CRO PlatformAI-Native CRO OS
Toggle navigationMenu

Reference

Protocol Amendment Data Flow — End-to-End

How a single protocol amendment travels through the platform — from a sponsor’s request, through staging and agent processing, across the Part 11 e-signature gate, to live promotion, audit trail, and inspector view. Read left to right.

8 steps·2 agent·2 human·3 system·avg 3.21 min/step
Protocol amendment end-to-end flow — eight steps from sponsor request to inspection1. SponsorSponsorRequest2. SystemStagingRecord3. AgentAgentClassificationA24. AgentAgentValidationA25. HumanE-Sign Gate6. SystemLivePromotion7. SystemAudit Trail8. HumanInspectionView
LegendSponsorAgentHumanSystem

Step 1 · Sponsor

Sponsor Request

Sponsor Portal (L5)

~2 min

Sponsor submits a protocol amendment request via the sponsor portal. The request includes the rationale, the affected sections, and target studies. No regulated record is written yet — only an intent row.

Evidence trail

  • Sponsor identity attested via Supabase Auth + MFA
  • Request row in sponsor_request table (intent only)
  • created_at, created_by populated by RLS policy

Step 2 · System

Staging Record

Staging tables (L1)

~30 sec

The orchestrator writes a structured staging_record bound to the sponsor request. All downstream agent work targets this staging row — never live tables. This satisfies the architectural invariant that agents write only to staging.

Evidence trail

  • staging_record row with provenance_id
  • Transactional outbox entry in cro.app_log
  • Governor policy check passes (no live write)

Step 3 · Agent

Agent Classification

Knowledge RAG Agent (L3)

~3 minA2

The Knowledge RAG agent classifies the amendment (substantial vs. non-substantial, ICH E6(R3) categories) and tags the affected sections. All claims are citation-grounded against ICH/FDA guidance.

Evidence trail

  • Agent run row with prompt + model registry version
  • Citation manifest in packages/citations format
  • Token + cost telemetry to cost_event

Step 4 · Agent

Agent Validation

Evaluation Agent (L3)

~5 minA2

The Evaluation agent cross-checks the classification against the protocol, prior amendments, and applicable LCD/NCD coverage. It produces a risk score and a list of unresolved questions for human review.

Evidence trail

  • Evaluation report attached to staging_record
  • Risk score + rationale persisted to risk_register
  • No causality call — architecturally blocked for safety claims

Step 5 · Human

E-Sign Gate

E-Signature Service (L4)

~4 min

A signed human reviewer re-authenticates, states intent, and signs. The signature row is immutable and binds the staging_record to a signer identity. This is the only path through which staging becomes live.

Evidence trail

  • Part 11 signature row (re-auth, intent, timestamp)
  • TOTP MFA challenge attested
  • Signature linked to staging_record by foreign key

Step 6 · System

Live Promotion

Orchestrator (L2)

~10 sec

On valid signature, the orchestrator promotes staging→live atomically. Live writes carry the signature_id so any inspector can trace the live row back to the human who signed.

Evidence trail

  • Live row written with signature_id foreign key
  • staging_record marked as promoted
  • Database webhook fires to notifier service

Step 7 · System

Audit Trail

Audit Trail Agent + provenance_event (L1)

~1 min

Every step above has already written provenance_event rows. The audit trail agent compiles them into a chronological ALCOA+ narrative, ready for export. Nothing is reconstructed — only assembled.

Evidence trail

  • Chronological provenance_event sequence
  • ALCOA+ checks: Attributable, Legible, Contemporaneous, Original, Accurate
  • Audit bundle hash recorded for tamper-evidence

Step 8 · Human

Inspection View

Inspector Console (L5)

~variable

An FDA/EMA inspector (or internal QA) opens the inspection package. They see the full chain: sponsor request, staging, agent rationale + citations, signature, live row, audit narrative. Read-only, single-pane-of-glass.

Evidence trail

  • Inspection package generated on demand (read-only)
  • Every artifact linked to its provenance_id
  • Export to PDF/ZIP via /exports