AI Agents for Prior Authorization Need Explicit Decision Boundaries

Introduction

CMS is already testing a form of technology-assisted utilization review in which the boundary around the final decision is explicit.

Its WISeR Model, which began in January 2026 for selected Original Medicare services in six states, allows participating companies to use technologies including AI and machine learning to support medical-necessity review. CMS also specifies that recommendations for non-payment are determined by appropriately licensed clinicians, and participating companies must have clinicians available to conduct medical review.

Prior authorization contains exactly the kind of work that attracts AI agents: discover requirements, retrieve records, identify missing documentation, prepare a request, submit it, monitor status, respond to information requests and prepare material for resubmission or appeal.

The workflow crosses different kinds of authority. Retrieving a policy requirement is administrative. Interpreting whether an individual patient satisfies a coverage criterion may involve clinical judgment. An agent can move between those activities quickly enough that the change in authority is easy to miss.

AI agents for prior authorization workflows need explicit decision boundaries because moving a case forward is not always the same thing as deciding what the case means.

At a glance

• Prior authorization is becoming increasingly machine-readable as CMS and HL7 structure electronic requirements, documentation exchange and request/response workflows.
• An AI agent can perform substantial administrative work without being given authority to determine medical necessity or coverage.
• Provider-side agents can alter the effective case by selecting, summarizing or omitting clinical evidence before it reaches the payer.
• Faster machine-to-machine exchange can create automated resubmission, clarification and denial loops unless workflow states and escalation conditions are controlled.
• Governance should attach authority to specific state transitions: gathering evidence, transmitting a request and making a coverage determination are different acts.

Prior authorization is becoming machine-actionable before it becomes autonomous

The technical foundation around prior authorization is changing quickly.

Under the CMS Interoperability and Prior Authorization Final Rule, affected payers generally began operating under shorter decision timeframes in 2026 for non-drug medical items and services: 72 hours for expedited requests and seven calendar days for standard requests, subject to the rule’s payer-specific scope and exceptions. Specific denial reasons are also required.

Beginning in 2027, affected payers are generally required to support a Prior Authorization API that can identify covered items and services, communicate documentation requirements, accept requests and return approvals, denials with specific reasons, or requests for more information.

The interoperability layer is also becoming more structured. HL7’s current U.S. catalogue includes 2026 releases of the Da Vinci Coverage Requirements Discovery (CRD), Documentation Templates and Rules (DTR) and Prior Authorization Support (PAS) implementation guides. Together, the HL7 Da Vinci implementation guides address different parts of discovering payer requirements, gathering required documentation and exchanging authorization requests and responses.

These changes make more of prior authorization navigable by software while leaving agent authority as a separate design decision.

A FHIR interface can expose what documentation is required. A structured workflow can transmit a request. A machine can monitor the response. Whether the same system may infer a missing clinical fact, decide that evidence satisfies medical-necessity criteria or accept an adverse coverage decision requires a different level of authority.

One prior-authorization workflow contains several kinds of work

“Automating prior authorization” can hide important differences between the activities inside it.

A provider-side agent could check whether authorization is required, identify documentation requirements, locate relevant material in the record, populate structured fields, assemble attachments, submit the request and monitor status.

If the payer requests additional information, the agent might identify the missing document and prepare a response. After a denial, it could retrieve the reason and assemble material for resubmission or appeal. Those tasks can remove significant clerical effort.

The control problem changes when the workflow reaches questions such as whether the patient meets a coverage criterion, whether conflicting evidence should be discounted, whether an exception is justified or whether medical necessity has been established.

AI can still assist at that point. It can retrieve the applicable rule, identify evidence relevant to it and show where documentation appears incomplete. The permission to prepare a case should not silently become permission to determine the case.

An agent that can populate and transmit a request has one kind of authority. Finalizing a consequential coverage judgment requires another.

A provider-side agent can change the case before submission

Automation risk begins before the request reaches the payer.

Consider an agent asked to prepare a prior-authorization package from a longitudinal medical record. It may search several years of notes, identify a diagnosis, retrieve previous treatment history, summarize failed therapies and populate the payer’s documentation fields.

The submitted package reflects choices about what to retrieve, what to summarize and what to leave out. An agent may compress multiple notes into a short clinical history, interpret whether a previous treatment qualifies as failed therapy or choose which result appears most relevant to the requested service.

A poorly controlled transformation can produce an administratively polished request whose evidentiary lineage is difficult to reconstruct.

No hallucination is required. Every underlying fact may be real while the assembled case becomes misleading through selection, omission, temporal confusion or unsupported interpretation.

For consequential requests, material claims about previous treatments, diagnoses, contraindications or clinical findings should remain traceable to their source evidence. The submitted record should also allow reviewers to distinguish direct extraction from agent-generated synthesis.

That preserves the ability to inspect how the case was built rather than treating the final package as a self-contained representation of the chart.

Machine-to-machine prior authorization can create faster disagreement

Manual prior authorization contains familiar friction: portals, phone calls, repeated forms, status checks and missing-document exchanges. Electronic interfaces can remove much of that work while also allowing an unsuccessful path to repeat at machine speed.

A provider-side agent might submit a request, receive a structured notice that evidence is missing, locate another note and resubmit automatically. A payer-side system evaluates the revised package and returns another deficiency.

Both systems can continue progressing through technically valid states even when the real problem is an unresolved clinical disagreement.

The same possibility appears after denial. CMS now requires affected payers within the rule’s scope to provide a specific reason for a denied prior authorization. An agent can use that reason to locate additional documentation or prepare the next administrative step.

Repeated correction should eventually reach an escalation boundary. The case may require a clinician to determine whether the available evidence actually supports the requested care or whether an exception or appeal is justified.

The workflow therefore needs conditions that stop automated iteration and route the case to someone able to resolve the underlying issue.

A coverage decision is a different control boundary

CMS guidance for Medicare Advantage provides a useful example of the difference between computational assistance and coverage judgment.

In its guidance on coverage criteria and utilization management, CMS states that algorithms or AI may assist Medicare Advantage plans in making coverage determinations, while the plan remains responsible for complying with applicable coverage rules.

CMS also emphasizes individual patient circumstances. Its examples state that an algorithmic prediction alone cannot serve as the basis for terminating post-acute care and that AI or algorithms alone cannot deny an inpatient admission or downgrade it to observation.

The guidance is specific to the Medicare Advantage context it addresses rather than a universal payer rule.

Within that context, an AI system can retrieve criteria, compare documented facts with those criteria and expose apparent matches or conflicts. Consequential judgments involving an individual patient’s circumstances still need an accountable decision point.

CMS’s WISeR model makes a comparable boundary visible from another direction by combining enhanced technology with human clinical review and assigning recommendations for non-payment to appropriately licensed clinicians.

Governance therefore needs to identify the decisions an AI is permitted to make, not merely whether AI participated somewhere in the process.

The audit trail needs to preserve how the request was built

Traditional prior-authorization records often focus on submitted documents, timestamps, payer responses and the final outcome. Agentic workflows introduce additional reconstruction needs.

For a consequential case, an organization may need to know which source records the agent accessed, which policy or documentation requirements it consulted, which facts it extracted, what text it generated, what a human changed and which system transmitted the final request.

Suppose a payer denies a service because a required prior therapy appears absent. The provider believes the therapy was completed. If an agent assembled the request, investigators need to determine whether the agent found that evidence, interpreted it correctly, placed it in the package and preserved it through subsequent transformations.

The payer side creates a similar requirement. A denial reason should remain connected to the applicable criterion and the patient-specific evidence considered rather than surviving only as a generic generated explanation.

This is case-level provenance: the history of how clinical evidence became an authorization request and how that request became a decision.

More automation raises the value of exception handling

Prior authorization attracts automation partly because much of the work is repetitive. As more routine cases move through automated paths, the exceptions left for people may contain a higher concentration of clinical ambiguity.

They may involve unusual histories, conflicting evidence, incomplete records, benefit ambiguity, exceptions or circumstances that fit standard criteria poorly.

A health system that automates document retrieval and request preparation may still need experienced staff for escalations. A payer that automates completeness checks and criteria matching may still need qualified reviewers for cases that reach interpretive boundaries.

The staffing model can therefore shift rather than simply shrink. Human attention becomes more concentrated on cases where judgment, exception handling or accountability matters.

Automation earns its value when it removes work machines can perform reliably without making difficult cases harder to recognize or route.

Speed should not be the only success measure

Prior authorization carries a substantial administrative burden.

The AMA’s 2025 prior-authorization survey, based on 1,000 practicing physicians and published in 2026, reported an average of 40 prior authorizations per physician per week and 13 hours of physician and staff time each weekspent on the work. Ninety-five percent of respondents said prior authorization delayed access to necessary care, while 26% reported that prior authorization had led to a serious adverse event for a patient in their care.

These are physician-reported survey findings rather than adjudicated outcome measures, but they illustrate why reducing administrative friction matters.

An AI-agent deployment can create legitimate value by reducing manual data retrieval, duplicate entry, portal navigation, status checking and repeated document assembly. Evaluation should also capture what happens to the quality of the authorization process as that work accelerates.

A faster workflow that produces more avoidable denials, sends incomplete evidence sooner or creates additional rounds of automated clarification may shift rather than remove the burden.

Useful measures can include first-submission completeness, manual effort removed, correction rates, escalation volume, resolution after denial, time to decision and whether the resulting process remains inspectable.

The control boundary should follow the state transition

Prior authorization already moves through recognizable states: requirement identified, evidence gathered, request prepared, request submitted, more information requested, approved, denied, resubmitted or appealed.

An AI agent does not need equal authority at each transition.

Moving from “requirements identified” to “documentation assembled” may be highly automatable. Moving from “package assembled” to “submitted” may require confirmation when the agent has generated clinical narrative or resolved ambiguity.

A payer-side transition from “request received” to “administratively complete” is different again from moving a case into a final adverse coverage decision.

Designing the agent around those transitions makes authority easier to reason about than giving it an open-ended instruction to “manage prior authorization.”

It also gives escalation a concrete location. Automation can continue while the next transition remains procedural and supported by explicit evidence. When the next transition requires clinical interpretation, an exception, conflicting evidence or a consequential denial, the case moves to an accountable reviewer.

“Human in the loop” then becomes a specific control at a specific transition rather than a vague assurance attached to the workflow as a whole.

FAQs

How can AI agents be used in prior authorization?

AI agents can help discover payer requirements, retrieve supporting documentation, populate request fields, assemble submission packages, transmit requests, monitor status, identify requests for additional information and prepare material for resubmission or appeal. The appropriate level of autonomy depends on the authority required at each step.

Can an AI agent make a prior-authorization decision?

AI may assist some coverage-review processes, but whether an automated system can make or finalize a decision depends on the payer, program, jurisdiction and applicable rules. In Medicare Advantage, CMS emphasizes plan responsibility and consideration of individual patient circumstances when making medical-necessity determinations.

How do CMS prior-authorization APIs affect AI agents?

CMS’s Prior Authorization API requirements create a more structured electronic path for discovering documentation requirements and exchanging authorization requests and responses for applicable non-drug medical items and services. They can make agentic workflows easier to implement, but the API requirements do not themselves grant an AI system clinical or coverage-decision authority.

What should be logged in an agentic prior-authorization workflow?

Organizations should be able to reconstruct the source information accessed, requirements or criteria consulted, information extracted from the clinical record, agent-generated content, human edits and approvals, submitted package, payer responses and later changes. The necessary detail should reflect the consequence of the workflow and applicable recordkeeping obligations.

Prior authorization is becoming easier for software to move

The administrative logic of prior authorization is being converted into more structured, interoperable exchanges. Repeated data entry, document chasing and status checking are poor uses of scarce clinical and administrative time.

AI agents can remove more of that work than conventional point automation because they can coordinate several steps rather than automate one screen or form.

Technical traversability, however, does not confer decision authority.

A machine can discover the requirement, assemble the evidence and move the case to the next state. The critical boundary is the moment it stops carrying the case and starts deciding what the case means.