The technical limits of LISA's guardrails: what the agent does, what it never does, and why

An AI agent in healthcare is not useful because it answers everything. It is useful because it answers correctly, within explicit limits, and knows when to stop. This article describes, in technical terms, how LISA's guardrails work today across the three formats it uses to communicate with patients: text, audio, and live calls.

The core principle: nothing reaches the patient without human approval

This is not a code of conduct: it is a system property. All patient-facing content goes through human review before release. Without approval, there is no link and no sending. What was approved stays frozen in the activation: if the content changes later, sending is blocked until it is approved again.

Release is explicit too. The release button first shows a system summary: how many patients will be included and who was left out, with the reason. Patients with pending issues are never included in the batch.

The same principle applies before content even exists: importing a patient base creates or updates profiles, and nothing more. No agent is activated and no message is generated or sent without an explicit activation.

Text: frozen content, not improvisation

In text, the patient does not talk to a model generating clinical answers on the fly. The main channel is the secure link: a private page with texts, audio and videos already approved by the team. It never sends anything by itself; the operator copies the access and decides how to share it.

When the patient chats, LISA introduces itself as an AI assistant. Its role there is bounded: welcome, organize questions, and call the team when needed. It gives no new clinical advice. Clinical answers come from the team, through the live chat. If there is a delay, LISA sends short, gentle follow-ups, always addressing the patient by name.

Secure link access is individual: a unique short code per person, or their CPF (Brazilian tax ID). Repeated attempts are blocked. Links last 30 days and can be revoked at any time. And the patient always sees the version approved and frozen at release time: if the content changes later, the old link stops working. There is never access to an altered version without new approval.

Audio: the voice reads the approved script, version by version

In audio, LISA does not improvise speech. The process starts with the full script: a greeting with the patient's name, care and verbatim clinical instructions, and a closing. That script is converted into the official voice. Approval applies only to the exact version shown on the review screen; regenerating the audio requires a new approval.

Script editing is restricted to administrators and creates a new pending version, invalidating the derived audio, video and links in a chain. Each step is recorded on the client's timeline, with version and status.

The same logic applies to video: the approved audio is synced to the official avatar in vertical format. The Video Studio prepares visual templates, but it does not change approved scripts or audio, and it does not generate or send the final video.

Live calls: one policy per journey, with a usage ceiling

Live voice is the most sensitive format, and it is where the limits are hardest. Today it works only on internal test links, in simulated mode, at no cost. The test link opens only for the operator; nothing is sent to the patient.

Each journey has its own voice policy, with explicit limits: 5 minutes per call, 3 calls per day, and a paid ceiling of 0 minutes per month. The policy state is visible per journey: approved and active in Diagnostic, in draft in Recovery, and nonexistent in Treatment and Pediatrics. No approved policy, no call.

Escalation to humans: the queue is part of the design

The most important limit of a healthcare agent is not technical: it is knowing what is not its job. When the patient asks to speak with the team, the case goes to the human queue and appears in the team's live chat, with the conversation context. Clinical answers remain with people.

Specialized agents reflect the same design. The post-consultation agent, for example, turns the physician's dictation and prescription into a clear draft for human approval, and never sends anything on its own.

Consent and revocation

The patient base uploaded by the institution is considered authorized for contact, and LISA records that consent with date and owner, in an auditable record linked to the profile. If a patient asks not to be contacted, the profile is archived or access is revoked.

In messaging channels, the limit is operational too: in WhatsApp test mode, only opted-in numbers receive messages, and each message is revalidated before sending.

What LISA does not do

• It does not choose procedures or treatment: clinical content comes from what the team approved, verbatim.
• It sends nothing on its own: neither an import, nor a secure link, nor an agent fires without explicit human action.
• It gives no new clinical advice in chat: it welcomes, organizes and escalates.
• It makes no live calls outside internal test mode.
• It sends no WhatsApp messages outside test mode and without opt-in.
• It does not replace clinical judgment: the decision and the final word always belong to the team.

These limits are not temporary restrictions waiting to be removed. They are what makes it possible to place an agent in the patient journey safely: every format has a ceiling, every send has an owner, and every exception has a human on the other side.

The right question about an AI agent in healthcare is not "what can it do?", but "what was it designed never to do?". In LISA, that answer lives in the system: approval before any send, content frozen per version, explicit usage ceilings, escalation to humans, and revocation at any moment.