Software Architecture

• PHI firewall built as a data-shape contract, not a filter

  The Python extraction pipeline's LLM-facing payload is a whitelist-constructed object that holds only codes, enums, and IDs. Narrative text is structurally excluded before it can reach a prompt sent to Anthropic's Claude API, and a second-layer scanner backs this up as defense in depth. (Medical Claim SaaS Platform, the reasoning service's PHI firewall)

• Split the domain into two aggregates joined loosely, not by foreign key

  The system is modeled as a forward-only document-pipeline state machine plus a separate 14-state user-facing case aggregate in PostgreSQL. A plain reference connects the two, so each can evolve and scale on its own. (Medical Claim SaaS Platform, the data model's two-record-type design)

• Enforced row-level entitlements by rewriting the SQL AST, not by filtering in application code

  Model-authored SQL gets parsed with node-sql-parser, in TypeScript. Every gated table reference is replaced with a pre-filtered subquery before execution, so a locked resource can't come back, even if it's named directly in the query. (Payor Rate Data Platform, the web layer's SQL entitlement fence)

• Separated the served product from the raw option value in the data model itself

  Only a small served code set gets loaded into the operational PostgreSQL database. A much larger capture-only code set streams straight to S3 instead. This keeps unrecoverable raw evidence without paying serving costs for it. (Payor Rate Data Platform, the rate-extraction pipeline's code-set split)

• Ran two independent provider migrations without touching the surrounding interface

  Cut the extraction LLM provider over to Anthropic's Claude API. Then, separately, cut the GPU compute over to CPU on AWS ECS Fargate. Both times, the queue/worker interface stayed untouched, so each swap could be tested and rolled back on its own. (Medical Claim SaaS Platform, the extraction worker service's provider-cutover history)

• Replaced hardcoded per-letter rendering with a declarative registry

  A spec/style/format-version registry, written in Python, lets one assembly walk produce four distinct letter kinds. Adding a new kind requires no changes to the render path itself. (Medical Claim SaaS Platform, the letter-formatting subsystem's registry design)

• Resolved a recurring CD-vs-infrastructure-as-code conflict by giving each system a single role

  The deploy pipeline, GitHub Actions, became the sole writer of the current image pointer, held in AWS SSM Parameter Store. The infrastructure-as-code layer, Terraform, became a reader only. This removed the race between deploy-driven and infra-driven image changes. (Medical Claim SaaS Platform, the infrastructure module's image-pointer wiring)

• Designed the AI-output schema so evolution can't silently break old consumers

  Every new field on the reasoning service's output contract is optional and validated with strict extra-field rejection, using Pydantic in Python. This lets old and new payload shapes coexist and be tested for parity mechanically. (Medical Claim SaaS Platform, the reasoning service's output-schema versioning)

• Pinned the rules engine to the document's date, not today's date

  The statutory-deadline engine, written in Python, resolves rule "vintage" from the denial letter's own date, not the current date. That way, historical determinations stay reproducible even as the underlying rule corpus keeps getting updated. (Medical Claim SaaS Platform, the reasoning service's statutory-deadline engine)

• Scoped an exception to a strict invariant as narrowly as possible instead of weakening the rule

  Added exactly one gated backward transition to an otherwise strictly forward-only state machine, for crash recovery only. It's bounded by a PostgreSQL transaction-local flag, not a general relaxation of the invariant. (Medical Claim SaaS Platform, the case data model's migration history)

• Split retention policy from the data model so history survives independently of raw storage limits

  One PostgreSQL fact table gets retention-pruned for cost. A separate percentile-aggregate table, refreshed transactionally alongside it, is never pruned. So historical trends survive regardless of the raw-data retention window. (Payor Rate Data Platform, the rate-extraction pipeline's permanent aggregate table)

• Built a repeatable privilege-bracket procedure for schema changes against a database with no direct network path

  A standing, audited procedure temporarily re-points IAM credentials, runs the migration with Alembic, then reverts access. It's been used across multiple schema releases, since there's no bastion host. (Payor Rate Data Platform, the infrastructure runbook's migration privilege-bracket procedure)

• Mapped database access pools to blast radius, not convenience

  A row-grain "drill" tool runs on a separate, least-privileged connection pool, apart from the aggregate-only tools. The boundary is enforced as a PostgreSQL grant, not application logic. (Payor Rate Data Platform, the web layer's three-pool database access design)

• Serve four independently-versioned services from one container image

  Each of four AWS ECS task definitions is pinned to a different tag of the same container image in AWS ECR. That way, any one service can roll forward without moving the other three. (Payor Rate Data Platform, the capture pipeline's container/task-definition design)

• Turned cross-repo content drift into a build failure instead of a silent divergence

  A large structured content corpus lives as version-controlled config in one repo. It syncs idempotently into the PostgreSQL database through a GitHub Actions pipeline, and exports as a checksummed artifact that a second repo consumes. So the two repos can't quietly drift apart. (Payor Rate Data Platform, the channels subsystem's content-corpus sync pipeline)

• Split ingestion into fetch and load stages connected by cloud-native events

  Fetch and load run as separate services, in Python, on AWS ECS Fargate, chained by state-change events. A fetch failure never loses already-fetched data, and a load never blocks on network I/O. (Payor Rate Data Platform, the pipeline's ingestion-architecture design)