I Built an AI agent that is not allowed to decide anything

A developer built Day Three, an AI agent for the All Things Agentic Hackathon that tracks discharged mothers along WHO and Indian clinical schedules to identify which newborns need urgent care. The system, running on Google Cloud Run with Gemini models, is architecturally constrained so the LLM cannot make clinical decisions—it only drafts messages and flags cases, with a human nurse confirming any symptom absence. Testing showed zero changes in triage decisions when the model was disabled, and all adversarial inputs were caught or fell back to nurse review.

Most newborn deaths occur in the first week of life, and Day 3 is the single most critical window. By day three, the mother has been discharged from the primary health centre, the baby who has stopped feeding or is running a fever is miles away from a clinic, and nobody makes the phone call. An Auxiliary Nurse-Midwife ANM at a rural clinic might have thirty-eight mothers discharged this month. She physically cannot call them all. This project was created for the purposes of entering the All Things Agentic Hackathon. It is called Day Three . It runs on Google Cloud Run with Firestore, Gemini 3.7 / 3.5 Flash, and Google ADK, and it solves one concrete problem: Which mother needs to be seen before tomorrow? Live Prototype: https://day-three-vypiu34uhq-el.a.run.app/?seed=3 https://day-three-vypiu34uhq-el.a.run.app/?seed=3 Code: https://github.com/Shivang-creator/day-three https://github.com/Shivang-creator/day-three Day Three tracks discharged mothers along official clinical schedules WHO Postnatal Care 2022 and India's Home-Based Newborn Care guidelines . At each contact ladder rung Day 1, 3, 7, 14, 42 , it ingests replies keypad digits, free text in Hindi/English, or silence and takes autonomous action: In high-stakes healthcare, an unconstrained LLM making medical diagnoses is dangerous. We built Day Three around strict architectural isolation: LlmAgent has four read-only tools read case , read rule , translate , draft message and receives a ReadOnlyStoreView with no write method. Prompt injections true or unknown . Any model-emitted false is rewritten to unknown . Only a human nurse or keypad form can confirm the absence of a symptom. core/ contains 28 transcribed WHO/NHM clinical rules with zero external imports, zero network calls, and zero wall-clock reads. make quiet-diff runs the entire 38-mother cohort with the model ON vs OFF: text QUIET DIFF: 0 decision changes · 4 prose fields differ All 38 clinical triage decisions remain byte-for-byte identical; only the prose strings fall back to pre-reviewed templates. The Honest Limits We tested 33 adversarial replies Hinglish, prompt injections, obfuscated self-harm . All 7 that reached the real model under free-tier quota were caught. The other 26 fell to safe nurse review fallback—zero slipped into routine. Every mother is synthetic, no clinician has formally reviewed the rule pack yet, and we state that clearly in the application banner. Built with Google ADK, Gemini 3.7/3.5 Flash, Gemma 2, Cloud Run, and Firestore.