Back to all articles
SlothAuth: Autonomous Overnight Prior-Auth Prep with Local Gemma, LangGraph, and pgvector

SlothAuth: Autonomous Overnight Prior-Auth Prep with Local Gemma, LangGraph, and pgvector

13 min read
Read original on DEV
#devchallenge
#hf26challenge
#opensource
#buildinpublic

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

The Burden: Why Modern Medicine Needs to Channel the Sloth

There is no creature on Earth that understands energy conservation quite like the sloth. The three-toed sloth moves at a deliberate 0.15 miles per hour, refusing to waste a single calorie on pointless exertion.

Now contrast that with the daily life of an American physician or hospital care coordinator.

Every single week, the average medical practice is forced to complete 39 prior authorizations (PA). That adds up to more than 13 hours of pure administrative drudgery per physician every week—nearly two full working days spent on paperwork rather than healing patients. For every single patient requiring an MRI or a biologic medication, a clinician or nurse must spend 35+ minutes:

  1. Opening four different electronic health record (EHR) tabs to locate conservative therapy dates, physical therapy discharge summaries, and medication trials.
  2. Manually digging through 80-page insurer policy bulletins to decipher arcane clinical guidelines.
  3. Hunting for baseline safety lab dates (such as tuberculosis screenings or liver enzymes) so an insurance algorithm doesn't automatically reject the claim.
  4. Typing a multi-page "Medical Necessity Justification Letter" from scratch.

This is the definition of pointless cognitive exhaustion. It fuels healthcare burnout, delays critical patient treatment by weeks, and turns brilliant medical minds into glorified data-entry clerks.

       ┌─────────────────────────────────────────────────────────────┐
       │             THE MORNING CLINICAL PARADOX                    │
       │                                                             │
       │  Traditional Workflow: 35+ Min / Patient                   │
       │  [EHR Tabs] ──> [Ctrl+F 80p PDF] ──> [Manual Typing]        │
       │                                                             │
       │  SlothAuth Workflow: 30 Sec / Patient                       │
       │  [Sleep 🦥] ──> [Overnight Local Agent] ──> [1-Click Sign]   │
       └─────────────────────────────────────────────────────────────┘
Enter fullscreen mode Exit fullscreen mode

Enter SlothAuth: Radical Laziness as Burnout Prevention

For Hacktoberfest 2026 Week 3 ("Slow and Steady / Rewarding Laziness"), I built SlothAuth: an autonomous, 100% on-premise prior-authorization prep agent designed to do all the tedious, high-friction investigative chart work overnight while the clinician sleeps.

Powered by Google's open-weight Gemma model running locally via Docker Model Runner, LangGraph.js, PostgreSQL with pgvector, and Next.js 16, SlothAuth acts like a tireless, meticulous nocturnal medical fellow:

  1. Overnight Intake: At 2:00 AM, SlothAuth scans the day's intake queue of pending procedure and medication requests.
  2. Hybrid Semantic Policy Retrieval: It queries PostgreSQL using pgvector HNSW cosine similarity to fetch the exact sub-sections of payer clinical guidelines governing that procedure.
  3. Point-by-Point Evidence Audit: Local Gemma cross-references the patient's longitudinal EHR timeline against every coverage rule, pulling verbatim chart quotes and dates.
  4. Pre-Submission Gap Detection: It catches missing mandatory baseline labs before the insurance company can issue a denial (e.g., flagging an absent tuberculosis test before initiating an immunosuppressive biologic).
  5. Automated Exception Justification: When step-therapy requirements cannot be met due to a severe adverse reaction or pharmacogenetic deficiency, it drafts a formal, citation-backed Step-Therapy Exception clause automatically.
  6. The 9:00 AM Coffee-Break Sign-Off: When the care coordinator arrives at the clinic, 35 minutes of frantic detective work is already finished. They review a split-screen evidence map and pre-drafted letter in 30 seconds, click "Approve & Sign," and send the packet on its way.

Demo

Here is SlothAuth in action—handling the complete clinical prior-authorization lifecycle from real-time LangGraph execution to electronic clinician sign-off:


(Interactive Video Walkthrough: 4-Node LangGraph execution, real-time SSE streaming, and instant clinician resolution)

Key Dashboard Views

1. The "Morning Care Coordinator" Queue & Real-Time SSE Stepper

The dashboard displays live operational telemetry alongside the LangGraph execution stepper. As the batch runs, clinicians watch each node light up in real time with zero UI freezing:

SlothAuth Queue and Real-Time SSE Execution Stepper
Figure 1: The Care Coordinator dashboard featuring the "Lazy Payoff" KPI bar, patient roster, and live LangGraph SSE execution stepper.

2. Scenario 1 (PT-2026-001 — Marcus Vance): 100% Policy Compliant

Marcus Vance needs a lumbar spine MRI (CPT-72148) for chronic radiculopathy. SlothAuth proves compliance with Aetna Policy #0016 by citing 12 sessions of physical therapy at Apex Sports & Spine, a failed 5-week trial of Naproxen, and preliminary plain X-rays:

Marcus Vance 100% Ready to Submit
Figure 2: Complete criteria alignment (98% confidence) with green verbatim evidence quotes and ready-to-submit status.

3. Scenario 2 (PT-2026-002 — Elena Rostova): Catching Missing Labs Before Denial

Elena Rostova was prescribed Adalimumab (J0135) for rheumatoid arthritis. She meets diagnostic criteria and failed a 16-week Methotrexate trial. However, UnitedHealthcare requires a negative Tuberculosis screening within the past 6 months. SlothAuth catches the omission, injects a prominent warning banner into the letter, and offers a 1-click resolution action:

Elena Rostova Missing Lab Flagged
Figure 3: SlothAuth proactively prevents an insurance denial by flagging a missing QuantiFERON-TB Gold test.

4. Scenario 3 (PT-2026-003 — David Chen): Automated Step-Therapy Exception

David Chen was prescribed Infliximab (J1745) for severe Crohn's disease without completing BlueCross BlueShield's mandatory 8-week Azathioprine trial. SlothAuth digs into his chart, spots that Azathioprine was halted on Day 5 due to acute drug-induced pancreatitis (lipase 980 U/L), correlates it with a low TPMT enzyme activity level (4.2 U/mL), and writes a formal contraindication justification:

David Chen Step Therapy Exception
Figure 4: Automated clinical justification for bypassing step-therapy due to documented life-threatening drug toxicity.

Code

https://github.com/NegiSushant/SlothAuth

The repository is organized into a clean, modular full-stack architecture:

sloth-auth/
├── Docker-Compose.yml                 # PostgreSQL 16 + pgvector container definition
├── package.json                       # Next.js 16, LangGraph.js, Prisma, pgvector
├── .env.example                       # Local DMR & PostgreSQL configuration
├── scripts/
│   ├── seed.ts                        # Local vector seeding (mxbai-embed-large + pgvector)
│   ├── test-agent.ts                  # CLI LangGraph workflow verification runner
│   └── test-api.ts                    # REST & SSE streaming test suite
└── src/
    ├── app/
    │   ├── api/prior-auth/
    │   │   ├── packet/[requestId]/    # PATCH: Save edits, resolve labs, clinician sign-off
    │   │   ├── prep/                  # POST: Single & batch runner with SSE streaming
    │   │   ├── queue/                 # GET: Live patient roster & telemetry
    │   │   └── reset/                 # POST: Reset simulation to PENDING_PREP
    │   ├── dashboard/page.tsx         # Split-screen Care Coordinator Dashboard
    │   └── page.tsx                   # Product landing page & architecture showcase
    ├── components/
    │   ├── AgentExecutionStepper.tsx  # Animated 4-node LangGraph execution tracker
    │   ├── PacketInspector.tsx        # Split-screen criteria checklist & markdown editor
    │   └── TelemetryFooter.tsx        # Fixed telemetry bar (0 Bytes PHI, $0.00 Cost)
    └── lib/
        ├── agent/
        │   ├── models.ts              # Docker Model Runner Gemma & Embeddings bindings
        │   ├── nodes.ts               # 4 deterministic LangGraph execution nodes
        │   ├── priorAuthGraph.ts      # StateGraph assembly & batch executor
        │   └── state.ts               # PriorAuthGraphState annotation definitions
        ├── prisma.ts                  # Database client with pgvector support
        ├── schema.sql                 # Reference SQL DDL with HNSW vector index
        └── seed-data.ts               # Synthetic policies & 3 patient clinical charts
Enter fullscreen mode Exit fullscreen mode

How I Built It

SlothAuth is built on four decoupled, production-grade open-source pillars designed to operate without any external cloud dependencies.

flowchart TD
    subgraph UI["Frontend Layer (Next.js 16 App Router)"]
        Dashboard["Care Coordinator Dashboard"]
        SSEStream["Server-Sent Events (SSE) Stepper"]
        Inspector["Split-Screen Evidence & Letter Editor"]
    end

    subgraph API["API Router (/api/prior-auth)"]
        PrepRoute["/prep (Streaming LangGraph Runner)"]
        PacketRoute["/packet/[requestId] (Interactive Actions)"]
        QueueRoute["/queue (Telemetry & Records)"]
    end

    subgraph Orchestrator["Agent Layer (LangGraph.js)"]
        N1["Node 1: extractPatientContext"]
        N2["Node 2: retrievePolicyChunks"]
        N3["Node 3: auditClinicalCriteria"]
        N4["Node 4: draftJustificationAndSave"]
    end

    subgraph LocalInference["Local AI Runtime (Docker Model Runner :12434)"]
        GemmaModel["Gemma Open-Weight LLM\n(ai/gemma3)"]
        EmbeddingEngine["Local Vector Embeddings\n(ai/mxbai-embed-large)"]
    end

    subgraph DataStore["Vector Database (PostgreSQL 16 + pgvector)"]
        PoliciesTable[("payer_policies\nHNSW vector(1024)")]
        RequestsTable[("patient_requests\nJSONB clinical_notes")]
        PacketsTable[("prepped_packets\nChecklists & Letters")]
    end

    Dashboard --> PrepRoute
    Dashboard --> QueueRoute
    Inspector --> PacketRoute

    PrepRoute --> Orchestrator
    PrepRoute -. "SSE Real-Time Updates" .-> SSEStream

    N1 --> RequestsTable
    N2 --> EmbeddingEngine
    N2 --> PoliciesTable
    N3 --> GemmaModel
    N4 --> GemmaModel
    N4 --> PacketsTable
    N4 --> RequestsTable

1. Local AI Runtime: Docker Model Runner & Google Gemma

Medical applications cannot rely on public cloud APIs that risk Protected Health Information (PHI) egress. To keep all data strictly on-premise, SlothAuth leverages Docker Model Runner (DMR), Docker's native local model inference engine running on TCP port 12434.

We configure LangChain's @langchain/openai client to point directly to Docker Model Runner's local endpoint:

// src/lib/agent/models.ts
import "dotenv/config";
import { ChatOpenAI } from "@langchain/openai";

const baseURL = process.env.DOCKER_MODEL_BASE_URL || "http://localhost:12434/engines/llama.cpp/v1";
const llmModel = process.env.LLM_MODEL_NAME || "ai/gemma3:4B-F16";

/**
 * Local Gemma chat model running via Docker Model Runner.
 * Configured with a low temperature (0.1) for deterministic clinical criteria extraction.
 */
export const gemmaChatModel = new ChatOpenAI({
  model: llmModel,
  apiKey: "docker-model-runner-local", // Zero external API keys needed
  configuration: {
    baseURL,
  },
  temperature: 0.1,
});
Enter fullscreen mode Exit fullscreen mode

For embeddings, SlothAuth connects to the local ai/mxbai-embed-large model to generate 1024-dimensional vectors on the fly with zero external network calls:

// src/lib/agent/models.ts
export async function generateQueryEmbedding(text: string): Promise<number[]> {
  const response = await fetch("http://localhost:12434/engines/llama.cpp/v1/embeddings", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      model: "ai/mxbai-embed-large",
      input: text,
    }),
  });
  const data = await response.json();
  return data.data[0].embedding;
}
Enter fullscreen mode Exit fullscreen mode

2. Hybrid Policy RAG with PostgreSQL & pgvector

In healthcare, pure semantic vector search is dangerous. If a patient with BlueCross BlueShield is requesting Crohn's biologic therapy, returning a high-similarity chunk from an Aetna Lumbar MRI policy would corrupt the entire prior-auth packet.

To guarantee mathematical precision, SlothAuth implements Hybrid Filtered Vector Search in PostgreSQL using the pgvector extension:

  1. Exact B-tree Metadata Filter: We filter by the exact insurer (payer_name) and clinical procedure code (procedure_code).
  2. HNSW Cosine Vector Ranking: Within that exact policy partition, we use an HNSW index (vector_cosine_ops) to rank chunks by cosine distance against the clinical query embedding. 
-- PostgreSQL pgvector Schema (src/lib/schema.sql)
CREATE EXTENSION IF NOT EXISTS vector;

CREATE TABLE payer_policies (
    id SERIAL PRIMARY KEY,
    payer_name VARCHAR(100) NOT NULL,
    procedure_code VARCHAR(50) NOT NULL,
    policy_number VARCHAR(50) NOT NULL,
    policy_title TEXT NOT NULL,
    section_name VARCHAR(150) NOT NULL,
    chunk_text TEXT NOT NULL,
    embedding vector(1024) NOT NULL
);

-- Fast HNSW cosine index
CREATE INDEX idx_payer_policies_embedding 
    ON payer_policies USING hnsw (embedding vector_cosine_ops);

-- Composite B-tree index for instantaneous hybrid filtering
CREATE INDEX idx_payer_policies_hybrid 
    ON payer_policies (payer_name, procedure_code);
Enter fullscreen mode Exit fullscreen mode

When Node 2 (retrievePolicyChunks) executes, it issues this parameterized query:

// src/lib/agent/nodes.ts
const rows = await prisma.$queryRawUnsafe<Array<{
  id: number;
  policy_number: string;
  policy_title: string;
  section_name: string;
  chunk_text: string;
  similarity: number;
}>>(
  `SELECT id, policy_number, policy_title, section_name, chunk_text,
          (1 - (embedding <=> $3::vector)) AS similarity
   FROM payer_policies
   WHERE payer_name = $1 AND procedure_code = $2
   ORDER BY embedding <=> $3::vector ASC
   LIMIT 5;`,
  payerName,
  procedureCode,
  vectorString
);
Enter fullscreen mode Exit fullscreen mode

3. Deterministic 4-Node LangGraph.js Orchestration

Monolithic LLM prompts fail when tasked with multi-step clinical audits. A single prompt trying to read 5 pages of chart notes, memorize an insurance policy, evaluate criteria, and draft a legal letter often hallucinates dates, forgets negative lab tests, or invents compliance.

SlothAuth solves this with LangGraph.js (@langchain/langgraph), enforcing a deterministic state transition pipeline:

// src/lib/agent/priorAuthGraph.ts
import { StateGraph, START, END } from "@langchain/langgraph";
import { PriorAuthGraphState } from "./state";
import {
  extractPatientContext,
  retrievePolicyChunks,
  auditClinicalCriteria,
  draftJustificationAndSave,
} from "./nodes";

const workflow = new StateGraph(PriorAuthGraphState)
  .addNode("extractPatientContext", extractPatientContext)
  .addNode("retrievePolicyChunks", retrievePolicyChunks)
  .addNode("auditClinicalCriteria", auditClinicalCriteria)
  .addNode("draftJustificationAndSave", draftJustificationAndSave)
  .addEdge(START, "extractPatientContext")
  .addEdge("extractPatientContext", "retrievePolicyChunks")
  .addEdge("retrievePolicyChunks", "auditClinicalCriteria")
  .addEdge("auditClinicalCriteria", "draftJustificationAndSave")
  .addEdge("draftJustificationAndSave", END);

export const priorAuthWorkflow = workflow.compile();
Enter fullscreen mode Exit fullscreen mode

How the 4 Nodes Work:

4. Real-Time Server-Sent Events (SSE) Streaming

Rather than making the clinician stare at a static spinner while multiple local models execute, POST /api/prior-auth/prep streams live LangGraph lifecycle events over a lightweight SSE connection:

// src/app/api/prior-auth/prep/route.ts
const eventStream = await priorAuthWorkflow.stream(
  { requestId: patient.id },
  { streamMode: "updates" }
);

for await (const update of eventStream) {
  const nodeName = Object.keys(update)[0];
  const nodeData = update[nodeName];

  sendEvent({
    type: "node_complete",
    requestId: patient.id,
    nodeName,
    step: NODE_METADATA[nodeName].step,
    stepLabel: NODE_METADATA[nodeName].label,
    logs: nodeData?.executionLogs || [],
    readinessVerdict: nodeData?.readinessVerdict,
  });
}
Enter fullscreen mode Exit fullscreen mode

The React frontend listens via a native EventSource / fetch reader, lighting up each stage in AgentExecutionStepper.tsx as Gemma evaluates chart criteria.

Why Does Open Innovation Matter?

Healthcare technology is currently facing a critical fork in the road: centralized black-box cloud APIs versus transparent, on-premise open-weight AI.

When developing software for healthcare providers, this is not an academic debate—it is a legal, operational, and financial necessity. Here is why the open-source architecture behind SlothAuth is the only viable path forward for clinical automation:

┌──────────────────────────────────────────────────────────────────────────────────┐
│                   CLOSED CLOUD APIS vs. OPEN-SOURCE SLOTH STACK                 │
├──────────────────────────┬────────────────────────────┬──────────────────────────┤
│ Architectural Dimension  │ Closed Cloud APIs          │ SlothAuth (Gemma Stack)  │
├──────────────────────────┼────────────────────────────┼──────────────────────────┤
│ PHI / HIPAA Data Egress  │ ⚠️ High Risk (Public Cloud)│ 🛡️ ZERO BYTES Egress     │
│ Overnight Batch Cost     │ 💸 Compounding Token Fees  │ 🆓 $0.00 In API Fees     │
│ Offline / Air-Gapped     │ ❌ Impossible              │ ⚡ 100% Intranet-Native  │
│ Model Weight Pinning     │ ❓ Silent Upstream Drift   │ 🔍 Fully Deterministic   │
│ Vector Search Control    │ 🔒 Proprietary Indices     │ 📐 PostgreSQL pgvector   │
└──────────────────────────┴────────────────────────────┴──────────────────────────┘
Enter fullscreen mode Exit fullscreen mode

1. Strict PHI Privacy & Zero Data Egress (The HIPAA Reality)

Under HIPAA, transmitting Protected Health Information (PHI)—including patient names, diagnostic ICD-10 codes, narrative clinical progress notes, and genomic lab values—to external third-party multi-tenant APIs requires complex Business Associate Agreements (BAAs), enterprise subscriptions, and continuous security auditing.

With open-weight Gemma and Docker Model Runner, SlothAuth processes patient data entirely inside the hospital's local network or workstation. Zero bytes of PHI ever leave the local machine.

2. $0.00 Marginal Cost for Continuous Overnight Batching

Prior authorization preparation is a high-volume background batch workload. Running multi-page clinical records and 80-page insurance policy chunks through commercial cloud LLMs every single night costs serious money.

By building on open-weight models, SlothAuth turns marginal inference cost into $0.00. A clinic can process 10, 100, or 1,000 prior authorizations every night on commodity local hardware without watching an API billing meter run up.

3. Model Weight Pinning & Clinical Reproducibility

When a closed commercial model provider updates its API endpoints, prompt responses drift. In healthcare, an unannounced model update that alters criteria evaluation could cause an insurance denial for a life-saving drug.

With open-weight models, hospital IT teams pin the exact model artifact (e.g., ai/gemma3:4B-F16), lock the temperature to 0.1, and maintain a 100% reproducible audit trail for medical compliance.

My Agent Session

Building SlothAuth required coordinating local containerized databases, vector embeddings, LangGraph state machine logic, and responsive UI components. I used an AI coding assistant in an iterative, five-phase architecture session:

  1. Phase 1: Local Infrastructure & Model Serving: Establishing Docker Model Runner bindings on port 12434 and configuring the pgvector/pgvector:pg16 database in Docker-Compose.yml.
  2. Phase 2: Synthetic Healthcare Data Engineering: Writing src/lib/seed-data.ts to construct realistic clinical cases with nuanced edge conditions (plain radiograph requirements, missing interferon-gamma release assays, and pharmacogenetic contraindications).
  3. Phase 3: LangGraph State Machine Architecture: Structuring the 4-node directed graph in src/lib/agent/ to ensure clean separation of concerns between patient timeline parsing, vector retrieval, criteria evaluation, and justification drafting.
  4. Phase 4: Real-Time SSE Streaming: Building the streaming response handler in src/app/api/prior-auth/prep/route.ts to stream LangGraph lifecycle updates without blocking the Next.js runtime.
  5. Phase 5: Morning Care Coordinator UI: Developing the split-screen reviewer in src/components/PacketInspector.tsx, giving clinicians a point-by-point evidence map on the left and an editable justification letter on the right.

Agent Transcript: You can inspect the complete step-by-step engineering trajectory and architecture logs in the SlothAuth Agent Session Transcript.

The Lazy Payoff

Let's look at the numbers. How much time and cognitive energy does SlothAuth actually save?

┌──────────────────────────────────────────────────────────────────────────────────┐
│                           THE "LAZY PAYOFF" AUDIT                                │
├───────────────────────────────────┬──────────────────────┬───────────────────────┤
│ Clinical Case                     │ Manual Workflow      │ SlothAuth Workflow    │
├───────────────────────────────────┼──────────────────────┼───────────────────────┤
│ Marcus Vance (Lumbar Spine MRI)   │ 35 minutes           │ 15 seconds (1-click)  │
│ Elena Rostova (Adalimumab RA)     │ 40 minutes + denial  │ 30 seconds (1-click)  │
│ David Chen (Infliximab Crohn's)   │ 45 minutes of appeal │ 45 seconds (1-click)  │
├───────────────────────────────────┼──────────────────────┼───────────────────────┤
│ TOTAL TIME INVESTED               │ 2 Hours, 0 Minutes   │ 1 Minute, 30 Seconds  │
└───────────────────────────────────┴──────────────────────┴───────────────────────┘
Enter fullscreen mode Exit fullscreen mode

Here is how SlothAuth transformed the three clinical test cases we ran through the system:

Case 1: Marcus Vance (PT-2026-001) — Lumbar Spine MRI (CPT-72148)

Case 2: Elena Rostova (PT-2026-002) — Adalimumab Biologic (J0135)

Case 3: David Chen (PT-2026-003) — Infliximab Infusion (J1745)

Prize Categories

🌟 Best Use of Gemma

SlothAuth relies on Google's open-weight Gemma model as its core clinical reasoning engine. Running locally via Docker Model Runner at temperature: 0.1, Gemma performs the critical intellectual work of the entire platform:

By using Gemma locally, SlothAuth achieves full clinical reasoning capability with 0 bytes of Protected Health Information (PHI) egress and $0.00 in marginal API costs.

🐯 Best Use of Tiger Data

SlothAuth leverages PostgreSQL with the pgvector extension as its unified vector and relational data layer:

Conclusion: Embrace Your Inner Sloth

In nature, the sloth's slow pace is an evolutionary superpower: by moving deliberately and eliminating wasted energy, the sloth thrives where others burn out.

In healthcare, we have spent decades forcing our most skilled doctors and nurses to sprint on an administrative hamster wheel—wasting thousands of hours on manual prior authorization paperwork.

SlothAuth proves that when open-weight models like Gemma run locally on modern open-source stacks, we don't have to sprint anymore. We can let the agent do the tedious overnight work, so clinicians can walk in, have their coffee, click "Approve," and get back to what matters most: caring for patients.

🦥 Slow and steady wins the race.

Published on DEV Community

Read comments, view reactions, and discuss with the developer community.

Open on DEV Community
LinkedIn
X