Change proposals in FHIR: human review for AI-driven writes
Letting AI agents write directly to FHIR is risky. This pattern turns mutations into reviewable Bundle proposals, keeping a human in the loop before anything executes.
When an AI agent touches clinical data, read risk means disclosure, but write risk means a wrong mutation that someone downstream will later treat as ground truth. The post treats this as a problem infrastructure engineering already solved with Terraform's plan/apply split: emit a diffable, reviewable plan first, then execute only after human or policy approval. It describes a FHIR-native version of that pattern, where an agent never calls the write API directly. Instead it drafts a transaction Bundle representing the proposed changeset — creates and deletes as plain entries, updates expressed as FHIRPath Patch operations rather than full-resource PUTs — and persists that Bundle without executing it. When immediate review isn't possible, a Task resource wraps the Bundle as a human-facing review envelope; on approval, the server executes the whole Bundle atomically.
The key move is representational: the proposal lives in the same type system as the data it would change, which is what makes it renderable, diffable, deferrable and auditable. Five mechanisms carry the weight — the transaction's fixed DELETE→POST→PUT/PATCH execution order regardless of entry order, urn:uuid internal references that let not-yet-created resources be linked atomically, per-entry preconditions via ifMatch/ifNoneExist for version pinning and idempotent retries, self-describing metadata extensions that give reviewers a human-readable summary, rationale and evidence, and an expected-current-value check on high-stakes patches that catches drift between what the agent saw and what's actually stored. Critically, the Bundle is POSTed as a plain resource, not submitted to the transaction endpoint that would execute it — keeping proposal and execution structurally separate.
For engineers, the takeaway is that trustworthy AI-driven writes in healthcare systems shouldn't rely on natural-language explanations of intent, but on exposing the actual mutation as verifiable, diffable, revocable data. FHIR's existing transaction, Patch and Task machinery turns out to be well suited for building this kind of human-in-the-loop review without deviating from the standard.