I ship production LLM systems
in regulated domains.

What I was up against

The verification step in Bingo Claims has to be airtight: a processor asks the AI a question, gets back three citations, and clicks through to confirm each one. The system was showing the right answer on the citation card — and then landing on a completely different paragraph in the source document. I needed the card and the source view to point at the same place, every time, with no exceptions.

How I worked through it

I traced both halves of the trust chain — the card view and the source view — and realized the right move wasn’t to make either one smarter. It was to remove the gap between them. I rebuilt the source-highlighting layer so it can only ever look inside the same passage the card is already showing. The two views can’t disagree, because the code physically won’t allow it.

# Step 1 — extract the exact window the card is about to show.
def _find_excerpt_window(content, query_terms, max_chars=240):
    """Densest cluster of query hits — the same window the card displays."""
    stripped = content.strip()
    if len(stripped) <= max_chars:
        return 0, len(stripped)

    lower = stripped.lower()
    best_start, best_hits = 0, -1
    for start in range(0, len(stripped) - max_chars, 40):
        snippet = lower[start : start + max_chars]
        hits = sum(snippet.count(q) for q in query_terms)
        if hits > best_hits:
            best_hits, best_start = hits, start
    return best_start, best_start + max_chars


# Step 2 — highlight picker now takes the WINDOW, not the whole section.
# It physically cannot search outside what the card is showing.
def _pick_highlight(excerpt_window, answer, query_terms):
    # tier cascade runs inside excerpt_window only — WYSIWYG by construction
    ...

What shipped

• 17 out of 17 citations across four real plans landed inside the excerpt window — verified programmatically
• Net code down — four helpers deleted, one added
• The next eight rounds of correctness work followed the same approach: change the contract, delete code

What I took away

When a class of failure won’t close, the fix usually isn’t a smarter component. It’s removing the degree of freedom that made the failure possible at all.

What I was up against

I’d been chasing the same class of bug across eleven rounds of patches. The pattern would shift — a different question, a different section, a different wrong sentence — but the bug kept reappearing in a new disguise. I needed to break the pattern, not patch it again.

How I worked through it

I stepped back and asked what the system was actually doing. The backend was working hard to guess which sentence the AI meant — using nearby words, scoring rules, defensive guards. None of those guesses had access to the one source of truth that mattered: the AI itself. So I changed the contract. Now the AI declares its evidence directly, inline with the citation. The backend stopped guessing and started checking.

# Before: backend guesses which sentence the model meant.
# Five tiers, four guards, nine heuristics. Failed quietly on edge cases.
highlight = _pick_highlight_from_answer(content, answer, section_id, query_terms)


# After: model emits the verbatim quote inline with the citation marker.
# Backend just verifies the substring belongs in the cited section.
def verify_quote(quote: str, section_text: str) -> bool:
    """Whitespace-tolerant substring check. One line. Zero heuristics."""
    return _normalize(quote) in _normalize(section_text)


# Citation payload from the model now looks like:
#   {"section": "1848", "quote": "Members have 30 days to file a claim..."}
# The "which sentence?" question is answered at write time, not inferred at read time.

What shipped

Nine downstream heuristics collapsed into a single check. The class of bug stopped reappearing. The whole verification path got simpler and faster.

What I took away

When ten rounds of fixes haven’t closed a class of failure, the answer is upstream. Stop teaching the system to guess what the model meant. Make the model tell you.

What I was up against

The app had every feature a claims processor needed, but the features were scattered across four separate tabs. Watching real users showed me the obvious: nobody was working in the order the tabs implied. The product was technically complete and operationally exhausting at the same time.

How I worked through it

I rebuilt the workspace as a single master dashboard with three swap-in-place states — idle queue, claim case, member call — under one persistent header with global search and a KPI strip. The processor never has to leave the surface they’re working on; the surface adapts to whatever they pick up next.

// One container, three states swap inline.
function setActiveCase(kind, id) {
  switch (kind) {
    case 'idle': return renderQueue();        // landing + activity
    case 'case': return renderClaim(id);      // adjudicate + verify
    case 'call': return renderMember(id);     // member coverage call
  }
}

// "Done & Next" closes the case and drops back to IDLE for the next item.
async function completeAndContinue(action, id) {
  await fetch(`/api/review/${id}/action`, { method: 'POST', body: action });
  await refreshQueue();
  setActiveCase('idle');  // clean slate, processor moves on
}

What shipped

Built across four parallel feature branches in separate git worktrees, merged through an integration branch, then to main. The whole rebuild went out in one release without breaking the live product underneath.

What I took away

Five features that do the right thing aren’t a product — they’re an admin panel. The product is the path through them.

What I was up against

In a regulated workflow, the AI is not the decision-maker. The human is. I needed every AI output to be one click and one signature away from its source — and I needed the system to refuse to advance until that happened. No friction worth skipping. No way to skip even if you wanted to.

How I worked through it

I built verification into the core data model, not on top of it. Every AI answer carries a citation. Clicking the citation opens the source with the exact passage highlighted in place. The processor reads it, initials a confirmation, and only then does the next step unlock. The system literally does not let the work continue until the trust chain is complete.

// The next-step button stays disabled until every citation is signed off.
function canAdvance(step) {
  return step.citations.every(c => c.viewed && c.initialed);
}

// Citation click opens the source in-place and starts the sign-off flow.
function onCitationClick(citation) {
  openSourceWithHighlight(citation.section, citation.quote);
  citation.viewed = true;
  promptForInitials(citation);  // signed audit row written on submit
}

What shipped

Every decision in Bingo Claims now carries a signed audit trail tying a specific human to the specific source they verified. Compliance and engineering don’t have to argue about whether the AI is reliable — the audit trail tells them which human made which call against which evidence.

What I took away

In high-stakes work, trust isn’t something the AI earns over time. It’s something the workflow guarantees on every single step.