Case Study

MedTrust Agent — a governed LLM agent for medical workflows.

In regulated healthcare, a good answer is not enough — the system must prove who was allowed to ask, where the answer came from, and that the record can't be quietly changed. MedTrust Agent makes those properties testable. Peer-reviewed at NEECON 2026, Dubai.

Zero-TrustLLM AgentGraphRAGAI GovernanceHIPAANIST 800-207Tamper-Evident Audit

The problem

Clinical research, pharmacovigilance and regulatory-intelligence teams want LLM assistants that reason over trial metadata, adverse-event tables, drug labels and literature. Today's production assistants optimize answer quality alone — and are weak on exactly the properties regulators mandate (HIPAA, EU AI Act): access control, auditability, safety and operational visibility. There was no end-to-end architecture joining agentic AI, cybersecurity, zero trust, governance and observability into one platform whose safety properties are actually testable. MedTrust Agent closes that gap.

The architecture

Every request flows through five cooperating layers, in order: authorize → retrieve → govern → observe → answer. The key rule: no tool runs before authorization succeeds. High-risk actions such as exporting patient data require a valid step-up token; without it the request is denied and audited.

The five publication figures

Figure 1 — System Architecture

Figure 1 — System Architecture — Five cooperating layers: agent orchestration, zero-trust IAM, retrieval/grounding, governance, and cross-cutting observability.
Five cooperating layers: agent orchestration, zero-trust IAM, retrieval/grounding, governance, and cross-cutting observability.

Figure 2 — Request Sequence

Figure 2 — Request Sequence — Per-request control flow: authorize → retrieve → govern → observe, including step-up authorization and human-review escalation.
Per-request control flow: authorize → retrieve → govern → observe, including step-up authorization and human-review escalation.

Figure 3 — Module Mapping

Figure 3 — Module Mapping — How each medtrust/ module maps to a production engine in the VeritasGraph framework — the reuse path from research prototype to production.
How each medtrust/ module maps to a production engine in the VeritasGraph framework — the reuse path from research prototype to production.

Figure 4 — Threat Model

Figure 4 — Threat Model — Adversary vectors (privilege escalation, data exfiltration, destructive actions, audit tampering, prompt injection) and the control that blocks each one.
Adversary vectors (privilege escalation, data exfiltration, destructive actions, audit tampering, prompt injection) and the control that blocks each one.

Figure 5 — Results / Ablation

Figure 5 — Results / Ablation — Ablation across five configurations (B0 plain LLM → MT full MedTrust Agent), showing measured security gains and the illustrative quality track.
Ablation across five configurations (B0 plain LLM → MT full MedTrust Agent), showing measured security gains and the illustrative quality track.

Live dashboard

The rendered governance dashboard shows approved answers with citations, zero-trust denials, step-up authorization flows and the tamper-evident audit chain — as demonstrated live in the NEECON 2026 session.

MedTrust Agent governance dashboard: approved answers with citations, zero-trust denials, step-up authorization and audit chain

Results — measured, not claimed

100%
Unauthorized / high-risk actions blocked
Measured (Wilson 95% CI)
100%
Citations enforced on released answers
Measured
Detected in all cases
Audit tamper-evidence
Mutation / truncation / recompute / rollback
100%
One-shot prompt injection blocked
Measured
100%
IAM spec conformance (n=50)
False-denial rate 0%
Defeated in 3 rounds
Content filter alone (adaptive attacker)
Negative finding — reported openly

Honesty note: answer-accuracy figures in the paper are explicitly labelled illustrative (seeded model); all security results above are measured straight from the running code. The negative finding — a content filter alone defeated by an adaptive attacker — is reported openly, and is exactly why MedTrust composes the filter with IAM, grounding, mandatory citation and human review.

⭐ Reference implementation on GitHub🔬 All research