How we shipped a regulated healthcare MVP in 34 days (and what almost broke it)
Thirty-four days from kickoff to a production-ready clinical documentation tool. Regulated healthcare. Real patient data considerations. A client who had been burned by a previous vendor that took six months and delivered an unshippable prototype.
Here's what the process actually looked like — and the one thing that nearly blew it.
The workflow we ran
We structured the engagement around Ailoitte's AI Velocity Pod model: a small, senior team running governed multi-agent AI workflows. In practice, that meant AI agents handling the high-volume implementation layers — component generation, test scaffolding, documentation — while human engineers owned architecture decisions, integration logic, and every point where patient data touched the system.
The agent split was intentional and explicit from day one:
- Research agent for codebase and requirements mapping.
- Implementation agent for feature-level code generation against defined specs.
- Test agent running in parallel.
- Security review agent flagging anything touching PHI (Protected Health Information) handling or API exposure.
Human engineers sat at four defined checkpoints: architecture sign-off, integration review, security findings triage, and pre-launch QA. In a non-regulated context, we'd compress some of those checkpoints. We didn't hear. Healthcare is the domain where "AI moving fast" quickly becomes a liability.
What almost broke it
Week two. The implementation agent generated a data-handling function that passed unit tests cleanly but contained a logging pattern that would have written partial patient identifiers to an application log in certain error states.
The security review agent flagged it. The test agent missed it — because the test spec didn't cover error-path logging behavior. It was a spec gap, not a model failure.
This is the thing about AI-assisted development that doesn't show up in the benchmark numbers: the AI executes the exact spec you gave it. If the spec has gaps, the AI finds them in the worst possible way.
We caught it at the security checkpoint, rewrote the spec to cover error-path behavior explicitly, and ran the implementation cycle again. Two days of rework. Still shipped in 34 days. But it was a stark reminder that speed without governance isn't speed — it's deferred risk.
The lesson
AI velocity is real. For our healthcare client, we delivered in 34 days what their previous vendor had failed to deliver in six months. The clinical AI documentation work reflects what AI-assisted delivery looks like in a regulated context.
But the speed only held because we governed what the AI touched:
- Explicit agent contracts
- Structured human checkpoints
- A full, transparent audit trail
The moment you let AI run unchecked in a domain with massive compliance stakes, you're not moving fast — you're moving blind. Build the governance in from day one. The speed follows from that, not the other way around.
Over to you: How are you thinking about AI governance in your own builds — especially in regulated verticals? Would love to hear what's working for your teams in the comments below!
Tags: #healthcare #mvp #ai #software-engineering
