So I reached out to a friend today using an ICM workspace I built as the pitch. He's the founder of a company that aggregates real-world health data from 130 million patients across US health systems. Their customers are pharma and medtech companies doing regulatory research. He posted on LinkedIn this morning about a breast cancer screening study his team published at ASCO. I sent him a message referencing the post, mentioned my mom and grandmother both had breast cancer, and their article caught my attention. Then, mentioned I was building something around a use case specific to his company. He liked the message within minutes. Built it and sent him the overview a few hours later. The workspace automates their internal research protocol review process, from the moment a researcher submits a study request all the way through risk scoring, reviewer assignment, compliance checks, and a final evidence package. Six stages, all connected, each one passing structured output to the next. Stuck to the 60/30/10 rule throughout the build. The folder structure and config files do the heavy lifting. The stage contracts handle the routing and rules. The AI runs the whole thing but only makes judgment calls in three stages: classifying the request, scoring risk, and drafting the protocol. Stage three is a straight lookup against the reviewer matrix. The files make the decision, not the AI. Ran a test protocol through it, a cardiovascular outcomes study using GLP-1 data. It classified the protocol as CRITICAL, scored it 5/5 on risk, assigned four reviewers with deadlines, caught a conflict of interest I didn't program it to look for, confirmed HIPAA and 21 CFR Part 11 compliance, and generated a full HTML report. All from one prompt. Twelve files. No code. The angle I'm pitching isn't just internal use. His pharma customers run the same painful protocol process on their end. This becomes something he could offer them, a workflow layer on top of their data platform that makes their customers stickier.

Wondering how to effectively screen for malicious stuff in AI beyond just reading the .md files and stuff because there can be a lot of them. And for some of the opensource tools being installed via Node.js npm commands, how do you screen those before they get installed? Saw a thing going around about the Shai Halud worm and it looked new enough to be concerning but old enough to not be sure if it was fixed already. But definitely feels like the era of early internet where you had to be careful of trojan horses and image files with .exe endings.