Agentic Governance and Adversarial Verification for Policy-Constrained LLM Healthcare Appeal Generation

May combine two claims.

Across all 1,000 AGVF cases, the mean number of citation-ungrounded assertions was 0.000 and the citation-grounding violation rate was 0.0%.

“Across all 1,000 AGVF cases the mean number of citation-ungrounded assertions is exactly 0.000, and the citationgrounding violation rate is 0.0%-every emitted assertion cites at least one verified fact, as Lemma 3.4 requires (Figure 4).”

May combine two claims.

When the gate was removed and two fabricated unsupported assertions were injected per case, the AGVF-Gates arm had exactly 2.000 citation-ungrounded assertions per case and a 100% grounding-violation rate.

“The AGVF-Gates arm, with the gate removed and two fabricated unsupported assertions injected per case, shows exactly 2.000 citation-ungrounded assertions per case and a 100% grounding-violation rate.”

May combine two claims.

When the citation-grounding gate was removed, the grounding-violation rate rose by 100 percentage points and fabricated assertions increased by 2.0 per case, with convergence and solved-rate unchanged.

“Removing the citation-grounding gate degrades the grounding-violation rate by +100 percentage points and adds +2.0 fabricated assertions per case, while leaving convergence and solved-rate untouched”

May combine two claims.

Validation on 1,000 synthetic appeal cases confirms zero citation-grounding violations across all AGVF cases and monotone deficiency reduction in every episode.

“The validation confirms implementation fidelity for the formal invariants: zero citation-grounding violations across all AGVF cases and monotone deficiency reduction in every episode”

• Also stated in: § 1.5 Key Contributions of This Paper · plain

  “validate on 1,000 synthetic cases that the implementation upholds its formal invariants: zero citation-grounding violations and monotone convergence in all AGVF episodes.”

May combine two claims.

The RAG baseline and the AGVF-Critic arm showed no citation-grounding violations.

“The RAG baseline and the AGVF-Critic arm likewise show no violations, because neither disables the gate.”

May combine two claims.

In every case and at every step, D(s) did not increase; the monotone-convergence rate was 100.0%.

“𝐷 (𝑠) is non-increasing at every step of every case: the monotone-convergence rate is 100.0%,matching Theorem 3.2 under the stated assumptions.”

May combine two claims.

Under explicit assumptions, AGVF's refinement over a fixed policy constraint graph monotonically reduces a formal evidence-deficiency potential and terminates either with a complete satisfying policy frontier or with a localized residual evidence gap.

“We prove that, under explicit assumptions, refinement over a fixed policy constraint graph monotonically reduces a formal evidence-deficiency potential and terminates either with a complete satisfying policy frontier or with a localized residual evidence gap.”

• Also stated in: § 1.5 Key Contributions of This Paper · plain

  “We prove that refinement over a static policy graph with append-only evidence monotonically reduces a formal deficiency potential and terminates in either a complete satisfying frontier or a residual evidence gap.”

• AssumptionThe authors state this as an assumption: Policy ingestion is invoked once per episode.
• AssumptionThe authors state this as an assumption: The evidence store is monotone, meaning verified facts are append-only and cannot be retracted mid-episode.
• AssumptionThe authors state this as an assumption: Coverage monotonicity: the probability of overturn is non-decreasing as satisfied obligations on a viable frontier accrue; equivalently, reward is non-increasing in deficiency.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Regulatory-template validation is a separate deterministic checklist interface in the reference implementation and is not evaluated as a statutory compliance guarantee in Section 5.

“Regulatory-template validation is a separate deterministic checklist interface in the reference implementation; it is not evaluated as a statutory compliance guarantee in Section 5.”

May combine two claims.

Because the citation-grounding invariant holds at every reachable state, it holds at the terminal state: the unsupported-assertion constraint is zero for the implemented predicate, discharging the corresponding CMDP constraint by construction rather than in expectation.

“Because Lemma 3.4 holds at every reachable state, it holds at the terminal 𝜏 * : C unsupported (𝜏 * ) = 0 for the implemented citation-admissibility predicate, discharging the corresponding CMDP constraint by construction rather than in expectation.”

• AssumptionRests on an assumption: Stochastic LLM outputs alone cannot guarantee that each generated assertion is tied to an admissible evidence source.

Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

In practice, policy ingestion is imperfect, and a real critic may be unsound or incomplete.

“Real policy ingestion is imperfect and a real critic may be unsound or incomplete”

May combine two claims.

The validation is a validation of implementation fidelity on a controlled synthetic benchmark, not a demonstration of real-world efficacy.

“This is a validation of implementation fidelity on a controlled synthetic benchmark, not a demonstration of real-world efficacy-we return to that distinction in Section 5.7.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The convergence guarantee depends on Assumption 1, a static and complete policy graph, and Assumption 3, a sound and complete critic/gap signal.

“The convergence guarantee relies on Assumptions 1 (a static, complete policy graph) and 3 (a sound and complete critic/gap signal).”

• AssumptionThe authors state this as an assumption: Within an episode, the policy graph is generated once, remains fixed, and represents the operative criteria.
• AssumptionThe authors state this as an assumption: The Critic does not contest obligations that are already anchored and does not conceal open obligations.

May combine two claims.

Self-refinement methods offer no termination or admissibility guarantee; the loop may oscillate, plateau, or improve toward a fluent but unsupported output.

“Second, self-refinement methods offer no termination or admissibility guarantee: the loop may oscillate, plateau, or”

• cites [7]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [12]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable).

To measure efficacy credibly, one needs clinician- or payer-adjudicated outcomes on real de-identified cases.

“A credible efficacy measure requires clinician-adjudicated or payer-adjudicated outcomes on real de-identified cases”

May combine two claims.

AGVF's refinement game is played on a fixed, finite policy-constraint board with a monotone evidence store, which forces non-increasing deficiency.

“Unlike unconstrained debate-where convergence is not guaranteed [4]-AGVF's game is played on the fixed, finite board 𝐺 𝐾 with a monotone evidence store.This structure forces non-increasing deficiency, as we now show.”

• cites [4]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• AssumptionThe authors state this as an assumption: Policy ingestion is invoked once per episode.
• AssumptionThe authors state this as an assumption: The evidence store is monotone, meaning verified facts are append-only and cannot be retracted mid-episode.

May combine two claims.

Generate-critique-revise loops measurably improve LLM output, motivating AGVF's refinement structure.

“These methods establish that a generate-critique-revise loop measurably improves LLM output, which motivates AGVF's refinement structure.”

• cites [7]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [12]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Because each agent contract is checkable at the orchestrator boundary, a misbehaving agent can be caught before it silently corrupts the loop, providing an operational safeguard for the assumptions the proofs rely on.

“Because each contract is checkable at the orchestrator boundary, a misbehaving agent (e.g., a Critic that violates soundness or hides open obligations) can be caught before it silently corrupts the loop-an operational safeguard for the assumptions the proofs rely on.”

May combine two claims.

The study uses no real patient records and does not measure clinical efficacy or payer-overturn outcomes.

“The study uses no real patient records and does not measure clinical efficacy or payer-overturn outcomes.”

May combine two claims.

When the deterministic gate is active, assertions lacking valid citations cannot enter shared state; when it is absent, every injected case becomes contaminated.

“The contrast is categorical rather than incremental: with the deterministic gate in place, citation-free or invalidly cited assertions cannot enter shared state; without it, every injected case is contaminated.”

Probably not a substantial claim: may not pass S4 (based).

For an agentic LLM system facing hard external constraints, representing those constraints as a formal graph and using deterministic gates for admissibility converts an unbounded generation problem into a bounded, auditable one with explicit assumptions and testable invariants.

“when an agentic LLM system must satisfy hard external constraints, encoding those constraints as a formal graph and enforcing admissibility through deterministic gates-instead of relying only on prompting or post-hoc review-turns an unbounded generation problem into a bounded, auditable one with explicit assumptions and testable invariants.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The one-obligation-per-round reveal limit affects solved-rate and round-count differences between arms; these should be interpreted as descriptive of loop behavior, not as efficacy comparisons.

“Solved-rate and round-count differences across arms are influenced by the one-obligation-per-round reveal limit and should be read as descriptive of loop behavior, not as efficacy comparisons.”

May combine two claims.

Neither debate nor Tree-of-Thought offers convergence or compliance guarantees; free-form debate may not converge.

“Neither method, however, offers convergence or compliance guarantees; even the debate literature acknowledges that free-form debate may not converge.”

• cites [4]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Section 5 does not evaluate statutory compliance because no jurisdiction-specific checklist is populated.

“a regulatory-template checker, but Section 5 does not evaluate statutory compliance because no jurisdiction-specific checklist is populated.”

May combine two claims.

The study neither shows nor can show that AGVF improves appeal outcomes.

“It does not, and cannot, show that AGVF improves appeal outcomes.”

May combine two claims.

All cases, denial framings, clinical evidence items, and obligation labels were fabricated, so the study addresses controlled system behavior rather than clinical reality.

“every case, denial framing, clinical evidence item, and obligation label is fabricated; the study therefore speaks to controlled system behavior, not clinical reality.”

May combine two claims.

AGVF restricts critique to a fixed policy-constraint board and pairs refinement with deterministic gates, which produces the guarantees in Section 3.

“AGVF restricts critique to a fixed policy-constraint board and pairs refinement with deterministic gates, which is what produces the guarantees in Section 3.”

• AssumptionRests on an assumption: Single-agent LLM/RAG architectures are poorly matched to high-stakes administrative healthcare because they may introduce unsupported clinical details, lose hierarchical policy structure, and provide weak post-hoc evidence.

May combine two claims.

Under the implemented gates, the citation-grounding and convergence invariants do not depend on the LLM, so they carry over at the control-logic level.

“The citation-grounding and convergence invariants are LLM-independent under the implemented gates, so they transfer at the control-logic level”

May combine two claims.

Because the deficiency engine is deterministic and the model is a mock, the critic's contested-obligation set matched the gap-analysis output, making the critic indistinguishable in this setting.

“with a deterministic deficiency engine and a mock model, the critic's contested-obligation set coincides with the gap-analysis output, so the critic cannot be differentiated here.”

May combine two claims.

With the benchmark evidence source, the system either fully satisfies the criterion or reports the remaining gap; it does not fabricate to close a gap.

“operational expression of Theorem 3.2's dichotomy under the benchmark evidence source: the system either fully substantiates the criterion or reports what remains missing; it does not close a gap by fabrication.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The paper does not claim that its formal result proves real-world overturn probability.

“We do not claim that this proves real-world overturn probability.”

Probably not a substantial claim: may not pass S4 (based).

Framing medical-necessity appeal generation as constrained multi-agent refinement over a policy graph with deterministic admissibility gates is novel to this work.

“To our knowledge, framing medical-necessity appeal generation as constrained multi-agent refinement over a policy graph with deterministic admissibility gates is novel to this work.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Multiple LLM instances debating over several rounds improves factual accuracy, and Tree-of-Thought search lets a model explore alternative reasoning paths before committing.

“Having multiple LLM instances debate over several rounds improves factual accuracy [4], and Tree-of-Thought search lets a model explore alternative reasoning paths before committing [13].”

• cites [4]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [13]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

The merge step is append-only for verified facts, so no agent can retract a previously grounded fact mid-episode.

“This makes the monotone-evidence assumption (Assumption 2) enforceable in code: the merge step is append-only for verified facts, so no agent can retract a previously grounded fact mid-episode.”

• AssumptionThe authors state this as an assumption: The evidence store is monotone, meaning verified facts are append-only and cannot be retracted mid-episode.

Probably not a substantial claim: may not pass S4 (based). May combine two claims. The quote only partly states this claim.

AGVF checks admissibility on the write path; no assertion enters the draft unless it cites verified evidence in the record, so the human reviewer audits a document whose claims are citation-grounded by construction.

“No assertion enters the draft unless it cites verified evidence in the record, so the human reviewer audits a document whose claims are citation-grounded by construction.”

• AssumptionRests on an assumption: In a regulatory setting, a fluent but unsupported statement is a liability that can implicate fraud statutes when it enters a payer-facing document.

May combine two claims.

AGVF replaces open-ended self-feedback with refinement bounded by a formal constraint graph and a deficiency potential, yielding monotone convergence of Theorem 3.2, and replaces soft self-critique with a deterministic citation-grounding gate, yielding the admissibility invariant of Lemma 3.4.

“AGVF replaces open-ended self-feedback with refinement bounded by a formal constraint graph and a deficiency potential, yielding the monotone convergence of Theorem 3.2, and replaces soft self-critique with a deterministic citation-grounding gate, yielding the admissibility invariant of Lemma 3.4.”

• AssumptionRests on an assumption: Single-agent LLM/RAG architectures are poorly matched to high-stakes administrative healthcare because they may introduce unsupported clinical details, lose hierarchical policy structure, and provide weak post-hoc evidence.

Classified as probably not a substantial claim.

The guarantees are constructive.

“The guarantees are constructive”

Classified as probably not a substantial claim.

The implementation evaluated in Section 5 is intentionally narrower: hand-formalized policy graphs, synthetic oracle-labeled evidence pools, exact-key retrieval, a deterministic mock LLM, and a sound deterministic critic.

“The implementation evaluated in Section 5, however, is intentionally narrower: hand-formalized policy graphs, synthetic oracle-labeled evidence pools, exact-key retrieval, a deterministic mock LLM, and a sound deterministic critic.”

Classified as probably not a substantial claim.

The unsupported-assertion constraint is enforced as a hard, deterministic citation-admissibility gate inside the Synthesis operator.

“The unsupported-assertion constraint C unsupported (𝜏) = 0 of the CMDP is enforced not as a soft penalty but as a hard, deterministic citation-admissibility gate inside the Synthesis operator.”

• AssumptionRests on an assumption: Stochastic LLM outputs alone cannot guarantee that each generated assertion is tied to an admissible evidence source.

Classified as probably not a substantial claim. May combine two claims.

The citation-grounding guarantee is a syntactic admissibility guarantee and should not be confused with full semantic entailment; a separate verifier is needed to prove that the wording of a cited assertion is completely entailed by the cited span.

“It should not be confused with full semantic entailment: a separate verifier is needed to prove that the wording of a cited assertion is completely entailed by the cited span.”

May combine two claims.

The study did not fully exercise end-to-end LLM retrieval quality, adversarial critique, synthesis fluency, or semantic faithfulness; reported latencies reflect loop overhead, not production model inference.

“end-to-end LLM retrieval quality, adversarial critique, synthesis fluency, and semantic faithfulness are not fully exercised, and reported latencies reflect loop overhead rather than production model inference.”

Classified as probably not a substantial claim.

AGVF's deterministic citation-grounding gate prevents assertions without admissible evidence citations from entering shared state.

“We also define a deterministic citation-grounding gate that prevents assertions without admissible evidence citations from entering shared state.”

• AssumptionRests on an assumption: Stochastic LLM outputs alone cannot guarantee that each generated assertion is tied to an admissible evidence source.

May combine two claims.

The citation-grounding and monotone-deficiency properties hold by construction from the formal results; the purpose of the study is to verify that the implementation honors them and to quantify the effect of removing the mechanisms that enforce them.

“The citation-grounding and monotone-deficiency properties hold by construction (Lemmas 3.1-3.4,Theorem 3.2); the purpose of the study is therefore to verify that the implementation honors them and to quantify the effect of removing the mechanisms that enforce them.”

• AssumptionThe authors state this as an assumption: Policy ingestion is invoked once per episode.
• AssumptionThe authors state this as an assumption: The evidence store is monotone, meaning verified facts are append-only and cannot be retracted mid-episode.
• AssumptionThe authors state this as an assumption: Coverage monotonicity: the probability of overturn is non-decreasing as satisfied obligations on a viable frontier accrue; equivalently, reward is non-increasing in deficiency.