How Narwal Helped a Leading Healthcare Technology Company Commercialize Its First AI Agent Securely

Summary

Narwal helped a leading US-based healthcare technology company transform an internal AI assistant into a secure, customer-facing commercial AI product, embedding AI agent governance, identity, compliance, and reliability into the foundation so future AI agents could launch faster and with lower risk. Operating in a highly regulated environment, the company needed to commercialize its first AI agent without compromising compliance standards. Narwal led the program from production launch through access-control architecture and post-launch reliability, delivering the company’s first commercial AI agent to production, backed by a four-layer governed access architecture and a reusable governance framework for future AI agent rollouts.

Customer Challenge

The agent had proven itself internally, but taking it external meant solving problems that only show up at commercial scale, in an industry where compliance isn’t optional, and where AI agent governance had to be built in rather than bolted on.

• Regulated Environment: Any customer-facing AI agent had to align with enterprise compliance standards, including ISO/IEC 27001, SOC 2 Type 2, and ISO 13485.
• No Scalable Access Model: The company had no AI agent governance framework in place to securely separate internal and external users, or manage affiliation-based permissions, across a growing set of AI agents.
• Cross-Team Coordination Gap: Production launch and access-control design required coordinated architecture across identity, middleware, API management, and the underlying data platform, involving a 25-plus person program team, with a smaller, focused team driving the reliability work that followed launch.
• Reliability at Commercial Scale: Response accuracy, semantic correctness, and consistent behavior needed to hold up under real customer usage, not just internal testing.

Narwal’s Solution

Narwal ran this as a single program spanning production launch, access-control architecture, and post-launch reliability, treating AI agent governance as the thread connecting all three rather than three disconnected efforts.

• Production Launch Coordination: Directed cross-team architecture across identity (Auth0), middleware, Azure API Management, and Snowflake Cortex Analyst and Cortex Search, achieving external production release on schedule.
• Four-Layer Governed Access Architecture: Designed a phased RBAC model spanning Auth0, Client Portal/BFF, Azure API Management, and Snowflake Cortex, enabling secure, affiliation-based access for both internal and external users, with just-in-time provisioning supporting the internal SSO and demo-account access path. End-to-end SSO/RBAC validation continued past initial delivery as a tracked watch item.
• QA and Validation Discipline: Supported structured QA scenarios and validation checkpoints covering routing, authorization, and external-user behavior before and after launch.
• Post-Launch Reliability Improvements: Refined agent behavior across truncation disclosure, neutral and fact-based response handling, replacement-cost semantic fields, and entitlement logic, integrated Service History into Capital Budget analyst workflows, and worked to resolve intermittent evaluation inconsistencies, with repeated eval runs continuing to confirm long-term stability.
• Reusable Governance Pattern: Built the AI agent governance model, spanning access control, validation, and reliability, to extend beyond this agent, creating a foundation the company could apply to future AI agent rollouts.

Business Outcomes

• First Commercial AI Agent in Production: The company’s first externally facing AI agent reached production release on schedule, with continued stabilization and governance afterward.
• Governed Access Across User Types: The four-layer RBAC architecture, with JIT provisioning for internal SSO access, gave the company a secure, auditable way to manage internal and external access, replacing an ad hoc approach, with end-to-end validation continuing post-launch.
• Improved Response Reliability: Post-launch enhancements, including Service History integration for Capital Budget workflows, reduced ambiguity in agent responses and improved semantic accuracy and entitlement handling, with evaluation stability confirmed through ongoing testing.
• A Repeatable Launch Pattern: The architecture, governance, and validation approach built for this agent became the foundation for additional AI agent rollouts already underway.

Why Narwal

Launching an AI agent internally is one milestone. Taking it external, in a regulated industry, with real AI agent governance in place for multiple user types and reliability that holds up under real usage, is a different scale of challenge entirely. Narwal brought the program discipline to coordinate architecture across identity, middleware, and data platform teams, the access-control expertise to design a governance model built for reuse, and the delivery rigor to keep improving reliability after launch rather than treating go-live as the finish line.