Talk to us
Health payors · Prior authorization

A prior-authorization routing agent, walked through one request

The short answer

A governed prior-authorization agent routes; it never approves or denies. It reads only the fields the routing rules need, applies a versioned rule set, sends the request to the right clinical reviewer queue and keeps the decision clock visible. Medical-necessity decisions stay with the clinical reviewer, and every routing choice can be traced to the rule that made it.

Illustrative case · invented data, not a customer’s

An expedited imaging request with a code the rules do not cover

A provider submits a prior-authorization request for cardiac imaging, marked expedited, with a diagnosis code, a procedure code and clinical notes. One of the diagnosis codes is not in the routing rule set.

  1. Agent prepares
  2. Control layer refuses
  3. Named person decides
  1. Person decides · Utilisation management intake

    The request is received and the clock starts

    The request is logged with its receipt time and its expedited flag. For payers covered by the CMS prior-authorization rule, an expedited request generally needs a decision within 72 hours and a standard one within seven calendar days.

  2. Agent prepares · Routing agent

    It reads only what routing needs

    The agent receives the diagnosis code, the procedure code, the plan and the urgency flag. It does not receive the full clinical notes, because the routing rules do not reference them.

  3. Agent prepares · Routing agent

    It applies the rule set and stops where the rules stop

    The procedure code maps to the cardiology reviewer queue under the current rule set. One diagnosis code matches no rule, so instead of guessing, the agent sends the request to the manual-review queue with the unmatched code named and the expedited deadline shown.

  4. Control layer · Control layer

    Clinical actions are out of reach

    Approve, deny and request-more-information are not tools this agent holds. Reading fields beyond the routing set needs an approved, logged grant.

  5. Person decides · Intake coordinator

    A person confirms the route

    The coordinator checks the unmatched code, confirms cardiology and releases the request to that queue inside the expedited window. The rule owner is told that the rule set has a gap.

  6. Person decides · Clinical reviewer

    The clinical reviewer decides

    The reviewer reads the full clinical notes and decides on medical necessity. A denial carries a specific reason, as the CMS rule requires of impacted payers.

The hard lines

What the agent cannot do

These are not instructions in a prompt. The actions are not tools the agent holds, so a request to use one fails and the attempt is recorded. A record with refusals in it shows the boundary held.

  • Approve a prior-authorization request
  • Deny a request
  • Read clinical notes the routing rules do not need
  • Change the routing rules
Six questions, answered once

The control answers for this agent

Who owns it?
The head of utilisation management, who can pause or stop it.
What risk tier?
Elevated: protected health information and a clinical decision downstream.
What can it reach?
The routing fields only: diagnosis and procedure codes, plan and urgency. More needs an approved, logged grant.
Where is the hard line?
No approve, deny or request-information actions, and no edits to the rule set.
Who decides?
An intake coordinator confirms exceptions; a clinical reviewer decides medical necessity.
What is kept?
Fields received, rule-set version, the matched rule, exceptions, the clock, the reviewer and the decision with its reason.
See it on your own process

From this walkthrough to your workflow

  1. 1

    Workflow diagnostic

    A short call comparing your current process with this one: where the evidence comes from, who decides, and where the time goes. No demo, no deck.

    Book a diagnostic
  2. 2

    Workflow-to-production workshop

    With your process owner and your risk or compliance reviewer in the room, map the agent, its boundaries and the evidence your reviewers will need.

    Governed AI agents workshop
  3. 3

    Paid production validation

    One agent on your data, in your cloud, measured against a baseline and success measures agreed before work starts. Results are reported as measured, not modelled.

Questions

Prior-auth routing, asked directly

Can an AI agent approve or deny prior authorization?

Not in a governed design. The agent routes the request to the right clinical reviewer; the medical-necessity decision stays with that reviewer, and the approve and deny actions are kept out of the agent’s reach.

What are the CMS prior-authorization decision timeframes?

Under the CMS Interoperability and Prior Authorization final rule (CMS-0057-F), impacted payers generally have to send decisions within 72 hours for expedited requests and seven calendar days for standard requests, beginning in 2026, and give a specific reason for a denial. QHP issuers on the federal exchanges are excluded from the timeframe requirement. Check the rule for your plan types.

How does minimum necessary apply to a routing agent?

Give it only the fields the routing rules reference. If a rule needs more of the clinical record, grant that field explicitly, log the access and record the justification, rather than handing the agent the whole record.

Is this a real patient request?

No. The request on this page is invented and contains no patient data. A walkthrough on your own process starts with a short workflow diagnostic.

Go deeper

Read the detail

Sources

Other walkthroughs: all four workflows.