Health plan's prior-auth agent approved a procedure outside coverage policy
A regional health plan's prior-auth agent approved a procedure that the company's medical policy explicitly excluded. The provider proceeded based on the approval. The plan paid the claim and triggered an internal review.
Agentic action error in healthcare is not a chat transcript. It is a claim, a procedure, and a regulator letter waiting to happen.
Key facts
- What
- A regional health plan's prior-auth agent approved a procedure that the company's medical policy explicitly excluded.
- Incident date
- Jan 29, 2026
- Who
- Anonymized: Health Plan · US · regional, 2M+ members
- Failure mode
- Agentic Action Error
- AI surface
- Agentic Workflow
- Severity
- High
What happened
A regional US health plan deployed an agent to handle low-complexity prior-authorization decisions. In early 2026, the agent approved a procedure that the plan's medical policy explicitly excluded. The provider performed the procedure based on the auth. The plan paid the claim, ate the cost, and triggered an internal review that paused agent-authored auths for procedures above a complexity threshold.
The case is anonymized at the plan's request. The pattern is what every payer with an agentic prior-auth workflow should expect.
What broke inside the model
- 01 · TriggerAn agent plans a multi-step task.
- 02 · Model stepIt chooses a wrong or destructive action.
- 03 · Control gapNo confirmation gate guards the write.
- 04 · FailureThe action commits to a system of record.
- 05 · ConsequenceData is changed or destroyed irreversibly.
A wrong action commits, and the step is written before anything can stop it.
Agentic action error. The agent had access to the approval tool. The medical-policy boundary was implemented as a context document the agent was supposed to read. The agent read the document, weighed it against the case, and approved anyway. The boundary was guidance, not enforcement.
What it cost
Claim paid outside policy, internal review costs, vendor renegotiation
Sources
- Customer-DisclosedRealm Labs case file under NDAfailureindex.ai
Cite this entry
https://failureindex.ai/failures/anonymized-healthcare-prior-auth-agent-policy-violationAI Failure Index. "Health plan's prior-auth agent approved a procedure outside coverage policy" (FI-0025). Realm Labs. https://failureindex.ai/failures/anonymized-healthcare-prior-auth-agent-policy-violation (indexed May 13, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0025. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
- AgentRealm
AgentRealm inspects each approval the agent is about to commit against the plan's medical policy as authoritative ground truth. Approvals outside policy fail the runtime check before the auth is issued. The procedure either gets routed to a human reviewer or denied per policy. The case becomes a sample log entry instead of a claim payout and an internal review.