Operations Portal
In plain English.
The day-to-day operations of our site, mostly on autopilot — so the team handles the exceptions, not the busywork.
The honest version: most repetitive work a coordinator, recruiter, or finance person used to do by hand now happens automatically, with safety checks that catch mistakes. The rest of this deck is the detail behind each of these.
Four production surfaces.
Each serves a distinct audience. All share one BigQuery dataset and one component library.
Unified operations dashboard
Recruitment, schedule, leads, comms, study performance, and study management. Backed by BigQuery views and the CRIO API.
Finance dashboard
The 4-layer revenue & receivables platform — data-health → revenue validation → per-study margin → collections — over the dollar-journey reconciliation spine. Per-study margin (contribution + fully-loaded), invoicing, and CRIO write-back for payments, invoices & reconciliation (live); mark-paid write-back is built and validated in test, not yet enabled in production. Gated to finance and leadership.
Patient-facing site & landing pages
Study browse, eligibility intake, and scheduling for pre-screening (Lp(a), FibroScan).
Provider portal
Direct-from-clinic ordering for Lp(a) and FibroScan, fax-back referrals, and a study list with eligibility criteria.
Live counts · June 2026.
The current footprint, derivable from live deployments.
A morning in the dashboard.
Twelve automated actions, 6am–noon, typical weekday. At most sites each one would need a human.
External systems we read from and write to.
CRIO upstream. BigQuery canonical. Other vendors handle channels.
| System | Role | Read access | Write access | Notes |
|---|---|---|---|---|
| CRIO source | EDC / clinical | REST API · webhooks · Fivetran CDC | PUT (allowlisted) + UI writer | Patient, study, visit, appointment, action-type. Finance (payments/invoices/mark-paid) via a Computer-Use browser writer — no finance API. Site-scoped. |
| BigQuery store | analytics store | SQL views | scheduled loads & mat. views | Canonical dataset behind every dashboard. |
| Telnyx channel | SMS · fax | delivery webhooks | send SMS · send/receive fax | Outbound SMS through one chokepoint · DNC + throttle + quiet window. |
| Google Voice source | voicemail intake | poll / transcript fetch | — | Voicemail triage. Claude classifies + auto-routes. Every 10 min · M–F. |
| GCS store | binary blob storage | signed URLs | agent uploads | Fax media + scraper artefacts. Replaced Firestore for binaries. |
| Tremendous channel | payments | order-status webhook | issue rewards (Visa) | Patient stipends and Lp(a) early-payment flow. |
| SignWell channel | e-signature | completion webhook | create signature requests | Consent capture · webhook updates the patient's consent status. |
| Gmail · Google APIs channel | email · drive | DWD service account | send email · drive writes | Outbound patient comms (queue-gated) and finance-direct mail. |
| JotForm source | intake | webhook endpoint | — | Single endpoint for form intake. |
| GitHub Actions infra | CI/CD | repo | deploy to Cloud Run · Firebase | Auto-deploy on push to main. |
How the portal is hosted, secured, and observed.
For integrations, audits, and incident response.
Hosting & deploy
- Cloud Run + IAP for internal · Firebase Hosting for public.
- Auto-deploy on push to main via GitHub Actions.
- Rollback is a single revert.
Data & storage
- BigQuery for analytics · Firestore for stateful records.
- No spreadsheet data store. Ever.
- Cross-system reconciliation in the validation harness.
Security & observability
- IT security: 14 monitoring sections · auto-suspend every 15 min · owner digest 8am ET (suppress-empty).
- Langfuse for agent tracing.
- Daily finance digest 7am ET · 11 checks.
Single source of truth for everything that runs without a human.
Agents, rules, and routines — inventoried in one tab. This slide mirrors it.
Production agents 12
- No-Show Risk ScorerDaily 6am ET
- Recruitment Manager30 min · M–F
- Finance ManagerDaily 7am ET
- Dollar Journey DigestDaily 7am ET
- Comms QA ReviewerPer comm
- Eligibility MatcherPer submission
- Fax Classifier (Telnyx + Claude)30 min
- Undocumented Cancel AlerterOn-demand
- eSource QC (full workflow)Engine 6am · digest 7am ET
- Voicemail TriageEvery 10 min · 7a–9p M–F
- CRIO Writer (Computer Use)Approval queue · payments/invoices
- AI Voice Caller (Telnyx)Dark · speed-to-lead pre-screen
Active rules 6 sets
- Eligibility Rulesaudited weekly
- SMS GuardrailsDNC + throttle
- Comms QAbrand · tone · template
- Locked Tabs (RBAC)4 layers
- eSource QC Rule Library17 rules · 41 citations
+ 1 more
Scheduled routines key · of ~91
- eSource QC EngineDaily 6am ET
- eSource QC Digest → ops@Daily 7am ET
- Alert Router Resolution SweepEvery 30 min
- Voicemail Classify + RouteEvery 10 min · M–F
- Dollar Journey Daily DigestDaily 7am
- Recruitment Manager Weekly ReviewSun 9am · weekly
+ 5 more
Three layers, two flow patterns.
Sources above, surfaces below. The core in the middle is where logic, automation, and audit live.
One design system. Every surface — including this deck.
One visual language across all four surfaces. A private repo, git-submoduled into every property.
#072061#1843AD#A2DCEB#FF9933#b35900#f0f4faInter + Market Pro
Inter — body and UI on every surface, weights 200–800.
Market Pro — handwritten accent, always orange, sparingly. Landing-page hero · Lp(a) cards.
23 helpers
Chips, buttons, KPI tiles, badges, flags, action rows, panels, and more — one helper per component.
Object args, schema-validated. Every helper emits a tagged marker for lint + audit.
Logos, gradients, motion
Two gradients for hero treatments (navy→blue, orange→navy). Logo lockups + favicons + email-shell templates centralised in the same repo.
Email + SMS render against the same tokens; this presentation does too.
Six rules for using it consistently.
The contract for using it. Every visible element obeys these rules.
Tagged elements only
Every visible element carries a design-system marker. Drives lint, audit, debug overlay.
Helpers only — never hand-rolled HTML
No raw component markup anywhere. Object args, schema-validated. The 23 helpers are inventoried on the previous slide.
Lint enforces the contract
Three lint rules + headless CI audit. Coverage floor 80%, rising to 100%.
WCAG AA contrast everywhere
Two oranges: text-orange for type + buttons (AA contrast), decoration-orange for accents. Never mixed.
Coverage rises, never falls
Floor starts at 80%, ratchets to 100% as modules retrofit. CI fails below the floor. Legacy is grandfathered with an expiring annotation.
Inter for body. Market Pro only as accent.
Hand-drawn warmth, orange-only, never for body copy.
Six rules that keep the system safe and honest.
Constitutional principles. Every agent, chokepoint, and audit trail honours them.
Two places, one truth
One source-of-truth per fact. Four lint tripwires enforce it.
Chokepoint pattern
Every mutating action funnels through one function with default-on safety guards: DNC, throttle, kill switch, idempotency.
CRIO is observed, never written without evidence
Read-only by default. Trait writes are blank-fill only; coordinator data is authoritative. The finance write-back bot reads back every write and confirms storage == intent before reporting success.
Bank deposit is the only trusted financial event
CRIO has no financial-write API. We reconcile against the deposit, never CRIO claims.
LLM is a narrator, not an actor
Schema-validated outputs cite subject, visit, and evidence row. Severity capped by ground-truth tier.
Append-only audit · auto-pause on drift
Every action logged (21 CFR Part 11). Auto-pause on 3σ findings spike.
39 users · 8 roles · default-deny RBAC.
Every staff member has a role; every role has a fixed tab list. 4-layer default-deny. Unassigned staff are blocked.
| Role | Users | Tabs visible |
|---|---|---|
| admin | 1 | 11 (incl. leadership + admin) |
| leadership | 4 | 9 (operational + leadership) |
| finance | 2 | 4 finance-only |
| ops | 7 | 7 operational |
| coordinator | 7 | 7 operational |
| recruiter | 5 | 7 operational |
| investigator | 11 | 4 investigator-scoped |
| readonly | 2 | 3 minimal |
Four themes that anchor the next phase.
The dashboard is the foundation. Four bets build on top — each compounds the others.
Magic
Agent-orchestrated patient qualification, end to end.
- Five manual handoffs and ~60% candidate leakage compressed into one pipeline
- 9 phases · 6 shipped · 3 in flight. HIE / lab recon = Phase 3 roadmap.
- Foundation for enrollment-as-a-service
Plug-and-play
Backend-once, frontend-anywhere — multi-site by construction.
- Same data layer + agent fleet + chokepoints feed any site
- Logo in → design system out, generated automatically
- New site: minutes, not months
AI-native query
Natural language over the unified data model.
- "How is enrollment trending for Sponsor X this quarter?" → answer in seconds
- Reads across CRIO, ClickUp, finance, comms, audit log in one prompt
- Conversation-as-UI replaces dashboard-as-UI for the long tail
Sponsor portfolio
The same data, a sponsor's questions — cross-site, cross-study.
- Enrollment trajectory · recruitment health · regulatory posture
- First commercial-facing surface for sponsor / CRO partners
- One sponsor = many sites · sponsor-owned access scope
Three pillars, nine asks.
Each ask is grounded in a postmortem or workaround. Platform changes that would let us delete compensating code.
Make the platform refuse what shouldn't happen.
Server-side subject status state machine
Reject regressions like ENROLLED → INTERESTED at the API layer.
Trait-write protection for completed visits
Refuse trait, medication, or history overwrites for any patient with a completed visit; allow blank-fill only.
Strict enum errors that name the rejected value
Return "actionType=INVALID not in enum" instead of "actionType is required."
Promote the entities we work with daily.
Sponsor · CRO · enrollment target as entities
Structured fields on the study record, not free-text in notes.
Test-vs-production patient flag
Boolean on the patient record, respected by every read and aggregate.
Curated tables — consent versions · IP canon · visit windows
Read-write API replacing "only-in-PDF" as the source of truth.
Close the gaps we hit in the read/write paths.
Subject-level mutation endpoint
A direct PUT /subject/{id} instead of burying status updates inside studies[] on Patient PUT.
Bulk write + idempotency keys
Batch N records per call; client-supplied idempotency token for safe retry.
Document content access
API surface for subject-document file bytes, not just metadata.
One patient, traced end-to-end.
A real flow. Each step touches a different integration; agents fill the gaps.
Glossary.
Abbreviations used above.
Cloud, data & AI
- BigQuery (BQ)
- Google's data warehouse. The canonical analytics store behind every dashboard.
- Cloud Run · Cloud Function
- Google's serverless platforms. Cloud Run hosts auth-gated dashboards; Cloud Functions power agent loops + webhooks.
- Firestore
- Google NoSQL document DB with point-in-time recovery. Holds visit confirmations, audit log, agent state.
- Fivetran
- Managed ETL service. Syncs CRIO → BigQuery every ~15 min.
- Claude · Langfuse
- Anthropic's LLM (the model under every agent) and the observability layer that traces every prompt + response.
- Design-system helpers
- Shared helper library — 23 helpers consumed by every CRP surface.
Security & compliance
- RBAC
- Role-Based Access Control. Determines which dashboard tabs each staff member can see.
- IAP · DWD
- Identity-Aware Proxy (Google Cloud auth gate). Domain-Wide Delegation (Workspace service-account auth on behalf of users).
- HIPAA · 21 CFR Part 11
- US patient-privacy regulation · FDA rule on electronic records (audit-trail requirement for clinical trials).
- HMAC · 3σ
- Cryptographic check that a webhook payload wasn't forged · three standard deviations from mean (auto-pause threshold).
- gitleaks · Semgrep · Checkov · SBOM
- Pre-commit secret scanner · static-analysis security scanner · IaC config scanner · Software Bill of Materials (dependency manifest).
- CODEOWNERS · ALCOA+
- Git enforcement of required reviewers · clinical data-integrity principles (Attributable, Legible, Contemporaneous, Original, Accurate, +).
Clinical, vendor & channels
- CTMS · EDC
- Clinical Trial Management System · Electronic Data Capture. CRIO is both.
- CRA · IRB · DOA
- Clinical Research Associate (sponsor monitor) · Institutional Review Board (ethics + protocol approval) · Delegation of Authority log.
- I/E · DNQ · AE/SAE
- Inclusion / Exclusion eligibility · Did Not Qualify · Adverse Event / Serious Adverse Event (SAE = 24h/15-day reporting).
- HIE · FHIR · NCT
- Health Information Exchange · FHIR R4 clinical-data API · ClinicalTrials.gov study identifier.
- HSX · NJHIN
- HealthShare Exchange (PA) · NJ Health Information Network. Our two HIE applications.
- CTA · DNC · CAPI · FMEA
- Clinical Trial Agreement (sponsor↔site contract) · Do Not Call list · Conversion API (server-side ad tracking) · Failure Modes & Effects Analysis.