On day three, someone should ask whether the antibiotic is still right.
Day Three builds the local resistance picture a small hospital may not
have, sleeps while nothing is due, then wakes at hour 48 with a source-grounded review
for a licensed pharmacist.
The walkthrough needs no key. To send your own reports, take a seven-day sandbox key — no account, no invitation — or inspect the API docs.
Synthetic data onlyHuman approval requiredEvery claim source checked
39.1 millionestimated cumulative deaths attributable to antimicrobial resistance across 2025 to 2050 [1]
8 of 20respondents cited limited infectious-disease or
stewardship expertise in one selected 21-program evaluation [2]
$732average saving per patient across the US studies in one stewardship review [3]
4.6 daysmean stay reduction reported by one de-escalation review [4]
The problem, in plain words
You arrive at a small hospital with an infection. Nobody knows yet which bacteria you have,
because growing it in the lab takes about two days. So the doctor makes an educated guess and
starts a powerful, broad antibiotic that kills many things at once. That guess is called
empiric therapy.
Two days later the lab result comes back. Now everyone knows exactly which bacteria it is,
and usually a narrower, cheaper, safer antibiotic would work better. Switching is called
de-escalation.
At a large hospital, a specialist stewardship team may review a patient around day three and
say "switch this one." Small and critical access hospitals often have less staff time and
infectious-disease support, so that review can be delayed or missed.
The United States CDC says many critical access hospitals adapt antibiotic
recommendations from nearby hospitals or regional collaboratives when local data or
expertise are limited [5]. Day Three helps build a local evidence base.
Who this is for
Marta is a clearly labelled synthetic composite of a contract pharmacist at a 25-bed
critical access hospital,
hospital with limited infectious-disease support.
She covers this hospital two days a week and another one on Thursdays. She is not employed by
either. She has never seen this hospital's own resistance patterns, because nobody has ever
compiled them. She is not a real interviewed person; she represents the practitioner the
system is designed to support. She is not a researcher, a product manager, or an executive. She is the person
who would do this work if she had the time and the data, and she has neither.
The complete journey
Three jobs, one controlled handoff
A first-time user should understand what enters the system, what the agents
do while unattended, and exactly where human authority resumes.
Step 01 · Read
Build the missing picture
Scanned laboratory reports go in. The system reads them and assembles an
antibiogram:
a local grid of which antibiotics still work.
Step 02 · Schedule
Register, then sleep
When a patient starts a guessed antibiotic, Course Watch registers its
wake ladder
through day 14, then does nothing until an action is due.
Step 03 · Review
Wake at hour 48
The agent checks the now-final result and drafts a narrower option only when the report
supports it. Unsupported numbers are rejected.
Step 04 · Hand off
Stop at the pharmacist
The pharmacist receives a reviewable draft and its evidence. The agent cannot prescribe,
dose, approve, or change an order.
Optional first-use briefing
See the control boundary before running it
Google image and video models turn the workflow into a quiet visual preview: read,
verify, wait, then stop for pharmacist review. The media contains no patient data,
clinical values, drug names, or recommendation.
Clock:loadingSimulated. Production uses the same scheduler in real time.
Guided run
Complete the four steps from left to right. Only the current step opens.
4 steps
1. PrepareCurrent
Clear prior demo state, then begin.
2. Build evidenceUpcoming
Repeat until all three organisms are loaded.
Instruction-shaped lines are quarantined before AI.
3. Wake the courseUpcoming
Advances to day 15. The remaining reviews fire in order and the course closes itself.
4. Review and challengeUpcoming
Also try
A second patient whose culture never came back: press twice and it
books one recheck, then refuses another. Discharge cancels the reviews that no longer
apply and arms a readmission check.
Each action reports what happened in Agent activity.
Agent activity
system
Ready. Press
Reset demo to begin.
The antibiogram
No reports ingested yet.
Inspect the full matrix
Percent of samples susceptible, with drugs in rows and organisms in columns
Percent susceptible,
not resistant.
First sample per patient only.
Fewer than 30 samples: no percentage.
Check it yourself
Three things you shouldn't take on trust.
The walkthrough uses a saved AI answer and a fast-forwarded clock, and says so on screen.
That is fair to be sceptical about. So here are all three, for real, right now.
1. Watch the AI read a page
We hand Google's AI a photo of a lab report — just the picture, with no text to
copy from — and score what it reads against the correct answers. It is scored
exactly the way we scored the reading we published, which got 29 of 29 right.
Gemini 3.5 Flash on Vertex AI. Image only, no source text, graded by
the same code as the published run.
Checking how many checks are left today.
Takes 20 to 30 seconds, because it is reading a picture rather than
answering from text.
It reads a fixed sample so the score on screen is checkable, and
a page with no login is no place for real patient records. To send your own report, take
a key on the developer page. Free to use, with a shared daily
limit, and it never touches the results table.
2. Make it wake up on its own
The walkthrough fast-forwards a two-week schedule into a few clicks. This does not. It
books a job for one minute from now, and nothing on this page can move it
— only real time passing, and a background service that checks once a minute.
A real-clock wake in its own project space, claimed by the
every-minute Cloud Scheduler job, never by the demo clock.
Nothing booked yet.
You can close this page and come back. It records when it was
booked, when it ran, and which machine ran it.
3. Try to call an agent you are not allowed to call
Day Three's agents are catalogued centrally so other departments can find them. Finding
one is not permission to run it. Press the first button as Infection Prevention with no
granted scope, then press the second with the scope it should have had.
Live calls to the managed Agent Registry. Both attempts are written to
an audit record, including the one that was refused.
This is the boundary a hospital would ask about first: not whether
an agent works, but who is allowed to make it work, and whether the refusal was recorded.
Use it beyond the demo
A bounded integration API, explained before credentials.
The public workflow is the fastest way to evaluate Day Three. The API is an optional deidentified beta for approved integrations.
No credentials
Evaluate publicly
Run the synthetic hospital workflow, observe the hour-48 wake, and inspect grounded pharmacist-review output.
API boundary: deliberately deidentified microbiology text only. No prescribing, ordering, dosing, paging, or chart mutation.
What this does not do
It never prescribes. Every output is a draft recommendation that a licensed pharmacist
must approve. The agent cannot change an order, and it never recommends a dose.
All data here is synthetic. No real patient information is used at any point.
Scope is deliberately narrow: whether the organism is susceptible to the drug. That is
checkable against a laboratory result. Broader clinical judgement is not attempted.
It is a screening aid, not a substitute for a laboratory's own reported antibiogram.
It refuses to guess. If the culture has not finalised, it re-arms for hour 72 rather
than speculating.
No hospital, agency, or professional body endorses this project.
Evidence
Auditable researchEvidence
11 cited sources and the product decisions they shaped
View evidenceHide evidence
Every number on this page is cited. We had no access to a practising rural
pharmacist during the build, so instead of asserting that the clinical logic is right, we built to
a published standard and made conformance checkable. See
the conformance report.
4.71 million deaths were associated with bacterial antimicrobial resistance in
2021 and 1.14 million were attributable to it; the estimated 39.1 million attributable deaths
are cumulative across 2025 to 2050.
Naghavi et al., The Lancet, 2024, GRAM Project
An in-depth evaluation covered 21 Iowa/Nebraska critical-access stewardship
programs that self-identified possible Core Element gaps. Of 20 answering the barriers
item, 15 cited limited time/personnel, 8 limited infectious-disease or stewardship
expertise, and 5 electronic-record limitations. This selected sample is not national.
Ryder et al.
One systematic review reported a mean 4.6-day reduction in length of stay after
de-escalation, without increased mortality in the included studies.
Systematic review and meta-analysis
De-escalation is recommended at 48 to 72 hours based on clinical status and microbiology.
PMC11776815
Analysis of how unreliable susceptibility percentages become below 30 isolates.
PMC9927543
CDC's 2025 national update reports that 97% of acute-care hospitals
reported all seven Core Elements in 2024, but only 16% reported all six newer implementation
priorities. This is national self-reported survey context, not a critical-access-hospital rate.
CDC,
Antibiotic Use and Stewardship in the United States, 2025 Update
In a CDC critical-access-hospital case example, an antibiogram was shared to
show local resistance patterns and guide empiric therapy while an ID telehealth pharmacist
prospectively reviewed new meropenem orders. It is one case example, not a universal outcome.
CDC NHSN
critical-access-hospital case example
A 2024 process evaluation of a year-long cohort in 19 critical-access
hospitals reported staffing shortages, turnover, and lack of bandwidth as implementation
barriers; 17 hospitals collected local data, while none completed a full improvement cycle
within the study year.
Kassamali-Escobar et al.,
2024
Research-to-design trace
Evidence changed the product, not just the pitch
Verified finding
Implemented decision
Limit kept visible
Core Element adoption is high nationally, while full priority implementation is much lower.
Day Three says it supports execution depth; it does not claim these hospitals have no stewardship program.
National survey results are not presented as a rural or critical-access rate.
A CDC critical-access case paired a local antibiogram with prospective pharmacist review.
The workflow links cumulative local evidence to a timed, pharmacist-controlled review.
The agent prepares evidence and an escalation; it neither prescribes nor messages a clinician.
A recent 19-hospital cohort reported staffing, turnover, and bandwidth barriers.
Wakes are registered up front and idle cheaply; the interface preserves state across the review ladder.
The cohort is named and scoped; no national prevalence or product outcome is inferred.
Architecture
Nine logical roles, each with one job, orchestrated inside one Cloud Run service through
typed routes and durable Firestore state. Wakes, claims, checkpoints, and audit records are
persisted; the roles are modular, not falsely presented as nine isolated services. Four
public capabilities and four Runtime projections produce eight entries in Google Cloud
Agent Registry. Four Runtime resources use distinct Agent Identities and one Gateway. A
bounded Memory Bank handoff preserves deidentified context between sessions while
Firestore remains authoritative.
InputsRecorded synthetic scansCulture reports and a synthetic antibiotic course
→
Cloud Run · day-three
Nine bounded roles on the shared spineRedaction, intake, curation, shortage watch, wakes, reconciliation, verification, routing, registry
→
Durable proofFirestore, Memory Bank, and Cloud TraceAuthoritative state, deidentified handoffs, audit records, and trace identifiers
Managed discovery plane
Eight entries in Agent Registry
Four REST capabilities plus four Runtime projections are read from the managed API. Inspect managed agents.
Managed execution controls
Runtime, Identity, Gateway, and Armor
Four distinct runtime identities share one governed ingress, with two regional Model Armor templates. Inspect live platform proof.
Cross-session context
Bounded Memory Bank handoff
Exact-scope memory carries no patient identifier or raw report. Firestore remains authoritative. Inspect managed memory.
Official operational data
Daily openFDA shortage watch
A bounded refresh filters the national feed to six formulary drugs. It never substitutes for local inventory. Inspect source-dated snapshot.
Agent
Job
Intake
Reads scanned culture reports into structured records. Anything it cannot quote exactly is dropped, never guessed.
Curator
Maintains the antibiogram to CLSI M39. Applies each report as a delta so you can see exactly which cells moved.
Course Watch
Owns one course across five scheduled inpatient decisions through day 14. A discharge transition can arm a separate 30-day readmission check.
Shortage Watch
Refreshes official openFDA data at most once per day and filters it to the demo formulary. A pharmacist still verifies local inventory.
Reconciler
Compares the regimen against the identified organism, the local antibiogram, allergies and shortages.
Drafter
Writes the recommendation. Every sentence must carry a claim.
Verifier
Adversarial. Rejects any claim it cannot trace to the source document, and circuit breaks rather than looping.
Router
Prepares a pharmacist-review escalation and waits for sign off. Never sends or executes.
Registrar
Publishes four capabilities to Google Cloud Agent Registry and applies local scope policy before invoking supported capabilities.
Built on Gemini 3.5 via Vertex AI with the
GenAI SDK, running on Cloud Run with Firestore and Cloud Scheduler, traced with
OpenTelemetry to Cloud Trace. A two layer redaction gate, deterministic patterns plus a
Gemma name reviewer, strips identifiers before text reaches Gemini.
Questions a sceptic would ask
Is this safe? An AI deciding antibiotics sounds alarming.
It decides nothing. It drafts a recommendation and a licensed pharmacist approves or rejects it.
Its scope is one narrow question with a checkable answer: is this organism susceptible to this
drug, according to the laboratory result. It never recommends a dose.
How do I know it is not making things up?
A sentence cannot be displayed unless a separate Verifier agent traced its claim to a quoted
line in the source document. Press Make the agent invent a number in the console above and
watch a fabricated statistic get rejected in real time.
What if someone hides instructions inside a lab report?
Instruction-shaped text is quarantined before any model reads the document, and what was removed
is shown to you rather than dropped silently. Even if a model were talked into a conclusion, it
could not be displayed, because there would be no supporting quote.
Why does the clock jump?
Because a multi-week course does not fit in a four minute demonstration. The agents genuinely
react to the time they are given, and the same scheduler code runs against real time in
production. The clock is labelled as simulated everywhere it appears.
Did a real pharmacist review this?
No, and we say so plainly. Instead of claiming clinical review we could not obtain, we built to
CLSI M39, published a line by line conformance report with the test that
proves each rule, and validated the output against public reference data. A judge can check a
published standard; they cannot check a private conversation.
Is the data real?
No. Everything is synthetic. Using real patient data would be both unnecessary and wrong for a
demonstration.
