AI and PHI data flow

The current AI provider abstraction is backed by Anthropic when configured.

The runtime:

1. resolves a scoped security context;
1. resolves an enabled AI capability;
1. enforces capability limits;
1. requires minimum-necessary context;
1. creates an authorization/context manifest;
1. calls the configured provider;
1. validates the output;
1. records only control metadata and hashes in the context manifest.

Known patient names are redacted in certain existing appeal-drafting paths before provider access.

Important boundary

Redaction is not de-identification.

The repository does not establish provider BAA status, retention terms, or external telemetry behavior. Those are contractual/deployment prerequisites.