reads
- Protocol versions, pharmacy manual, SOPs
- Returns
- Governing passages with citations, or "not found"
Why a state graph and a blackboard, not an agent mesh
Veridose does use graphs: every orchestrator is one. What it avoids is agents conversing with each other. Specialists never message one another; they read and write typed findings on the case file.
Swipe for more →
One agent, every tool
- Hundreds of tools in one context; tool-selection errors rise
- No single context of use to validate
- A prompt injection reaches every system
Agent mesh, peer-to-peer chat
- Agents negotiate in free text; emergent, non-reproducible paths
- Hard to attribute which agent decided what
- Context leaks across permission scopes
State graph + blackboard
- State machine with durable checkpoints; replays reuse recorded model outputs, never regenerate them
- Stateless specialists with scoped tools and typed outputs
- Every transition and finding attributable in the audit ledger
Swipe for more →
Tool allowlists
Each graph gets only its tools, enforced at the gateway, not in the prompt.
Case-scoped commands
Each approval issues one short-lived, idempotent command, checked again at the destination.
Injection containment
Retrieved text is data: it cannot add tools or change routing.
Blinding-aware outputs
Role filters keep unblinding facts away from blinded roles.
Semantic layer
The same drug, lot or site appears in the IMPD, the pharmacy manual, the IRT and a courier email under different names. The semantic layer gives each one a single ID and meaning, and every consumer, human or agent, reads through it.
Swipe sideways to see the full diagram →
Facts are extracted with ontology-constrained structured outputs, so a model can only emit types and relations the canonical model defines. Apache AGE serves lineage and multi-hop queries as a property graph; an RDF and SHACL stack is added only if a partner needs standards-based exchange.
Swipe for more →
A fact becomes an edge with context
@ pharmacy-manual/v4#6.2
Conflicts surface, never merge
Label proof v5 → ≤ 25 °C
Rules decide, people confirm
Authority order (approved IMPD over manual over email), then effective date and version. The resolved fact keeps a pointer to the decision that settled it.
Swipe for more →
Bitemporal facts
Each fact carries as-of, effective and observed timestamps, so answers can be reproduced for any point in time.
Inventory state semantics
On-hand, released, allocatable, quarantined and in transit are distinct states, never one “available” count.
Source-of-truth matrix
Each attribute has one authoritative system; conflicts go to a reconciliation queue, never a silent merge.
Labels and attribute-based access
One central policy model decides access from labels attached to the data, not from where it is stored. Labels are assigned at ingestion, propagate to every derived artifact, and are enforced independently at each access point, with negative tests.
Swipe sideways to see the full diagram →
Where permission-aware RAG usually breaks
Swipe for more →
Post-filtering
Filtering after retrieval leaks counts and starves recall.
Label predicates pushed into the ANN query
Inheritance drift
Source ACLs change after the index was built.
Change events re-evaluate and re-tag
Derived-content leakage
Summaries and embeddings mix restricted sources.
Derived artifacts inherit the strictest labels
Inconsistent LLM labels
Free-text tags drift from the ontology.
Ontology-constrained outputs + checks
Aggregate inference
Counts by arm or lot can reveal allocation to blinded roles.
Unblinded data segregated; aggregates suppressed
Why label facts, not just documents
Swipe for more →
Document tags
- One label for a 200-page IMPD
- All-or-nothing access
- Lost the moment text is chunked
Chunk labels
- A chunk mixes unrelated facts
- Relationships and provenance are lost
- Re-chunking breaks the mapping
Labeled facts
- Subject, relation, object + context
- Context carries source, version, span and label set
- Access, lineage and deletion decided per fact
(Kit 0042) —locatedAt→ (Site 12) is visible to the whole study team. Treatment allocation is never ingested into a blinded study cell: it stays in the IRT or an unblinded-only store, and blinded roles are blocked from aggregate queries that could reveal arm-level supply. Document- or chunk-level tags cannot make this distinction.Clinical NLP layer
General models misread supply text: “IP” is not intellectual property, a lot number is not a word, and “2-8C” is a storage condition. Terms are resolved before retrieval and linted again after generation.
Swipe sideways to see the full diagram →
Original text is never modified: normalized forms are stored as annotations with confidence, scoped by sponsor, study and document version. The lexicon is versioned like code and every change is reviewed.
Swipe for more →
Acronym sense chosen from supply context, not the general dictionary.
Identifiers are protected tokens: never split, stemmed or spell-corrected.
Units normalized to UCUM so search and range checks see one form.
Linked to the MKT service and its computed value.
Lemmatized for keyword recall, applied only to ordinary vocabulary.
Azure services
What each service does in the platform, and why it was chosen.
Swipe for more →
AKS, workload identity
One runtime for connectors, services and agents; Container Apps at pilot scale.
PostgreSQL Flexible Server
pgvector, Apache AGE and TimescaleDB in one database to validate.
Event Hubs (Kafka), Event Grid MQTT
Immutable event log; managed MQTT v5 for gateways.
Durable Task Scheduler
Checkpointed state graphs with recorded activity results.
Microsoft Foundry + API Management
Multi-model routing and governed MCP tools.
Microsoft Purview, Azure ABAC
Sensitivity labels in, attribute-based access out.
Immutable Blob, Confidential Ledger
WORM records and verifiable audit digests.
Entra ID, Key Vault Managed HSM
OIDC SSO, claims for policy, customer-managed keys.
Proof scenarios
Design partners test failure paths, not just happy paths. Each scenario has acceptance evidence an SME signs off.
Swipe for more →
Impending stock-out
Forecast assumptions, sensitivity and feasible replenishment options confirmed by a planner.
Excursion and quarantine
Exposure checked against approved criteria; hold and Quality escalation; never auto-release.
Blinding inference attack
A blinded CRA probes kit, supply and aggregate data; no arm is disclosed, directly or indirectly.
Conflicting documents
A superseded manual disagrees with the current one; the system abstains and escalates.
Vendor disagreement
IRT says available, depot says quarantined; status stays unreconciled until the source resolves it.
Write-back partial failure
Destination times out mid-command; idempotent retry, no double order, escalation.
Model regression
A new model is better on general QA but worse on dosing terms; the release is held.
Degraded mode
Model endpoint down while stock alerts fire; rules-only monitoring continues.
Validation-ready, improving under change control
Each sponsor validates for its intended use; Veridose supplies the evidence. Models in GxP paths do not learn online: decision records and outcomes feed offline improvements that ship as versioned, regression-tested releases.
Swipe for more →
Capture
Decision recordsRecommendation, the approver’s choice, edits and reason.
Link
OutcomesStock-outs avoided, kits wasted, transit times, dispositions.
Learn offline
Priors, lexicon, ontologyLane performance, new terms, corrected facts, new eval cases.
Release
Controlled releaseRegression-tested on domain evals and approved before any cell receives it; rollback ready.
21 CFR Part 11 and EU Annex 11 audit trails and e-signatures; validation evidence generated in CI following GAMP 5 and the ISPE GAMP AI guide. Draft EU GMP Annex 22 is under revision; EMA’s June 2026 workshop explored a technology-neutral, risk-based approach (source). Until it is final, generative AI stays out of GMP-critical decisions here.
Evaluating Veridose?
We share the full design, validation approach and security documentation with design partners and investors. See how partnerships work.