Enterprise pharmacy operations platformTwo four-week delivery cycles. 28 rules codified across 7 pharmacy workflows. An AI copilot that explained every outcome with a citation, and never fabricated one.
Luveo Health builds an enterprise pharmacy operations platform: software that pharmacies use to manage inventory, track controlled substances, document waste and stay audit-ready across the overlapping regulatory frameworks that govern pharmacy practice.
Their customers operate under DEA controlled substance rules, DSCSA supply chain requirements, HIPAA, USP Chapter 797 sterile compounding standards and state Board of Pharmacy inspection regimes. Every one of those frameworks carries documentation requirements with real consequences for getting it wrong.
The platform already handled the operational workflows well. What it did not yet have was a compliance layer that could evaluate those workflows against the regulations governing them: automatically, consistently, and with an audit trail.
Before this engagement, compliance evaluation on the platform was effectively manual. The requirements existed in regulations, policy documents and staff training. What did not exist was anything that systematically checked an operational event against them before the record was committed. That created three specific exposures.
A receiving event could be recorded without a required field, and nothing in the system would stop it. The gap surfaced later, during an internal review or, worse, an inspection.
Where validation did exist, it produced technical output. A technician facing a failed event knew something was wrong but not which field, why it mattered or what to type. The default was to escalate to the pharmacist-in-charge, the most expensive resource in the pharmacy.
When an auditor asked how a compliance decision was reached, reconstructing the answer meant pulling records from multiple places and reasoning backward. The evidence existed. The chain did not.
The harder constraint: a conventional AI assistant could produce fluent guidance, and also fluent guidance that was wrong, cited a regulation that did not apply, or expressed confidence it had no grounding for. In pharmacy compliance, a confidently incorrect answer is worse than no answer, because someone will act on it.
The architecture separates two jobs that most AI implementations collapse into one.
Deterministic and versioned, producing a pass, warn or fail outcome with an immutable audit record. No probability is involved: given the same event and the same rule version, it returns the same outcome every time.
It does not evaluate compliance, interpret regulation or infer anything the rules engine has not already determined. Its scope is narrow by construction, and that narrowness is what makes it safe to deploy in a regulated environment.
Retrieving “DEA Form 222 is required for Schedule II” correctly and applying it to a Schedule III shipment is a reasoning failure, not a grounding failure, and citation alone does not catch it. Putting the classification logic in a deterministic engine removes that failure mode from the AI layer entirely.
The first cycle produced the deterministic foundation: an executable rule catalog covering the operational workflows where pharmacy compliance exposure concentrates.
Receiving · Movement · Waste · Audit · Expiration · Ordering · Credential.
Rule selection was driven by where real regulatory findings concentrate rather than breadth of coverage. The highest-value rules enforce field completeness, quantity reconciliation and documentation timing, before an event is committed.
Each rule produces a structured outcome recording which rule fired, against which event, at what time, with what result, and which regulatory provision it derived from.
Before any AI layer was connected, the engine was load-tested against production-representative traffic: 35 events per second sustained ingest, p95 latency of 2.9 seconds, with horizontal scale.
A correct outcome is not the same as a useful one. A technician facing a blocked receiving event needs to know what failed, why it matters and exactly what to do, in operator language, not regulatory language.
Every explanation follows the same seven-block structure, predictable for staff and straightforward for a reviewer to evaluate.
| Block | What it contains |
|---|---|
| 1 · Status banner | What happened, in 3 to 6 words |
| 2 · Plain-language summary | What failed, named in operator terms |
| 3 · Why this matters | The regulatory or operational context |
| 4 · What to do, right now | Concrete numbered steps |
| 5 · Edge case branch | The “if you cannot” path for the common stuck case |
| 6 · Provenance | Rule key, regulatory citation and audit record link |
| 7 · Feedback | Thumbs up or down, captured for knowledge base tuning |
Provenance is required on every response: the rule key, the regulatory source and the audit record. The copilot cites authority; it does not become authority. When grounding is weak, it states plainly that there is no clear playbook for the case.
Accuracy claims about AI systems are only as good as the evaluation behind them. The evaluation was structured for coverage rather than volume: 30 scenarios distributed deliberately across outcome types, with a Luveo reviewer scoring each response.
The scoring standard was operational, not “does it sound plausible”: would this explanation let a competent technician resolve the case without escalating to a pharmacist-in-charge or contacting support?
| Scenario group | Pass | Fail | Warning | Unknown | Total |
|---|---|---|---|---|---|
| Federal receiving rule 1 · Controlled substance receipt | 3 | 3 | 2 | 2 | 10 |
| Federal receiving rule 2 · Documentation completeness | 3 | 3 | 2 | 2 | 10 |
| State receiving rule · State Board of Pharmacy | 3 | 3 | 2 | 2 | 10 |
| All scenarios | 9 | 9 | 6 | 6 | 30 |
The Unknown column matters most. Those six scenarios were built so the correct behavior was to decline. A system that scores well on clear-cut questions and fabricates on ambiguous ones is not safe to deploy. Result: 97% on /explain, 100% on /chat, and zero hallucinated rule keys, fabricated citations, unauthorized write recommendations or guardrail violations.
“Compliance has always been the unglamorous, unavoidable cost of running a pharmacy. What DNAMIC built does not just automate that cost away. It turns it into a system our technicians can actually trust, because every recommendation traces back to a specific rule and a specific regulation.”
Anywhere AI sits on top of a process that already has a correct answer (a regulatory check, a billing requirement, a clinical protocol, a financial control) the same separation applies.
The same engine pattern applied to eligibility documentation and claim validation, evaluated before submission rather than after denial. Risk & Revenue Intelligence →
QMSR documentation completeness and MDR reportability determinations, with the same audit trail requirements and consequences. Compliance Intelligence →
The same governed explanation layer applied to institutional clinical documentation, surfacing evidence with citations while the decision stays with the clinician. Clinical Knowledge Systems →
If we can scope it into a four-week cycle, we’ll tell you exactly what it includes and what it costs. If we can’t, we’ll tell you that too.
Book a 30-minute scoping call →Hi. Ask me about our services, the four-week cycle, PHI and security, or the Luveo case study. Every answer links to where it comes from.