case study
Luveo Health: pharmacy compliance, running as code.
Two 4-week delivery cycles. 28 rules codified across 7 pharmacy workflows. An AI copilot that explained every outcome with a citation — and never fabricated one.
Client: Luveo Health, Enterprise Pharmacy Operations Platform · Frameworks: DEA, DSCSA, HIPAA, USP 797, State Board of Pharmacy · Delivered: 2026
28
COMPLIANCE RULES CODIFIED
7
PHARMACY WORKFLOWS COVERED
97%
EXPLANATION ACCURACY · 100% ON CHAT
0
FABRICATED CITATIONS
0 GUARDRAIL VIOLATIONS
35/sec
SUSTAINED EVENT INGEST UNDER LOAD TEST
2.9s
P95 LATENCY AT SCALE
30
SCENARIO STRUCTURED EVALUATION SET
2
FOUR-WEEK DELIVERY CYCLES
Luveao Health
Luveo Health builds an enterprise pharmacy operations platform — software that pharmacies use to manage inventory, track controlled substances, document waste, and stay audit-ready across the overlapping regulatory frameworks that govern pharmacy practice.
Their customers operate under DEA controlled substance rules, DSCSA supply chain requirements, HIPAA, USP Chapter 797 sterile compounding standards, and state Board of Pharmacy inspection regimes. Every one of those frameworks carries documentation requirements with real consequences for getting it wrong.
The platform already handled the operational workflows well. What it did not yet have was a compliance layer that could evaluate those workflows against the regulations governing them — automatically, consistently, and with an audit trail.
the challenge
Compliance that depended on people remembering.
Before this engagement, compliance evaluation on the platform was effectively manual. The requirements existed — in regulations, in policy documents, in the training pharmacy staff received. What did not exist was anything that systematically checked an operational event against those requirements before the record was committed.
That created three specific exposures.
THREE CHALLENGE BLOCKS
Requirements that lived outside the workflow
A receiving event could be recorded without a required field, and nothing in the system would stop it. The gap surfaced later — during an internal review, or worse, during an inspection.
Error codes that meant nothing to the person reading them
Where validation did exist, it produced technical output. A pharmacy technician facing a failed event knew something was wrong but not which field, why it mattered, or what to type. The default response was to escalate to the pharmacist-in-charge — whose time is the most expensive resource in the pharmacy.
An audit trail assembled after the fact
When an auditor asked how a compliance decision was reached, reconstructing the answer meant pulling records from multiple places and reasoning backward. The evidence existed. The chain did not.
THE HARDER CONSTRAINT
There was also a constraint that ruled out the obvious approach. A conventional AI assistant — documents indexed, language model on top — could produce fluent guidance. It could also produce fluent guidance that was wrong, cite a regulation that did not apply, or express confidence on a case it had no grounding for. In a pharmacy compliance context, a confidently incorrect answer is worse than no answer, because someone will act on it.
the approach
Deterministic first. AI second. Deliberately.
The architecture separates two jobs that most AI implementations collapse into one.
The rules engine determines what is compliant. It is deterministic, versioned, and produces a pass, warn, or fail outcome with an immutable audit record. No probability is involved. Given the same event and the same rule version, it returns the same outcome every time.
The AI copilot explains that outcome. It does not evaluate compliance, interpret regulation, or infer anything the rules engine has not already determined. Its scope is narrow by construction — and that narrowness is precisely what makes it safe to deploy in a regulated environment.
WHY THIS MATTERS
A conventional retrieval-plus-language-model system has no structural protection against a specific failure: two individually correct facts combined into an incorrect conclusion. Retrieving “DEA Form 222 is required for Schedule II” correctly and applying it to a Schedule III shipment is a reasoning failure, not a grounding failure — and citation alone does not catch it.
Putting the classification logic in a deterministic rules engine removes that failure mode from the AI layer entirely. By the time the copilot is involved, the determination has already been made and validated.
Cycle One
28 rules across 7 workflow families.
The first cycle produced the deterministic foundation: an executable rule catalog covering the operational workflows where pharmacy compliance exposure concentrates.
WORKFLOW LIST
Receiving
Receiving
Movement
Waste
Audit
Expiration
Ordering
Credential
Rule selection was driven by where real regulatory findings concentrate rather than by breadth of coverage. The highest-value rules are the ones that enforce field completeness, quantity reconciliation, and documentation timing — before an event is committed, not after an inspection surfaces the gap.
Each rule produces a structured outcome with an immutable audit record: which rule fired, against which event, at what time, with what result, and which regulatory provision it derived from.
VALIDATION
Before any AI layer was connected, the engine was load-tested against production-representative traffic: 35 events per second sustained ingest, with 95th-percentile latency of 2.9 seconds and horizontal scale delivery. The foundation was proven before anything was built on top of it.
Cycle Two
The engine produced correct outcomes. The copilot made them actionable.
A correct outcome is not the same as a useful one. A pharmacy technician facing a blocked receiving event needs to know what failed, why it matters, and exactly what to do — in operator language, not regulatory language.
The second cycle built that layer. Every explanation follows the same seven-block structure, which makes it predictable for staff and straightforward for a reviewer to evaluate.
THE NON-NEGOTIABLE
Provenance is required on every response: the rule key, the regulatory source, and the audit record. The copilot cites authority. It does not become authority. And when grounding is weak, it produces a calibrated fallback — stating plainly that there is no clear playbook for the case — rather than generating a confident answer it cannot support.
| Block | What it contains |
|---|---|
| Block 1Status banner | What it containsWhat happened, in 3 to 6 words |
| Block 2Plain-language summary | What it containsWhat failed, named in operator terms |
| Block 3Why this matters | What it containsThe regulatory or operational context |
| Block 4What to do, right now | What it containsConcrete numbered steps |
| Block 5Edge case branch | What it containsThe "if you cannot" path for the common stuck case |
| Block 6Provenance | What it containsRule key, regulatory citation, and audit record link |
| Block 7Feedback | What it containsThumbs up or down, captured for knowledge base tuning |
how it was validated
Thirty scenarios, scored by a human reviewer.
Accuracy claims about AI systems are only as good as the evaluation behind them. The Luveo evaluation was structured for coverage rather than volume: 30 scenarios distributed deliberately across outcome types, with a Luveo reviewer scoring each response.
EVALUATION DESIGN — see table below
THE MOST IMPORTANT ROW
The “unknown” scenarios are the ones that matter most. Those were cases deliberately constructed so the correct behavior was to decline — to produce the calibrated fallback rather than an answer. A system that scores well on clear-cut questions and fabricates on ambiguous ones is not safe to deploy. Testing for honest refusal was a first-class requirement, not an afterthought.
RESULTS
97% accuracy on /explain. 100% on /chat. Zero hallucinated rule keys. Zero fabricated regulatory citations. Zero unauthorized write recommendations. Zero guardrail violations.
THE SCORING STANDARD
Responses were not scored on whether they sounded plausible. The reviewer standard was operational: would this explanation enable a competent pharmacy technician to resolve this case without escalating to a pharmacist-in-charge or contacting support?
| Rule | Pass | Fail | Warning | Unknown | Total |
|---|---|---|---|---|---|
| Federal receiving rule 1 Controlled substance receipt | Pass3 | Fail3 | Warning2 | Unknown2 | Total10 |
| Federal receiving rule 2 Documentation completeness | Pass3 | Fail3 | Warning2 | Unknown2 | Total10 |
| State receiving rule State Board of Pharmacy | Pass3 | Fail3 | Warning2 | Unknown2 | Total30 |
“Compliance has always been the unglamorous, unavoidable cost of running a pharmacy. What DNAMIC built does not just automate that cost away — it turns it into a system our technicians can actually trust, because every recommendation traces back to a specific rule and a specific regulation.”
Chief Executive Officer, Luveo Health
What was delivered.
A deterministic rules engine codifying 28 rules across 7 pharmacy workflows Coverage spanning DEA, DSCSA, HIPAA, USP 797, and state Board of Pharmacy requirements Real-time evaluation of operational events before records are committed Immutable, timestamped audit records with full rule-level traceability
A governed AI copilot producing cited, plain-language guidance on every rule outcome
A 30-scenario regression evaluation suite that carries forward into future development
Zero-tolerance guardrails, tested rather than asserted
A production deployment with a written roadmap for expanding coverage
WHAT THIS MEANS BEYOND PHARMACY
The regulations change. The architecture does not.
Pharmacy compliance is a specific domain. The pattern underneath it is not.
Anywhere an organization is layering AI on top of a process that already has a correct answer — a regulatory check, a billing requirement, a documented clinical protocol, a financial control — the same separation applies. Let deterministic logic own the determination. Let AI own the explanation. Never let the second job quietly absorb the first.
THREE ADJACENT APPLICATIONS
-
Medicaid redetermination and managed care billing
The same engine pattern applied to eligibility documentation and claim validation, evaluated before submission rather than after denial.
-
Medical device quality and adverse event reporting
QMSR documentation completeness and MDR reportability determinations, with the same audit trail requirements and the same consequences for getting it wrong.
-
Clinical protocol and guideline retrieval
The same governed explanation layer applied to institutional clinical documentation — surfacing evidence with citations while leaving the decision to the clinician.
Bring us one workflow. We will tell you what four weeks looks like.
Thirty minutes. Three questions: which workflow carries the most regulatory exposure, what systems hold the data behind it, and what would have to be true for you to consider it solved. If we can scope it into a cycle, we will tell you exactly what that includes and what it costs. If we cannot, we will tell you that too.