NemoClaw Agentic Workflows & PHI Security
Deploying agents in clinical environments requires isolating Protected Health Information (PHI) while permitting models to execute reasoning loops. NemoClaw combines foundation models with a ReAct orchestration layer to implement strict de-identification/re-identification boundaries.
Fleet overview
Git repository
GitHub / GitLab — source of truth
commit → webhook
ArgoCD hub
Management cluster, ApplicationSets
→
EKS
AWS prod
AKS
Azure prod
GKE
GCP prod
kubeadm
DC primary
RKE2
DC secondary
OpenShift
Regulated DC
Cluster labels (ArgoCD cluster secret annotations)
eks-us-east-prod
flavor:eks
env:prod
gpu:true
compliance:hipaa
aks-eastus-prod
flavor:aks
env:prod
gpu:true
compliance:hipaa
gke-us-central-prod
flavor:gke
env:prod
gpu:true
compliance:hipaa
dc1-kubeadm-prod
flavor:kubeadm
env:prod
gpu:true
compliance:hipaa
dc2-rke2-prod
flavor:rke2
env:prod
gpu:true
compliance:hipaa
dc3-ocp-regulated
flavor:openshift
env:prod
gpu:true
compliance:hipaa,hitrust
ApplicationSet pattern (platform addons fleet)
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
name: platform-addons
namespace: argocd
spec:
generators:
- clusters:
selector:
matchLabels:
platform: healthcare-ai # targets all 6 clusters
template:
metadata:
name: 'platform-{{name}}'
spec:
project: platform
source:
repoURL: https://github.com/org/platform-iac
path: addons/{{metadata.labels.flavor}} # per-flavor path
targetRevision: HEAD
destination:
server: '{{server}}'
syncPolicy:
automated:
prune: true
selfHeal: true
retry:
limit: 3
Addon deployment matrix — flavor-specific overrides
| Addon | Cloud (EKS/AKS/GKE) | On-prem (kubeadm/RKE2) | OpenShift |
|---|---|---|---|
| Cilium CNI | deployed | deployed | — OVN-Kubernetes (built-in) |
| Istio service mesh | |||
| MetalLB | — cloud LB used | ||
| Cloud CSI driver | EBS/Disk/PD | — Longhorn / Rook-Ceph | — ODF (Ceph) |
| Longhorn storage | — cloud CSI used | — ODF used | |
| Kyverno | — SCC + OPA only | ||
| OPA Gatekeeper | |||
| Nvidia GPU Operator | via OperatorHub | ||
| cert-manager | |||
| NemoClaw / NIM |
Step through a complete NemoClaw agent reasoning cycle for a clinical drug interaction check. The agent uses a Reason → Act → Observe loop until it has enough information to synthesize a safe clinical output.
PHI data journey — from EHR to clinical AI output
EHR / source systems
Epic, Cerner, or Meditech emits clinical events. SMART on FHIR app launches in EHR context with scoped access token (patient/*.read).
Epic SMART on FHIRCerner MillenniumHL7 v2 ADT feedsDICOM modalities
FHIR R4 ingestion — namespace: clinical-data
Incoming FHIR resources validated (schema + terminology), persisted to Hapi FHIR server. HL7 v2 converted via FHIR Converter. DICOM metadata indexed. All writes trigger an audit event.
Hapi FHIR R4 serverHL7 v2 → FHIR ConverterDICOM → DICOMweb adapterAudit: write logged
De-identification pipeline
Before any data reaches AI agents, the de-ID pipeline strips all 18 HIPAA Safe Harbor identifiers using NLP + rule-based detectors. A secure token maps the de-identified payload back to the original patient record.
18 HIPAA identifier removalNLP NER (dates, names, MRN)Secure re-link token issuedReversible only by clinical-data ns
NemoClaw agents — namespace: nemo-agents
Agent Supervisor receives the de-identified payload and routes to the appropriate clinical agent. Agents operate entirely on de-identified data. Tool calls back to clinical-data namespace are authenticated via mTLS service identity and audit-logged.
De-identified payload onlymTLS service identity (SPIFFE)Tool calls audit-loggedReAct reasoning loop
NIM LLM inference — namespace: ai-platform
NemoClaw calls NIM or Triton for LLM reasoning. De-identified clinical context is included in the prompt. NeMo GuardRails validates the model output for clinical safety before returning to the agent.
NIM API (no PHI in prompt)Triton Inference ServerNeMo GuardRails validationGPU-resident, no egress
Re-identification & output delivery
Clinical AI output is re-linked to the patient record using the secure token held by the clinical-data namespace. The output is written as a FHIR Communication or ClinicalImpression resource and delivered to the clinician's EHR session.
Secure token re-links to MRNOutput → FHIR CommunicationDelivered to EHR SMART contextClinician review + sign-off
Immutable audit trail
Every PHI access, de-ID operation, agent tool call, LLM inference, and clinical output delivery is appended to an immutable log store (WORM). Logs are shipped to the SIEM for HIPAA audit readiness and stored for 7 years minimum.
User ID + timestamp + actionPHI resource accessedWORM log store (7-year retain)Splunk / Elastic SIEM
IaC monorepo structure
platform-iac/
├── clusters/ Cluster API + Crossplane manifests
│ ├── cloud/
│ │ ├── eks/ AWS CAPA ClusterClass + MachinePool
│ │ ├── aks/ Azure CAPZ ClusterClass + MachinePool
│ │ └── gke/ GCP CAPG ClusterClass + NodePool
│ └── onprem/
│ ├── kubeadm/ CAPD/CAPH machine + kubeadmControlPlane
│ ├── rke2/ CAPRKE2 cluster + machine config
│ └── openshift/ IPI install-config + MachineConfig
│
├── addons/ Helm + Kustomize add-on configs per flavor
│ ├── networking/ Cilium, Istio, Gateway API, MetalLB
│ ├── storage/ CSI drivers, Longhorn, Rook-Ceph, Velero
│ ├── monitoring/ Prometheus stack, Grafana, Loki, OTel
│ ├── security/ OPA, Kyverno, Falco, Trivy, cert-manager
│ └── gpu/ GPU Operator, Network Operator, DCGM
│
├── ai-platform/ Nvidia NIM, Triton, vLLM, KServe
│ ├── nim/ NIM deployment manifests + model config
│ ├── triton/ Triton server + model repository config
│ ├── vllm/ vLLM deployment + quantisation config
│ └── kserve/ InferenceService + ServingRuntime CRDs
│
├── nemo/ NemoClaw agent framework workloads
│ ├── agents/ Agent Supervisor, tool registry, ReAct config
│ ├── guardrails/ NeMo GuardRails config + clinical policies
│ ├── milvus/ Milvus vector DB + embedding pipeline
│ └── redis/ Redis cluster for short-term agent memory
│
├── clinical/ PHI-scoped healthcare workloads
│ ├── fhir/ Hapi FHIR R4 server + PostgreSQL
│ ├── hl7/ HL7 v2 broker + FHIR Converter
│ └── deid/ De-identification pipeline + token store
│
├── gitops/ ArgoCD App of Apps bootstrap
│ ├── bootstrap/ ArgoCD self-install + root app
│ ├── platform-appset.yaml Deploys addons to all clusters
│ ├── ai-appset.yaml Deploys AI platform (gpu=true selector)
│ └── clinical-appset.yaml PHI workloads (compliance=hipaa selector)
│
└── terraform/ Cloud prerequisites only (VPC, IAM, KMS)
├── modules/ eks-prereqs, aks-prereqs, gke-prereqs
└── environments/ dev / staging / prod tfvars
Key convention — each addons/<flavor>/ directory holds a Kustomize base shared with addons/common/ and applies flavor-specific patches. The ArgoCD ApplicationSet resolves {{metadata.labels.flavor}} at sync time so a single ApplicationSet serves all 6 cluster flavors from one template.
Safety & Guardrails for Clinical AI
Workloads deployed inside the clinical-apps and clinical-data namespaces must implement strict boundary parameters using K8s native admission policies and service meshes:
1. Cilium Network Policy — Clinical Data Namespace Isolation
Enforces strict zero-trust isolation on the clinical-data namespace, preventing arbitrary traffic ingress and egress.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: clinical-data-isolation
namespace: clinical-data
spec:
endpointSelector: {}
ingress:
- fromEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: nemo-agents
toPorts:
- ports:
- port: "8080"
protocol: TCP
rules:
http:
- method: GET
path: /fhir/r4/.*
- fromEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: clinical-apps
- fromEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: monitoring
toPorts:
- ports:
- port: "9090"
egress:
- toEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
namespace: clinical-data
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
2. Istio PeerAuthentication & AuthorizationPolicy
Enforces strict mTLS in-transit encryption and explicitly validates SPIFFE identities.
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: clinical-data-mtls-strict
namespace: clinical-data
spec:
mtls:
mode: STRICT
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: fhir-server-allow
namespace: clinical-data
spec:
selector:
matchLabels:
app: hapi-fhir
action: ALLOW
rules:
- from:
- source:
principals:
- "cluster.local/ns/nemo-agents/sa/drug-interaction-agent"
- "cluster.local/ns/nemo-agents/sa/diagnostic-agent"
- "cluster.local/ns/nemo-agents/sa/radiology-agent"
- "cluster.local/ns/clinical-apps/sa/clinician-app"
to:
- operation:
methods: ["GET"]
paths: ["/fhir/r4/*"]
when:
- key: request.auth.claims[aud]
values: ["fhir-server"]
3. Istio Egress Gateway for External Tool APIs
Forces all external agent requests through a centralized, audited egress gateway.
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: drugbank-external
namespace: nemo-agents
spec:
hosts:
- api.drugbank.com
ports:
- number: 443
name: https
protocol: HTTPS
location: MESH_EXTERNAL
resolution: DNS
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: nemo-agents-egress
namespace: nemo-agents
spec:
hosts:
- api.drugbank.com
- api.fda.gov
tls:
- match:
- port: 443
route:
- destination:
host: istio-egressgateway.istio-system.svc.cluster.local