Securing an AI agent that approves medical requests.

ClearPath reviews prior-authorization requests: it auto-resolves clear approvals and sends every denial and uncertain case to a human reviewer. The whole point is that a human signs off on the hard decisions. The original build had no security layer at all, so before calling it production-ready I reviewed it the way an attacker would.

I started with a threat model: what is worth protecting, who can reach it, and where trust changes hands.

• Assets: case data (PHI in a real deployment), reviewer decisions and the audit trail, API keys and database credentials, the LLM budget, and the public MCP server.
• Actors: anonymous visitor, submitter, reviewer, admin, and an attacker trying injection, token forgery, IDOR, header spoofing and cost exhaustion.
• Trust boundaries: internet to app, app to the LLM (its output is untrusted), app to database, case text to prompt, and CI to cloud.

Identity and access

• Supabase Auth with every JWT verified locally (signature, expiry, audience, issuer; algorithm fixed by config, never taken from the token). Roles come from the database, never from token claims.
• Roles enforced on every endpoint and MCP tool: only the reviewer assigned to a case can approve or deny it. Admins can assign but cannot decide.
• Postgres row-level security under the API, with a least-privilege app role and an append-only audit log, so the database itself refuses cross-user reads, forged decisions and edits to the log.

Inputs, AI and cost

• Pydantic schemas with enums and length limits, unknown fields dropped (which closed the expected hole), a 64 KiB body cap and send-backs capped at 3.
• Prompt injection: untrusted case text fenced off from instructions, a deterministic tripwire that forces human review on instruction-like text, and schema-validated output. Denials can never be auto-finalized; the route is decided in Python, not by the model.
• Per-IP rate limits and a daily LLM call cap that fails closed, with the spend counter in Postgres.

Secrets, supply chain and recovery

• Keys moved to Google Secret Manager; the service runs as an account with no project roles.
• Hash-pinned dependencies, Dependabot, an SBOM, and seven scanners in CI on every push.
• Daily pg_dump to a private bucket by a create-only identity, with an automated restore test on every run.

• TOTP MFA for reviewers and admins (Supabase supports it; it needs an enrolment screen).
• Verify JWTs inside Postgres so the database stops trusting the app for identity.
• Self-host Langfuse or strip model rationales from traces before handling real PHI.