An example of prior authorization as a governed process: agents do the 8 steps, and a person signs 2 gates before anything irreversible happens. Download it, import it into your workspace, and adapt it to your systems.
minctrl.process/v1 · hash 2b640a3e230d…e30f
Prior authorization is the most-hated administrative burden in US healthcare — slow, manual, and a denial without a physician signature is a legal and reputational landmine. Routine requests are auto-approved against criteria in minutes; only genuine medical-necessity calls reach a medical director, who signs every adverse determination.
Issuing an authorization decision — especially a denial — is a regulated adverse-benefit determination with appeal rights, so a clinician signs off before a denial or a limited approval is released.
| Rule | What it requires |
|---|---|
| CMS Interoperability & Prior Authorization Final Rule (CMS-0057-F) | Impacted payers must support electronic prior authorization (FHIR-based PARDD APIs), send decisions within 72 hours for expedited and 7 calendar days for standard requests, and give a specific reason on every denial — with most provisions effective January 2026/2027. |
| Payer medical-necessity criteria | Approval turns on the plan's coverage policy and medical-necessity criteria (often InterQual or MCG); the request must attach the clinical documentation that supports the requested service, drug, or procedure. |
| ERISA / ACA adverse-benefit-determination rules | A denial is an adverse benefit determination: the member must get the clinical rationale and appeal rights, so the deciding logic and evidence have to be recorded and defensible. |
| HIPAA Privacy & Security Rules | PHI in the auth packet must stay minimum-necessary, access-controlled and audit-logged end to end. |
A summary for orientation, not legal advice.
A minctrl.process/v1 document: the graph and the hash of the process it becomes.
Import into Minctrl opens this example in your workspace; one click stores it as your first version. Import JSON does the same with the file, and a file changed after download is refused.
Every connector starts in shadow: steps run, nothing leaves Minctrl until you configure a connector and switch it live.
Change signers, time limits and steps on the canvas. Each save is a new version; a running case stays on the version it started with.
The example models what the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) asks of a decision: a specific denial reason, timing against the 72-hour expedited and 7-calendar-day standard windows, and a log of every determination with its evidence. Whether your organization meets the rule depends on your systems, your API obligations and your own compliance review. Minctrl holds no certification, and this is not legal advice.
The AI agent gathers the clinical documentation and codes and maps them to the plan's medical-necessity criteria, then produces a recommendation with its confidence score. It never releases a denial or a limited approval on its own — those park at a clinical sign-off gate, so a licensed reviewer owns the adverse determination.
Every prior authorization decision is recorded with the criteria applied, the clinical evidence, the confidence, the human who signed off, and a tamper-evident audit hash. Because runs are deterministic and replayable, an appeals reviewer or auditor re-running the case gets the same result and the same rationale.