Artificially Designed · Issue 21: Three Active Medications

Issue 21 · Three Active Medications

An agent can retrieve every record correctly and still get the meaning wrong, which makes it a data problem before it is an AI problem.

If this landed in spam or Promotions, drag it to your inbox and hit reply with one word. It tells your inbox this is mail you want, and it helps every issue after this one reach you.

Hi friend,

The last three issues were Design for Meaning, Design for Context and Design for Trust, and this week I want to show you how the three stack, starting with the data underneath all of them.

I used to think the hard part of trusting an AI agent was checking its answers. I still check them, but building Orinyx has moved the hard part upstream, to a question I skipped for too long. Does the agent know what the data it is reading means?

So this week starts with an old problem, garbage in and garbage out, and ends with why I am building Orinyx's bounty agents the way I am, including the knowledge graph I plan to build underneath them.

This week

🔨 Built Wrong, the acetaminophen miss that taught me to check meaning before answers, the knowledge graph I plan to build underneath Orinyx, and why the bounty agents are specialized investigators

⚡ One Slot, Obsidian, the record that keeps why every decision about my agents was made, and my verdict

🌎 In the News, Oracle and SAP both building a meaning layer for agents, and the AMA on who answers when clinical AI fails

✅ Before You Ship, the three-records test

💻 Prompt for Productivity, audit what your data means

🗓 Open Calls, my Claude Loves Lovable workshops with 100 Lovable credits, beta sign-ups for the Orinyx MCP, and four picks, an online conference, a Kansas City expo, a hackathon and a startup call

🔭 Next From Me, the official Orinyx release issue, with CHARM and the hardening agent

In October, Orinyx received a synthetic order for acetaminophen 1,500 mg every four hours. That is six doses, 9,000 mg in a day, and FDA's over-the-counter monograph for internal analgesics caps the adult limit at 4,000 mg in 24 hours. Orinyx missed the total. It lost the frequency somewhere along the way and still answered in reassuring language while its checking was incomplete. I published the miss instead of fixing it quietly, and what changed at Orinyx tells the rest of that story.

What I keep coming back to is where the miss happened. Nothing was invented, and the label text it checked was real. A piece of meaning was dropped, because "every four hours" has to be read as six doses before any limit can mean anything. I had built checks for the answer before I had settled what the data meant, and that is the order I got wrong.

The same failure turns up in a different costume. Picture a patient with three medication records, an active prescription, a historical administration of the same drug and a discontinued order for it. This is an illustration, not an incident. An agent can retrieve all three correctly and still read them as three active medications, because it never learned how each record's status and date relate to the others. The shape repeats outside healthcare, in an agent that confuses projected revenue with recognized revenue, one that treats a retired asset as operational, or one that counts two supplier identifiers as two companies.

A chatbot that misreads a record writes a wrong answer. An agent that misreads it can update a database, trigger a workflow or submit a transaction, so the ambiguity travels from a bad sentence to a bad action. That is why I no longer think an AI can be governed at the output alone. You have to govern what the data means, the decisions the AI makes, and the actions it is allowed to take.

Here is the whole stack as I think about it now, from fragmented data up to the person who keeps the authority, with the two layers Orinyx is building toward marked planned.

Layer two is where "active patient" and "approved expenditure" get a meaning someone can point to, and layer three connects those meanings across systems, so a program can follow links instead of matching text.

The decision. Orinyx plans to build a knowledge graph underneath its checks. It does not run on one today, I am giving no date, and the plan came out of research after the failures above, a matcher that turned ferrous gluconate into ferrous sulfate and a bare "metoprolol" that fits two different products. A graph that links an ingredient to its products, dose forms and label sections gives the checker a place to stop and say that two products fit, where a string match would quietly pick one. The longer version is on the Orinyx blog, including where the evidence stops.

A knowledge graph is not mandatory for every AI workflow, and a well-governed relational schema is sometimes enough. What is not optional is a reliable way to tell identities, meanings, relationships and sources apart. Connecting your data is a different job from making it understandable.

This stack is the thinking behind CHARM, the framework I named back in Issue 17 and have been building in the open, and I will lay it out properly next week. Orinyx is a separate, developer-facing product that sits inside that thinking, and today it is much narrower than the whole stack, because it checks medication orders against cited FDA label text. The broader architecture still needs empirical validation, and I would rather say that here than in a footnote.

Why the bounty agents are built the way they are. The bounty agents are a planned set of specialized investigators that arrive after the Orinyx MCP, and none of them ships with it. I never wanted one general-purpose checker that reads an answer and declares it correct, for four reasons.

A good output does not prove sound reasoning. An agent can reach a plausible answer through an unreliable reading of the data.

Verification has to be independent. The system that builds a checker should not be the only authority grading it. My own regression tests are useful, and stronger claims need independent evaluation by clinical or domain experts.

A verdict needs more than pass or fail. It needs traceable evidence, what failed, what is uncertain, and an honest abstain when the information is not enough.

Checking never ends. A model, a mapping, an API or a data source can change after you ship.

So each agent asks one narrow question: did it read the information correctly (semantic mapping), did it use the right evidence (source evidence), is the medication claim supported (medication claims), did it make an unsafe recommendation (patient message safety), can an unexpected input break it (adversarial testing), and have the definitions or mappings changed (mapping drift). Medication claims is the closest to done, because the MCP already checks medication orders against label text, and the rest arrive one at a time as each passes testing.

Underneath all of it is one rule. AI supports the decision and a person keeps the authority, so a finding says what failed and which evidence supports it, and it surfaces the exceptions worth a person's time.

Three moves came out of this, and none of them need Orinyx.

Write down what your status words mean. Active, complete and approved each need a definition and a named owner.

Give every identity one canonical ID. List its aliases beside it, so two names for one supplier or one drug stay one thing.

Test the meaning before you test the answer. If the reading is wrong, a correct-looking answer only hides it.

The One Slot Rule is that every job gets one slot, and a new tool has to take it from whatever holds it now. This week the slot is the record, and Obsidian already holds it.

What is the job. Keeping why a decision was made, for me and for every agent I run. I use Obsidian as a second brain and as the governance record for my agents. A governance agent registers every agent I build, with the tools it can use and the folders it may write to, and adds one line to an append-only audit log each time an agent is added or edited. A librarian agent files what the fleet produces and keeps the index and links honest. It is also why my newsletter's brand kit came back almost exactly after I deleted it by accident, because a note had recorded every color, font and size.

Can it do that job, not can it do more. The record, yes. Obsidian's graph view draws each note as a circle and each internal link as a line, and its documentation says nothing about typing those links, so it shows that two notes relate and not how. The typing lives in properties, which are fields on a note such as text, a date, a checkbox or a list, saved as YAML at the top of the file. That makes it a good record and a modest ontology, and it enforces nothing, because a note cannot stop an agent from doing something. The enforcement lives in the standards each agent has to meet and in me, because I approve the permission level of every agent myself.

What does it touch that is hard to undo. The vault syncs across my devices, and twice last week the disk filled up, iCloud evicted files and the sync stalled. Anything below a 5 GiB free-space floor is now read-only for agents, and none of them is allowed to run git inside the vault.

What would have to be true to let it run unwatched. The free-space floor holds, nothing runs git, and I apply any change to a rule myself.

My verdict is keeping it, with those two rules.

Three announcements from the last week, and two of them point at the same layer.

🧠 The meaning layer is showing up in the big platforms. Oracle announced a Business Semantic Layer for its autonomous AI lakehouse, meant to give users and AI agents consistent business context, and SAP announced an Ontology Manager that lets teams build domain-specific views of its Knowledge Graph for agents. Both are vendor announcements, and Oracle says its layer is coming within the next 12 months, so treat them as direction. What stays with me is the timing, two of the largest enterprise software companies on the same layer in the same week. Oracle's announcement and SAP's announcement

⚖️ Who answers when clinical AI fails? The AMA's Center for Digital Health and AI published an issue brief proposing that responsibility for clinical AI should match each party's authority, information access and ability to prevent harm. Physicians would answer for the clinical judgment they can exercise, developers for what they build, and deployers for how the AI is used. The AMA calls it a first contribution and announces no new policy, so read it as a framing and not a rule. Read it

Run the three-records test on one kind of record your AI reads, an order, an invoice, a supplier or a ticket. Write down every state it can be in, active, historical, discontinued, on hold, and for each one say where in your data that state lives and who decides it. If the answer is a free-text field, a naming habit or someone's memory, an agent will guess, and it will guess confidently.

If you can answer from the schema alone, you have a definition. If you need a person, you have a dependency, and the smallest fix is usually a status field with a short list of allowed values and an owner's name beside it.

Audit what your data means.

WHEN TO USE IT. Before you give an agent read access to any new data source, and include rows in every status, because a sample of only active records hides the problem.

WHAT IT DOES. It audits the meaning of your data instead of summarizing it, and it lists the five places an agent is most likely to guess wrong, each with the one question to ask the person who owns the data.

TIP. "Mark anything you could not judge as unknown" is the line that matters, because a model that fills a gap with a confident guess is doing the exact thing you are trying to catch.

From me

Starting Wednesday, November 4, 8:30 to 10am Central. Claude Loves Lovable, my hands-on workshop series with Central Exchange, where we build with Claude and Lovable, starting with a pitch deck this week. Four sessions are left, November 4, 11 and 18 plus an optional one on December 2, and registering for one covers all four, so please register only if you plan to attend live. Participants get a Lovable code for Pro Plan 1, which includes 100 credits at no cost during the event, and checkout may ask for payment details, with a month to cancel. It is virtual, no coding or prior Claude experience is needed, and it is free for Central Exchange members and $25 for non-members. Register through Central Exchange

Beta sign-ups are open. The Orinyx MCP, and I'm looking for beta testers. If you are building AI agents for healthcare, it checks the medication orders and claims your agent produces against FDA label text, cites the section it checked, and says plainly when it could not check at all. It is free for developers and runs on synthetic test data only, never real patient records. Join the Orinyx MCP waitlist

Four picks for the week

Monday and Tuesday, November 9 and 10, 11am to 5pm Central. Agentic AI Conference, Data Science Dojo's free two-day Zoom conference on agentic AI. Register

Tuesday, November 10, 4 to 8pm. KC AI Expo, in person at The Mint in Lenexa, with 30-plus exhibitors and no keynotes, $20 with a ticket. The organizer says the last one sold out. Get tickets

November 3 to 8. Vultr Agent Rush, an online build on lablab.ai with an AI agents theme, $200 in Vultr credits per participant, teams of one to six and prizes up to $15,000, with an on-site finish in Salt Lake City on November 8. See the details

Applications close November 9. MassChallenge 2026-2027 cycle, open to pre-seed through Series A companies worldwide, with healthcare among the industries, and a founder has to attend the in-person events in Boston. Apply

Tool verdicts, templates and reference material live on the site at charmthirteen.com.

That is the stack, and CHARM is how I hold it together. Next week is planned as the official Orinyx release issue. I will finally lay out CHARM, then show the hardening agent I built for my own workflow, the one I promised for this week, and the testing habits I want every Python script to meet.

Where in your data does one word mean two things, and who decides which one is right? Hit reply and tell me, because the answers shape what I test next.

Lex