Architecture

MedFlow runs on GraphFlow, a visual workflow engine described in our paper. GraphFlow traces its roots back more than three decades to TeamFlow, a business process mapping tool used by organizations like Ford, Boeing, Dolby, and Philips. MedFlow brings this proven approach to clinical care, combining visual workflows with AI automation designed for mission-critical reliability.

The idea at its center is simple: the care pathway diagram you draw is the specification that runs the automation. It is not a picture of a system that other code implements. The diagram is the source of truth, and the runtime behavior is derived from it, so a clinician can review a pathway and trust that what they approved is exactly what runs.

Diagram as specification

You author a blueprint in the diagram editor, and everything the runtime does is derived from it. To change what a pathway does, you change the diagram, not code buried underneath it. Because the diagram itself is the artifact people review, rather than some generated structure they have to take on faith, automation stays reviewable and drifts far less over time.

The three parts and the loop

Every Workflow combines a Trigger, a Diagram, and Metrics. Underneath, the engine runs them as a single loop, and all three share one data model.

Part	What it does	How it stays honest
Find	A cohort query selects patients or pathways by tags (`with` / `without`).	Cohort selection is explicit and auditable, not an implicit prompt, and the same query feeds both triggers and metrics.
Automate	A trigger starts one run for each member of the cohort, and the diagram executes its steps.	Swimlanes classify each step (clinic staff, EHR, patient, AI, or MedFlow runtime), which sets what is checked and what is recorded.
Validate	Metrics aggregate the same queries over time.	Monitoring reuses the same cohort model, so what you measure is what you acted on.

Because Find and Validate run on the same query infrastructure, you measure outcomes against the exact population the automation acted on.

Two guarantee modes

Not every pathway needs the same guarantees, so the engine separates what it can check before a run starts from what it enforces while the run is live.

Verified core, checked before it runs. A diagram that is acyclic and sequential can be compiled into a reusable automation with explicit requires and ensures contracts, and the engine checks composition so that one step’s guarantees satisfy the next step’s needs. These are the pieces that are safe to reuse across pathways.
Durable runtime, enforced while it runs. A full pathway can wait, retry, and loop. It runs on a durable engine that records every outcome to an append-only event log, so a run can be replayed for audit from that log instead of by calling external systems again.

Neither mode changes how you author. You draw one diagram, and the engine applies whichever guarantees that diagram qualifies for.

Boundaries and human judgment

Anything outside MedFlow’s own runtime, such as an EHR call, a human decision, or an AI suggestion, is a boundary, and swimlanes make those boundaries explicit on the diagram. The runtime treats each boundary outcome as an assumption: it records the outcome for replay and, where a guard is defined, checks it when the run reaches that step. Escalation is a first-class step, so a pause, an approval, or a reroute becomes a reviewable event rather than silent drift. Clinicians keep the judgment while the runtime executes the diagram and produces the audit trail.

Trust model

The trust boundaries are deliberate:

UI and AI are untrusted. They only propose changes and suggestions, and every change is authenticated, authorized, and audited before it takes effect.
The generator, verifier, and runtime are the trusted core. Artifacts are emitted only when the checks pass, and the runtime enforces isolation, durability, and audit logging.
External systems are untrusted. They are modeled as assumptions and guarded at runtime where possible.

Tenant and workspace isolation is enforced across both storage and execution, and secrets are resolved at runtime in least-privilege contexts, never embedded in generated artifacts. The design maps to the NIST SP 800-53 Moderate control families for guidance, not as a certification claim. See Security for the operational detail.