Business Rules & Guardrails

system_prompt = """You are processing expense reports.

Rules:
- Meals: $50/day maximum
- Hotels: $200/night maximum  
- Flights: Economy only, except >5 hours
- Receipts required for purchases >$25
- Manager approval needed for >$500 total
"""

from typing import Literal
from pydantic import BaseModel
from datetime import datetime

class ExpenseValidation(BaseModel):
    """Validation result with full details."""
    approved: bool
    violations: list[str]
    warnings: list[str]
    approval_needed: list[str]
    total_amount: float

@tool()
async def validate_expense_report(
    expenses: list[dict],
    employee_id: str,
    trip_type: Literal["domestic", "international"],
    submission_date: str
) -> ExpenseValidation:
    """Validate expense report against company policy using deterministic rules.

    Use this when:
    - You have extracted line-item expenses and related trip metadata
    - You need a definitive policy decision computed by code
    
    Do NOT use for:
    - Free-form policy explanations without data
    - Submitting/approving to a system of record
    
    Args:
        expenses: List of expense objects with keys:
            - category: str ["meals", "lodging", "airfare", ...]
            - amount: float (USD)
            - date: str (ISO 8601 "YYYY-MM-DD")
            - receipt: bool|str (presence or URL)
            - category-specific fields (e.g., lodging: checkin, checkout, name)
        employee_id: str (e.g., "EMP-12345")
        trip_type: Literal["domestic", "international"]
        submission_date: str (ISO 8601)
    
    Returns:
        ExpenseValidation with approved status, violations, warnings, 
        approvals needed, and final total
    
    Example:
        Input:
            expenses = [{
                "category": "meals", 
                "amount": 62.5, 
                "date": "2025-10-12", 
                "receipt": True
            }]
            employee_id = "EMP-12345"
            trip_type = "domestic"
            submission_date = "2025-10-15"
        
        Output:
            ExpenseValidation(
                approved=False,
                violations=["Meals on 2025-10-12: $62.50 exceeds $50/day limit"],
                warnings=[],
                approval_needed=["manager_approval"],
                total_amount=62.5
            )
    """
    
    violations = []
    warnings = []
    approval_needed = []
    
    # Rule 1: Meal limits (deterministic check)
    meal_expenses = [e for e in expenses if e["category"] == "meals"]
    meals_by_day = {}
    
    for meal in meal_expenses:
        date = meal["date"]
        meals_by_day[date] = meals_by_day.get(date, 0) + meal["amount"]
    
    for date, total in meals_by_day.items():
        if total > 50:
            violations.append(
                f"Meals on {date}: ${total:.2f} exceeds $50/day limit"
            )
    
    # Rule 2: Hotel limits (deterministic check)
    hotels = [e for e in expenses if e["category"] == "lodging"]
    
    for hotel in hotels:
        checkin = datetime.fromisoformat(hotel["checkin"])
        checkout = datetime.fromisoformat(hotel["checkout"])
        nights = (checkout - checkin).days
        per_night = hotel["amount"] / nights if nights > 0 else hotel["amount"]
        
        if per_night > 200:
            violations.append(
                f"Hotel {hotel['name']}: ${per_night:.2f}/night exceeds $200 limit"
            )
    
    # Rule 3: Receipt requirements (deterministic check)
    for expense in expenses:
        if expense["amount"] > 25 and not expense.get("receipt"):
            violations.append(
                f"{expense.get('description', expense['category'])}: "
                f"Receipt required for amounts over $25"
            )
    
    # Rule 4: Flight class restrictions (deterministic with calculation)
    flights = [e for e in expenses if e["category"] == "airfare"]
    
    for flight in flights:
        duration_hours = calculate_flight_hours(
            flight["origin"],
            flight["destination"]
        )
        
        if flight.get("class") != "economy":
            if duration_hours <= 5:
                violations.append(
                    f"Flight {flight['number']}: Premium class only allowed "
                    f"for flights >5 hours (this flight: {duration_hours}h)"
                )
            else:
                warnings.append(
                    f"Flight {flight['number']}: Premium class approved "
                    f"(duration: {duration_hours}h)"
                )
    
    # Rule 5: Manager approval thresholds (deterministic calculation)
    total = sum(e["amount"] for e in expenses)
    
    if trip_type == "international":
        total *= 1.15  # International gets 15% buffer
        warnings.append("International trip: 15% buffer applied")
    
    if total > 500:
        approval_needed.append("manager_approval")
    
    if total > 2000:
        approval_needed.append("director_approval")
    
    # Rule 6: Q4 budget freeze (deterministic date logic)
    month = datetime.fromisoformat(submission_date).month
    
    if month >= 10:  # October-December
        approval_needed.append("budget_freeze_exception")
        warnings.append("Q4 submission requires budget exception approval")
    
    # Final decision: approved only if no violations
    approved = len(violations) == 0
    
    return ExpenseValidation(
        approved=approved,
        violations=violations,
        warnings=warnings,
        approval_needed=approval_needed,
        total_amount=total
    )

# Configure LLM and prompt
llm = ChatOpenAI(model="gpt-4o-mini", temperature=0)

system_prompt = """You are an expense processing assistant.

Workflow:
1. Extract expense information from user message
2. Validate using validate_expense_report tool
3. Explain results clearly and empathetically

When violations occur:
- Clearly state what's wrong
- Suggest specific fixes
- Explain approval requirements if needed"""

agent = create_agent(
    model=llm,
    tools=[validate_expense_report],
    system_prompt=system_prompt
)

async def process_expense_report(user_message: str):
    result = agent.invoke({"role": "user", "content": user_message})
    return result

async def process_expense_report(user_message: str):
    """Agent workflow: extract → validate → explain."""
    
    # Step 1: Agent extracts expense data (LLM handles natural language)
    extraction = await client.messages.create(
        model="claude-sonnet-4-20250514",
        messages=[{
            "role": "user",
            "content": f"""Extract expense information from this message:

{user_message}

Return JSON with:
{{
  "expenses": [
    {{
      "category": "meals|lodging|airfare|other",
      "amount": number,
      "date": "YYYY-MM-DD",
      "description": "...",
      "receipt": boolean
    }}
  ],
  "employee_id": "...",
  "trip_type": "domestic|international",
  "submission_date": "YYYY-MM-DD"
}}"""
        }]
    )
    
    expense_data = json.loads(extraction.content[0].text)
    
    # Step 2: Deterministic validation (code handles business logic)
    validation = await validate_expense_report(
        expenses=expense_data["expenses"],
        employee_id=expense_data["employee_id"],
        trip_type=expense_data["trip_type"],
        submission_date=expense_data["submission_date"]
    )
    
    # Step 3: Agent explains results (LLM handles communication)
    explanation = await client.messages.create(
        model="claude-sonnet-4-20250514",
        messages=[{
            "role": "user",
            "content": f"""Explain these validation results to the user:

Approved: {validation.approved}
Total: ${validation.total_amount:.2f}
Violations: {validation.violations}
Warnings: {validation.warnings}
Approvals needed: {validation.approval_needed}

Be empathetic but clear about violations. Suggest how to fix issues."""
        }]
    )
    
    return explanation.content[0].text

class AgentGuardrails:
    """Enforce business rules on agent actions."""
    
    async def pre_execution_check(
        self,
        tool_name: str,
        params: dict,
        context: dict
    ) -> tuple[bool, Optional[str]]:
        """Check if action is allowed BEFORE execution."""
        
        # Rule: Don't issue refunds >$500 without manager approval
        if tool_name == "issue_refund":
            if params["amount"] > 500:
                if not context.get("manager_approved"):
                    return False, "Refunds over $500 require manager approval"
        
        # Rule: Don't delete customer data without legal approval
        if tool_name == "delete_customer_data":
            if not context.get("legal_approved"):
                return False, "Data deletion requires legal department approval"
        
        # Rule: Don't send emails outside business hours (if customer preference set)
        if tool_name == "send_email":
            customer_tz = context.get("customer_timezone")
            if customer_tz:
                customer_time = datetime.now(pytz.timezone(customer_tz))
                hour = customer_time.hour
                
                if hour < 8 or hour > 20:
                    return False, f"Customer prefers no emails outside 8am-8pm {customer_tz}"
        
        # Rule: Rate limiting per session
        action_count = context.get("action_count", {})
        if action_count.get(tool_name, 0) >= 5:
            return False, f"Rate limit: '{tool_name}' called 5 times already"
        
        return True, None
    
    async def post_execution_check(
        self,
        tool_name: str,
        result: dict
    ) -> tuple[bool, Optional[str]]:
        """Validate result AFTER execution."""
        
        # Rule: Discount can't exceed 50%
        if tool_name == "calculate_discount":
            if result["discount_percent"] > 50:
                return False, "Discount exceeds maximum 50% allowed"
        
        # Rule: Shipping address must be validated
        if tool_name == "create_order":
            if not result.get("address_validated"):
                return False, "Order created with unvalidated shipping address"
        
        return True, None

# Integration with agent
guardrails = AgentGuardrails()

async def execute_tool_with_guardrails(
    tool_name: str,
    params: dict,
    context: dict
):
    """Safe tool execution with rule enforcement."""
    
    # Pre-check
    allowed, reason = await guardrails.pre_execution_check(
        tool_name, params, context
    )
    
    if not allowed:
        return {
            "success": False,
            "blocked": True,
            "reason": reason,
            "required_approvals": extract_approvals(reason)
        }
    
    # Execute
    result = await execute_tool(tool_name, params)
    
    # Post-check
    valid, reason = await guardrails.post_execution_check(tool_name, result)
    
    if not valid:
        # Rollback if possible
        await rollback_tool(tool_name, params)
        
        return {
            "success": False,
            "blocked": True,
            "reason": reason,
            "action_rolled_back": True
        }
    
    return result

from pydantic import BaseModel, validator, Field

class CustomerInput(BaseModel):
    """Validated customer input."""
    
    email: str = Field(
        ..., 
        regex=r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    )
    phone: str = Field(..., regex=r'^\+?1?\d{10,15}$')
    amount: float = Field(..., ge=0, le=100000)
    
    @validator('amount')
    def amount_reasonable(cls, v):
        """Ensure amount is within reasonable range."""
        if v > 10000:
            raise ValueError(
                "Amount exceeds $10,000. Contact support for large transactions."
            )
        return v
    
    @validator('email')
    def email_not_disposable(cls, v):
        """Block disposable email addresses."""
        disposable_domains = [
            'tempmail.com', 
            'throwaway.email', 
            'guerrillamail.com'
        ]
        domain = v.split('@')[1]
        
        if domain in disposable_domains:
            raise ValueError("Disposable email addresses not allowed")
        return v

@tool()
async def process_customer_request(
    email: str,
    phone: str,
    amount: float
) -> dict:
    """Process request with input validation."""
    
    try:
        # Validate inputs
        validated = CustomerInput(
            email=email,
            phone=phone,
            amount=amount
        )
        
        # Process with clean data
        result = await process_validated_data(validated.dict())
        return result
        
    except ValidationError as e:
        # Return validation errors to agent
        return {
            "success": False,
            "validation_errors": [
                f"{err['loc'][0]}: {err['msg']}" 
                for err in e.errors()
            ],
            "message": "Please correct the following and try again"
        }

class SecurityGuardrails:
    """Layered security checks for agent inputs and outputs."""
    
    def __init__(self):
        self.pii_detector = PIIDetector()
        self.jailbreak_detector = JailbreakDetector()
        self.toxicity_classifier = ToxicityClassifier()
    
    async def check_input(self, user_input: str) -> tuple[bool, str, dict]:
        """
        Check user input for security issues.
        
        Returns:
            (is_safe, sanitized_input, metadata)
        """
        metadata = {}
        
        # Layer 1: PII Detection and Redaction
        pii_result = await self.pii_detector.scan(user_input)
        
        if pii_result.contains_pii:
            metadata["pii_detected"] = pii_result.entities
            metadata["pii_redacted"] = True
            
            # Redact PII before processing
            sanitized = self.pii_detector.redact(user_input, pii_result.entities)
        else:
            sanitized = user_input
        
        # Layer 2: Jailbreak Detection
        jailbreak_result = await self.jailbreak_detector.analyze(sanitized)
        
        if jailbreak_result.is_jailbreak:
            metadata["jailbreak_detected"] = True
            metadata["jailbreak_type"] = jailbreak_result.attack_type
            
            return False, sanitized, metadata
        
        # Layer 3: Toxicity Check
        toxicity_result = await self.toxicity_classifier.predict(sanitized)
        
        if toxicity_result.is_toxic:
            metadata["toxicity_detected"] = True
            metadata["toxicity_score"] = toxicity_result.score
            
            return False, sanitized, metadata
        
        return True, sanitized, metadata
    
    async def check_output(self, agent_output: str) -> tuple[bool, str, dict]:
        """
        Check agent output before sending to user.
        
        Returns:
            (is_safe, sanitized_output, metadata)
        """
        metadata = {}
        
        # Layer 1: PII Leakage Prevention
        pii_result = await self.pii_detector.scan(agent_output)
        
        if pii_result.contains_pii:
            metadata["pii_leaked"] = pii_result.entities
            
            # Critical: Block output with PII from training data or other users
            if any(e.source != "user_session" for e in pii_result.entities):
                return False, "", metadata
            
            # Redact PII from current session
            sanitized = self.pii_detector.redact(agent_output, pii_result.entities)
        else:
            sanitized = agent_output
        
        # Layer 2: Content Policy Compliance
        policy_result = await self.check_content_policy(sanitized)
        
        if policy_result.violates_policy:
            metadata["policy_violation"] = policy_result.violation_type
            return False, sanitized, metadata
        
        return True, sanitized, metadata

import re
from typing import List, Literal
from presidio_analyzer import AnalyzerEngine
from presidio_anonymizer import AnonymizerEngine

class PIIDetector:
    """Detect and redact PII using multiple techniques."""
    
    def __init__(self):
        # Microsoft Presidio for NER-based detection
        self.analyzer = AnalyzerEngine()
        self.anonymizer = AnonymizerEngine()
        
        # Regex patterns for structured data
        self.patterns = {
            "ssn": r'\b\d{3}-\d{2}-\d{4}\b',
            "credit_card": r'\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b',
            "phone": r'\b\d{3}[-.]?\d{3}[-.]?\d{4}\b',
            "email": r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b'
        }
    
    async def scan(self, text: str) -> PIIResult:
        """Detect PII using multiple methods."""
        
        entities = []
        
        # Method 1: Presidio (NER + patterns)
        presidio_results = self.analyzer.analyze(
            text=text,
            language='en',
            entities=[
                "PERSON", "EMAIL_ADDRESS", "PHONE_NUMBER",
                "CREDIT_CARD", "US_SSN", "US_PASSPORT",
                "LOCATION", "DATE_OF_BIRTH", "MEDICAL_LICENSE"
            ]
        )
        
        for result in presidio_results:
            entities.append({
                "type": result.entity_type,
                "text": text[result.start:result.end],
                "start": result.start,
                "end": result.end,
                "score": result.score,
                "method": "presidio"
            })
        
        # Method 2: Regex patterns (for known formats)
        for pii_type, pattern in self.patterns.items():
            for match in re.finditer(pattern, text):
                entities.append({
                    "type": pii_type,
                    "text": match.group(),
                    "start": match.start(),
                    "end": match.end(),
                    "score": 1.0,
                    "method": "regex"
                })
        
        return PIIResult(
            contains_pii=len(entities) > 0,
            entities=entities
        )
    
    def redact(
        self, 
        text: str, 
        entities: List[dict],
        redaction_type: Literal["replace", "mask", "hash"] = "replace"
    ) -> str:
        """Redact PII from text."""
        
        if redaction_type == "replace":
            # Replace with entity type placeholder
            redacted = text
            for entity in sorted(entities, key=lambda e: e["start"], reverse=True):
                placeholder = f"[{entity['type']}]"
                redacted = (
                    redacted[:entity["start"]] + 
                    placeholder + 
                    redacted[entity["end"]:]
                )
            return redacted
        
        elif redaction_type == "mask":
            # Mask with asterisks (preserving length)
            redacted = text
            for entity in sorted(entities, key=lambda e: e["start"], reverse=True):
                mask = "*" * (entity["end"] - entity["start"])
                redacted = redacted[:entity["start"]] + mask + redacted[entity["end"]:]
            return redacted
        
        elif redaction_type == "hash":
            # Hash PII for consistency (same input → same hash)
            import hashlib
            redacted = text
            for entity in sorted(entities, key=lambda e: e["start"], reverse=True):
                pii_text = entity["text"]
                hashed = hashlib.sha256(pii_text.encode()).hexdigest()[:8]
                placeholder = f"[{entity['type']}_{hashed}]"
                redacted = (
                    redacted[:entity["start"]] + 
                    placeholder + 
                    redacted[entity["end"]:]
                )
            return redacted

# Example usage
async def process_with_pii_protection(user_input: str):
    """Process input with PII protection."""
    
    detector = PIIDetector()
    
    # Scan for PII
    pii_result = await detector.scan(user_input)
    
    if pii_result.contains_pii:
        # Log detection (for audit)
        logger.info(f"PII detected: {[e['type'] for e in pii_result.entities]}")
        
        # Redact before sending to LLM
        sanitized = detector.redact(user_input, pii_result.entities, "replace")
        
        # Process sanitized input
        response = await agent.process(sanitized)
        
        # Important: Map placeholders back in response if needed
        # (only if PII came from current user session)
        
        return response
    else:
        # No PII, process normally
        return await agent.process(user_input)

class JailbreakDetector:
    """Detect adversarial prompt injection attempts."""
    
    def __init__(self):
        # Pattern-based detection
        self.suspicious_patterns = [
            # Instruction override attempts
            r'ignore (all )?previous (instructions|prompts)',
            r'disregard (all )?previous (instructions|prompts)',
            r'forget (all )?previous (instructions|prompts)',
            r'you are now',
            r'new instructions:',
            r'system (prompt|message):',
            
            # Role manipulation
            r'you are a (DAN|evil|unrestricted)',
            r'act as (if )?you are',
            r'pretend (that )?you are',
            
            # Encoding tricks
            r'base64',
            r'rot13',
            r'reverse this',
            
            # Output manipulation
            r'output (only|just)',
            r'respond with exactly',
            r'your response must be',
        ]
        
        # Model-based detection (LlamaGuard or custom)
        self.llm_detector = None  # Initialize if available
    
    async def analyze(self, text: str) -> JailbreakResult:
        """Analyze text for jailbreak attempts."""
        
        # Method 1: Pattern matching (fast)
        pattern_score = self._pattern_match(text)
        
        # Method 2: Heuristics
        heuristic_score = self._heuristic_check(text)
        
        # Method 3: LLM-based detection (if available, slower)
        llm_score = 0
        if self.llm_detector:
            llm_score = await self._llm_detect(text)
        
        # Combine scores
        combined_score = max(pattern_score, heuristic_score, llm_score)
        
        return JailbreakResult(
            is_jailbreak=combined_score > 0.7,
            confidence=combined_score,
            attack_type=self._classify_attack(text) if combined_score > 0.7 else None
        )
    
    def _pattern_match(self, text: str) -> float:
        """Check for known jailbreak patterns."""
        text_lower = text.lower()
        
        matches = 0
        for pattern in self.suspicious_patterns:
            if re.search(pattern, text_lower):
                matches += 1
        
        # Normalize to 0-1 score
        return min(matches / 3, 1.0)
    
    def _heuristic_check(self, text: str) -> float:
        """Heuristic checks for manipulation attempts."""
        score = 0.0
        
        # Check 1: Unusual structure (many newlines, separators)
        if text.count('\n') > 10 or text.count('---') > 2:
            score += 0.3
        
        # Check 2: Multiple instruction-like phrases
        instruction_words = ['must', 'should', 'always', 'never', 'only', 'just']
        instruction_count = sum(1 for word in instruction_words if word in text.lower())
        if instruction_count > 5:
            score += 0.3
        
        # Check 3: Contains code blocks or encoding
        if '```' in text or 'base64' in text.lower():
            score += 0.2
        
        # Check 4: Excessive length (might hide injection)
        if len(text) > 5000:
            score += 0.2
        
        return min(score, 1.0)
    
    def _classify_attack(self, text: str) -> str:
        """Classify the type of jailbreak attempt."""
        text_lower = text.lower()
        
        if any(word in text_lower for word in ['ignore', 'disregard', 'forget']):
            return "instruction_override"
        elif any(word in text_lower for word in ['you are', 'act as', 'pretend']):
            return "role_manipulation"
        elif any(word in text_lower for word in ['base64', 'rot13', 'encode']):
            return "encoding_attack"
        elif any(word in text_lower for word in ['output only', 'respond with exactly']):
            return "output_constraint"
        else:
            return "unknown"

# Example usage
async def safe_agent_execution(user_input: str):
    """Execute agent with jailbreak protection."""
    
    detector = JailbreakDetector()
    
    # Check for jailbreak
    result = await detector.analyze(user_input)
    
    if result.is_jailbreak:
        logger.warning(
            f"Jailbreak detected: {result.attack_type} "
            f"(confidence: {result.confidence:.2f})"
        )
        
        # Return safe response without processing
        return {
            "success": False,
            "message": "Your request couldn't be processed. Please rephrase.",
            "reason": "security_policy"
        }
    
    # Safe to process
    return await agent.process(user_input)

from nemoguardrails import RailsConfig, LLMRails

# Define guardrails in Colang
config = RailsConfig.from_content(
    yaml_content="""
    models:
      - type: main
        engine: openai
        model: gpt-4
    
    rails:
      input:
        flows:
          - check pii
          - check jailbreak
          - check toxicity
      
      output:
        flows:
          - check pii leakage
          - check harmful content
    """,
    colang_content="""
    define flow check pii
      $pii_detected = execute detect_pii(input=$user_message)
      
      if $pii_detected
        bot inform pii detected
        stop
    
    define flow check jailbreak
      $is_jailbreak = execute detect_jailbreak(input=$user_message)
      
      if $is_jailbreak
        bot refuse jailbreak
        stop
    
    define flow check pii leakage
      $leaked = execute detect_pii(input=$bot_message)
      
      if $leaked
        bot apologize and ask to rephrase
        stop
    
    define bot inform pii detected
      "I noticed your message contains sensitive information. For your privacy, 
       I've removed it before processing. Let me help you with your request."
    
    define bot refuse jailbreak
      "I can't process that request. How else can I help you?"
    
    define bot apologize and ask to rephrase
      "I need to rephrase my response to protect sensitive information. 
       Let me try again."
    """
)

# Create rails
rails = LLMRails(config)

async def process_with_nemo_guardrails(user_input: str):
    """Process input through NeMo Guardrails."""
    
    response = await rails.generate_async(
        messages=[{"role": "user", "content": user_input}]
    )
    
    return response

async def production_agent_pipeline(user_input: str, context: dict):
    """
    Production agent with full guardrail stack.
    
    Security layers:
    1. Input validation (format, size)
    2. PII detection and redaction
    3. Jailbreak detection
    4. Business rule pre-checks
    5. Agent execution
    6. Business rule post-checks
    7. Output PII scan
    8. Content policy check
    """
    
    guardrails = SecurityGuardrails()
    business_rules = AgentGuardrails()
    
    try:
        # Layer 1: Input validation
        if len(user_input) > 10000:
            return error_response("Input too long")
        
        # Layer 2-4: Security checks
        is_safe, sanitized_input, security_metadata = await guardrails.check_input(
            user_input
        )
        
        if not is_safe:
            logger.warning(f"Security check failed: {security_metadata}")
            return safe_rejection_response(security_metadata)
        
        # Layer 5: Business rule pre-checks (if action proposed)
        # ... pre-execution validation ...
        
        # Layer 6: Agent execution
        agent_output = await agent.process(sanitized_input, context)
        
        # Layer 7: Business rule post-checks
        # ... post-execution validation ...
        
        # Layer 8-9: Output security checks
        is_safe_output, sanitized_output, output_metadata = await guardrails.check_output(
            agent_output
        )
        
        if not is_safe_output:
            logger.error(f"Output security check failed: {output_metadata}")
            # Trigger alert - this shouldn't happen
            return safe_fallback_response()
        
        return {
            "success": True,
            "response": sanitized_output,
            "metadata": {
                "pii_redacted": security_metadata.get("pii_redacted", False),
                **output_metadata
            }
        }
        
    except Exception as e:
        logger.error(f"Agent pipeline error: {e}")
        return error_response("An error occurred processing your request")

system_prompt = """Process insurance claims.

Rules:
- Covered: Doctor visits, prescriptions, ER, surgery
- Not covered: Cosmetic, experimental, out-of-network
- Pre-auth required: Surgery, MRI, specialist
- Deductible: $1000/year, then 80/20 co-insurance
- Out-of-pocket max: $5000/year
"""

@tool()
async def evaluate_insurance_claim(
    claim: dict,
    policy: dict,
    patient_ytd: dict
) -> ClaimDecision:
    """Evaluate claim with deterministic rules."""
    
    decision = ClaimDecision(approved=True, covered=0, patient_owes=0)
    
    # Rule 1: Coverage check (boolean logic - no ambiguity)
    if claim["procedure"] in COSMETIC_PROCEDURES:
        decision.approved = False
        decision.reason = "Cosmetic procedures not covered"
        return decision
    
    if claim["procedure"] in EXPERIMENTAL_PROCEDURES:
        decision.approved = False
        decision.reason = "Experimental procedures not covered"
        return decision
    
    # Rule 2: Network check (boolean logic)
    if claim["provider"] not in policy["network"]:
        if not claim.get("emergency"):
            decision.approved = False
            decision.reason = "Out-of-network non-emergency"
            return decision
    
    # Rule 3: Pre-authorization (boolean logic)
    if claim["procedure"] in REQUIRES_PREAUTH:
        if not claim.get("preauth_number"):
            decision.approved = False
            decision.reason = "Pre-authorization required"
            return decision
    
    # Rule 4: Cost calculation (arithmetic - 100% deterministic)
    billed = claim["amount"]
    
    # Negotiated rate
    allowed = min(billed, get_rate(claim["procedure"], claim["provider"]))
    
    # Deductible
    remaining_deductible = max(0, policy["deductible"] - patient_ytd["deductible_met"])
    deductible_applies = min(allowed, remaining_deductible)
    after_deductible = allowed - deductible_applies
    
    # Co-insurance (80/20)
    insurance_pays = after_deductible * 0.8
    patient_coinsurance = after_deductible * 0.2
    
    # Out-of-pocket max
    patient_ytd_oop = patient_ytd["out_of_pocket"]
    remaining_oop = max(0, policy["oop_max"] - patient_ytd_oop)
    
    # Adjust if hitting OOP max
    total_patient_cost = deductible_applies + patient_coinsurance
    
    if total_patient_cost > remaining_oop:
        # Insurance covers excess
        excess = total_patient_cost - remaining_oop
        insurance_pays += excess
        patient_coinsurance = remaining_oop - deductible_applies
    
    decision.covered = insurance_pays
    decision.patient_owes = total_patient_cost
    decision.breakdown = {
        "allowed_amount": allowed,
        "deductible": deductible_applies,
        "coinsurance": patient_coinsurance,
        "insurance_pays": insurance_pays
    }
    
    return decision

# Production results:
# - Accuracy: 78% → 99.7%
# - Processing time: 3 min → 5 sec
# - Cost per claim: $8 → $0.20
# - Compliance violations: 400/month → 2/month