Fortified Enterprise Fleet · Live on Google Cloud
On day three, someone should ask whether the antibiotic is still right.
Day Three builds the local resistance picture a small hospital may not have, sleeps while nothing is due, then wakes at hour 48 with a source-grounded review for a licensed pharmacist.
The problem, in plain words
You arrive at a small hospital with an infection. Nobody knows yet which bacteria you have, because growing it in the lab takes about two days. So the doctor makes an educated guess and starts a powerful, broad antibiotic that kills many things at once. That guess is called empiric therapy.
Two days later the lab result comes back. Now everyone knows exactly which bacteria it is, and usually a narrower, cheaper, safer antibiotic would work better. Switching is called de-escalation.
At a large hospital, a specialist stewardship team may review a patient around day three and say "switch this one." Small and critical access hospitals often have less staff time and infectious-disease support, so that review can be delayed or missed.
The United States CDC says many critical access hospitals adapt antibiotic recommendations from nearby hospitals or regional collaboratives when local data or expertise are limited [5]. Day Three helps build a local evidence base.
Who this is for
Marta is a clearly labelled synthetic composite of a contract pharmacist at a 25-bed critical access hospital, hospital with limited infectious-disease support.
She covers this hospital two days a week and another one on Thursdays. She is not employed by either. She has never seen this hospital's own resistance patterns, because nobody has ever compiled them. She is not a real interviewed person; she represents the practitioner the system is designed to support. She is not a researcher, a product manager, or an executive. She is the person who would do this work if she had the time and the data, and she has neither.
The complete journey
Three jobs, one controlled handoff
A first-time user should understand what enters the system, what the agents do while unattended, and exactly where human authority resumes.
Build the missing picture
Scanned laboratory reports go in. The system reads them and assembles an antibiogram: a local grid of which antibiotics still work.
Register, then sleep
When a patient starts a guessed antibiotic, Course Watch registers its wake ladder for five weeks, then does nothing until an action is due.
Wake at hour 48
The agent checks the now-final result and drafts a narrower option only when the report supports it. Unsupported numbers are rejected.
Stop at the pharmacist
The pharmacist receives a reviewable draft and its evidence. The agent cannot prescribe, dose, approve, or change an order.
See the control boundary before running it
Google image and video models turn the workflow into a quiet visual preview: read, verify, wait, then stop for pharmacist review. The media contains no patient data, clinical values, drug names, or recommendation.
- Image
- Gemini 3.1 Flash Image
- Motion
- Veo 3.1 Fast
- Role
- Onboarding only; never clinical evidence
Interactive proof
Run the live workflow
Use the recommended order. The model readings are genuine recorded outputs; every state change below is executed live against the deployed service.
Recommended walkthrough: reset, load three reports, test the hidden instruction, admit the patient, advance the clock twice, ask the day-three question, then challenge the verifier. Disabled controls enforce that order.
Open judge evidenceGuided controls
Press three times to load three different organisms.
Hidden instructions are quarantined before any AI reads the page.
Every button explains what it will cause before you press it, and what happened afterwards.
Agent activity
The antibiogram
No reports ingested yet.
Each cell shows the percent of samples that were susceptible rather than resistant. Only the first sample per patient counts, and cells with fewer than 30 samples show no number at all.
What this does not do
It never prescribes. Every output is a draft recommendation that a licensed pharmacist must approve. The agent cannot change an order, and it never recommends a dose.
- All data here is synthetic. No real patient information is used at any point.
- Scope is deliberately narrow: whether the organism is susceptible to the drug. That is checkable against a laboratory result. Broader clinical judgement is not attempted.
- It is a screening aid, not a substitute for a laboratory's own reported antibiogram.
- It refuses to guess. If the culture has not finalised, it re-arms for hour 72 rather than speculating.
- No hospital, agency, or professional body endorses this project.
Evidence
Every number on this page is cited. We had no access to a practising rural pharmacist during the build, so instead of asserting that the clinical logic is right, we built to a published standard and made conformance checkable. See the conformance report.
- 4.71 million deaths were associated with bacterial antimicrobial resistance in 2021 and 1.14 million were attributable to it; the estimated 39.1 million attributable deaths are cumulative across 2025 to 2050. Naghavi et al., The Lancet, 2024, GRAM Project
- An in-depth evaluation covered 21 Iowa/Nebraska critical-access stewardship programs that self-identified possible Core Element gaps. Of 20 answering the barriers item, 15 cited limited time/personnel, 8 limited infectious-disease or stewardship expertise, and 5 electronic-record limitations. This selected sample is not national. Ryder et al.
- The US studies in one systematic review reported average stewardship savings of 732 US dollars per patient; this is evidence from the included studies, not a guaranteed result. Antimicrobial Resistance and Infection Control, systematic review
- One systematic review reported a mean 4.6-day reduction in length of stay after de-escalation, without increased mortality in the included studies. Systematic review and meta-analysis
- CDC says many critical access hospitals adapt treatment recommendations from nearby hospitals or regional collaboratives when local data or expertise are limited. CDC Core Elements for Small and Critical Access Hospitals
- CDC says that in most critical access hospitals a pharmacist, usually onsite, provides stewardship leadership. CDC Core Elements for Small and Critical Access Hospitals
- De-escalation is recommended at 48 to 72 hours based on clinical status and microbiology. PMC11776815
- Analysis of how unreliable susceptibility percentages become below 30 isolates. PMC9927543
- CDC's 2025 national update reports that 97% of acute-care hospitals reported all seven Core Elements in 2024, but only 16% reported all six newer implementation priorities. This is national self-reported survey context, not a critical-access-hospital rate. CDC, Antibiotic Use and Stewardship in the United States, 2025 Update
- In a CDC critical-access-hospital case example, an antibiogram was shared to show local resistance patterns and guide empiric therapy while an ID telehealth pharmacist prospectively reviewed new meropenem orders. It is one case example, not a universal outcome. CDC NHSN critical-access-hospital case example
- A 2024 process evaluation of a year-long cohort in 19 critical-access hospitals reported staffing shortages, turnover, and lack of bandwidth as implementation barriers; 17 hospitals collected local data, while none completed a full improvement cycle within the study year. Kassamali-Escobar et al., 2024
Research-to-design trace
Evidence changed the product, not just the pitch
| Verified finding | Implemented decision | Limit kept visible |
|---|---|---|
| Core Element adoption is high nationally, while full priority implementation is much lower. | Day Three says it supports execution depth; it does not claim these hospitals have no stewardship program. | National survey results are not presented as a rural or critical-access rate. |
| A CDC critical-access case paired a local antibiogram with prospective pharmacist review. | The workflow links cumulative local evidence to a timed, pharmacist-controlled review. | The agent prepares evidence and an escalation; it neither prescribes nor messages a clinician. |
| A recent 19-hospital cohort reported staffing, turnover, and bandwidth barriers. | Wakes are registered up front and idle cheaply; the interface preserves state across the review ladder. | The cohort is named and scoped; no national prevalence or product outcome is inferred. |
Architecture
Nine logical roles, each with one job, orchestrated inside one Cloud Run service through typed routes and durable Firestore state. Wakes, claims, checkpoints, and audit records are persisted; the roles are modular, not falsely presented as nine isolated services. Four public capabilities also live in Google Cloud's managed Agent Registry.
Four agents in Google Cloud Agent Registry
The public proof route queries the managed API using the Cloud Run identity. Inspect managed agents.
Daily openFDA shortage watch
A bounded refresh filters the national feed to six formulary drugs. It never substitutes for local inventory. Inspect source-dated snapshot.
| Agent | Job |
|---|---|
| Intake | Reads scanned culture reports into structured records. Anything it cannot quote exactly is dropped, never guessed. |
| Curator | Maintains the antibiogram to CLSI M39. Applies each report as a delta so you can see exactly which cells moved. |
| Course Watch | Owns one antibiotic course for about five weeks, sleeping between five decision points. |
| Shortage Watch | Refreshes official openFDA data at most once per day and filters it to the demo formulary. A pharmacist still verifies local inventory. |
| Reconciler | Compares the regimen against the identified organism, the local antibiogram, allergies and shortages. |
| Drafter | Writes the recommendation. Every sentence must carry a claim. |
| Verifier | Adversarial. Rejects any claim it cannot trace to the source document, and circuit breaks rather than looping. |
| Router | Prepares a pharmacist-review escalation and waits for sign off. Never sends or executes. |
| Registrar | Publishes four capabilities to Google Cloud Agent Registry and applies local scope policy before invoking supported capabilities. |
Built on Gemini 3.5 via Vertex AI with the GenAI SDK, running on Cloud Run with Firestore and Cloud Scheduler, traced with OpenTelemetry to Cloud Trace. A two layer redaction gate, deterministic patterns plus a Gemma name reviewer, strips identifiers before text reaches Gemini.
Questions a sceptic would ask
Is this safe? An AI deciding antibiotics sounds alarming.
It decides nothing. It drafts a recommendation and a licensed pharmacist approves or rejects it. Its scope is one narrow question with a checkable answer: is this organism susceptible to this drug, according to the laboratory result. It never recommends a dose.
How do I know it is not making things up?
A sentence cannot be displayed unless a separate Verifier agent traced its claim to a quoted line in the source document. Press Make the agent invent a number in the console above and watch a fabricated statistic get rejected in real time.
What if someone hides instructions inside a lab report?
Instruction-shaped text is quarantined before any model reads the document, and what was removed is shown to you rather than dropped silently. Even if a model were talked into a conclusion, it could not be displayed, because there would be no supporting quote.
Why does the clock jump?
Because a five week course does not fit in a four minute demonstration. The agents genuinely react to the time they are given, and the same scheduler code runs against real time in production. The clock is labelled as simulated everywhere it appears.
Did a real pharmacist review this?
No, and we say so plainly. Instead of claiming clinical review we could not obtain, we built to CLSI M39, published a line by line conformance report with the test that proves each rule, and validated the output against public reference data. A judge can check a published standard; they cannot check a private conversation.
Is the data real?
No. Everything is synthetic. Using real patient data would be both unnecessary and wrong for a demonstration.