Constructive-Only Architecture
Status: concept — architectural, not policy; the prototype inherits it by construction.
PRISM can suggest a diagnostic test or say nothing — those are the only two outputs the system is physically capable of producing. There is no pathway anywhere in the architecture through which a denial, restriction, or "no need" could be emitted, and this article explains why that is a property of the machinery rather than a promise about its use.
Two operations, nothing else
Strip the system to its moving parts and it does exactly two things: append rows to a patient timeline, and count positives. Each model's entire job is continuing a six-column table with the next plausible rows of care. A suggestion exists when that continuation contains a diagnostic TEST code; the ensemble then counts how many independent models produced it. Everything else in PRISM — training, serving, evaluation — exists to make those two operations trustworthy.
Neither operation can express "don't." A model generates a test code or fails to generate it. A count rises or stays flat. The output space contains positive suggestions and silence, and the constraint runs through every layer: the training data records care that happened, with no field for care that was withheld; the models learn only to continue what-happened sequences; the vote is pure accumulation, where a model that doesn't fire contributes nothing rather than a vote against.
What a denial-capable system would require
The clearest way to see that this is architecture rather than policy is to enumerate what would have to exist for PRISM to deny care:
| a denial-capable system would need | what PRISM has instead |
|---|---|
| an output vocabulary of decisions — "approve", "deny", "not medically necessary" | the output vocabulary is rows of billing codes; there is no decision token to emit |
| training data labeled with what should not happen | training data is timelines of care that actually occurred |
| an aggregator that can weigh votes against an action | counting is additive only; non-firing models add nothing and cancel nothing |
| a connection to claims, orders, or authorizations it could act on | suggestions reach a physician as information; PRISM touches no claim, no order, no authorization |
None of these are disabled features or configuration switches. They are absent components. Turning PRISM into a denial engine would mean rebuilding it — a different output space, different training data, a different aggregation rule, and a different connection to the world. That is the meaning of "architectural, not policy": a policy can be reversed by whoever inherits the system; missing machinery cannot be quietly switched on.
Silence is not a "no"
When the ensemble does not reach consensus on a patient, the output is nothing at all — not a weak suggestion, not a clearance, not reassurance. Silence means the pattern recognition found insufficient agreement, full stop. It does not mean the patient was evaluated and found not to need screening; the record may hold signals PRISM cannot see, and billing data omits most of what a clinician knows.
Architecturally, that reading is the only one available: a non-firing model contributes nothing to the count, and no negative recommendation is representable anywhere in the output space. Why silence must never be read as clearance — and how the EOS ban enforces the same asymmetry inside every single generation — is the subject of Recall, not prediction.
Every knob points the same direction
The tunable parameters share one property: they adjust how suggestive the system is, never how restrictive. Lowering the consensus threshold surfaces more suggestions; raising it yields fewer, down to silence — never past silence into denial. Adding pools and models can only add potential votes; removing them only quiets the system. In the prototype's five-model ensemble, two models firing while three stay silent is a flag with weight two — not three votes against. Disagreement produces inaction, not opposition, so no calibration choice can weaponize the system for restriction.
Recognition is separated from action
The final safeguard is that PRISM recognizes patterns and humans act. A consensus flag becomes a suggestion to a primary-care physician, who retains full authority to order the test, defer it, or ignore the flag entirely — and the patient can always decline. Healthcare already has abundant mechanisms for saying no; what it lacks is systematic surfacing of the beneficial tests that go unordered. PRISM supplies only that missing half, and because it is wired to no claims system or authorization pathway, even a total failure of every other property would leave it unable to restrict anything.
The business model points the same way
The economics reinforce the architecture rather than strain against it: PRISM is paid only when a suggestion leads to a documented early detection. There is no fee-for-service and no per-member fee, so no revenue attaches to a test not happening — the incentive to be restrictive is as absent from the business model as the capability is from the architecture. A system that profits only from confirmed early detections and can emit only positive suggestions has its constraint and its motive aligned by construction, and the public-benefit charter locks that alignment above any future change of ownership.
See also
- Recall, not prediction — the EOS ban; why forced continuation enforces the same asymmetry per generation
- Pools and consensus — how additive voting works and why independence makes it meaningful
- Clinical decision support — physician autonomy and the non-device posture
- Results-based compensation — the payment model that removes any incentive to restrict