Main site

Biotechnology AI agent · Research oversight

Research-Oversight & Attestation Evidence AI Agent

Track which projects belong to which review body, build the evidence pack behind a required attestation, and hold it for the named principal investigator — who determines the classification and signs it.

Typical delivery
4–6 weeks
Deployment
Your stack
PI attestation
Portfolio-wide
After launch
Agent Care

What this agent does

Builds the record, never the determination

In

  1. 01

    A proposal is drafted, and the agent sweeps it in — Executive Order 14292 (2025) does not stop at federal awards.

  2. 02

    A sponsor deadline approaches, and the agent shows whether the attestation it needs exists and who owes it.

Reason

  1. 03

    A project changes shape, and the agent reopens scope against the review body it was first scoped to.

  2. 04

    A registration approaches the three-year limit in 42 CFR 73.7(l), and the agent shows the work behind it.

  3. 05

    An amendment is filed, and the agent holds it as a blocking gate until approval returns — not as submitted.

Decide

  1. 06

    A person is approved for access, and the agent starts the training clock on the earlier of the two dates.

  2. 07

    A drill or plan review falls due, and the agent counts the security, biosafety and incident plans separately.

Out

  1. 08

    A project closes, and its pack, its open items and the register it sat in are retained against the award.

  2. 09

    Execute write actions only inside the approval boundaries agreed during implementation.

Product statement

The agent assembles the record and runs the clocks; a named principal investigator attests and a named institutional official certifies.

Example workflow

One proposal, scope to attestation

  1. 1Proposal receivedGrants system, contract record, philanthropic gift or internal project registration
  2. 2Record assembledFunding source, sites, agents in use, registrations and training, each with its named source
  3. 3Evidence pack draftedScope questions, the review body, open items and confidence
  4. 4Controls appliedScope-sweep checks, registration and training currency, blocking amendments and confidence threshold

No human action required

Stages 1 to 4 run unaided, and nothing is attested or certified at any of them — the agent is assembling, and the investigator's lane opens at the confidence gate.

5DecisionBranches at the confidence threshold
High confidence

Goes to the principal investigator to read.

Low confidence

Adds a biosafety officer read first.

Investigator review

The pack is held with its sources, its open items and the confidence.

Approve · Edit · Send to the biosafety officer

Approved — released for attestation

  1. 6Oversight registers updatedOnly where write access and approval policy allow it
  2. 7Outcome evaluatedPack completeness, open-item outcomes, review-body turnaround and post-award corrections

Edits

Every investigator edit is counted, and so is every correction made after the award.

What should not run autonomously

Human approval stays in control

Outside the boundary — human approval required

8 items

  • Determining whether a project is dangerous gain-of-function research.
    • Pre-filling, scoring or ranking a DGOF or IROC field.
    • Summarising, drafting or completing experimental methodology.
    • Attesting in writing to a classification.

  • Automation boundary

    Agent acts unaided

    • ✓Sweep the portfolio for projects that may be in scope.
    • ✓Assemble the registration, training and inventory.
    • ✓Run the registration, access, training, drill and reporting clocks.
    • ✓Flag what needs review, and hold the pack for the named investigator.

    Any write happens inside the boundaries agreed at implementation, never ahead of an attestation.

    • Certifying that an application is accurate and truthful.
    • Recording that a project does not need review.
    • Notifying CDC or APHIS of a theft, loss or release.
  • Changes to scope, registration or attestation rules.

Example output

One evidence pack, annotated

The pack is what the investigator reads before signing, and what is read back afterwards.

Evidence-pack output · single proposal

Illustrative example
Project
Non-federally funded study
Flag raised
The performance site changed after the review this project was scoped against
Review body
IBC · IRE
Source of record
Subaward amendment
Confidence
93%
Attribution
Named investigator and role

As received

Taken from the proposal record and the registration file — nothing on this side is written by the agent.

Evidence used

  • Registration amendment
  • Subaward site record
  • IBC approval on file

Why this was flagged

It flags a project for review and never clears one; a person decides.

What the score decides

Below the configured threshold the pack picks up a biosafety officer read first.

Action

ApproveEditSend to the biosafety officer

Value

Where AI adds value

The same four claims, placed at the point in the workflow where each one applies.

Where the value lands

Value 01 – 04

Every project

From the proposal record

03Assembly

Assemble from the record

Draw on registrations, approvals, training records and inventories — never on protocols, a corpus that is dual-use in itself.

01Approved path

Flag it, never clear it

Registration, training and inventory evidence arrives gathered, with the clocks that expire it.

02Human review

Aim the review at what was missed

Projects that may be in scope are flagged for the review body; the agent never records that one does not need review.

04

Build an evidence trail

The project, the review body it belongs to and the official who certified stay on the record.

Integrations

Typical integrations

Five system groups connect to the same agent. Which of them are in scope is decided in discovery.

  • Grants & proposals

    • Cayuse
    • InfoEd
    • Huron
    • Kuali Research

  • Committee systems

    • IBC and IRE modules
    • Key Solutions
    • iRIS

  • Training & access

    • CITI Program records
    • Badge and access logs

Agent

Research oversight & attestation

  • Reads the record
  • Assembles the pack
  • Holds for the PI

  • Registration & inventory

    • Select-agent inventory
    • eFSAP registration file

  • Observability & evaluation

    • OpenTelemetry
    • Langfuse
    • Supported monitoring/evaluation sources

Integration availability depends on the client's existing systems and API access.

Agent controls

Six layers between the model and the attestation

Six controls in sequence, widest first. What clears them all is drawn in the map beneath this.

L6 · Outermost — last line of defence

Inward → L1 · closest to the model

L6Rollback / safe modeNarrow the agent to register assembly when evaluation or production signals degrade.Roll back
L5Version monitoringTrack model, prompt and scope-rule changes, and the currency date of every rule read.Track
L4TraceabilityRecord the sources, the pack, the open items and the time it was released.Record
L3Investigator reviewHold packs for the named investigator; it governs release of the pack, not whether the attestation signed after it is right.Gate
L2Policy guardrailsTest packs against the configured scope, currency and record rules; a failure returns the pack.Restrict
L1Confidence thresholdsRoute low-confidence packs to a biosafety officer read before the investigator sees them.Require review
Model corePack assembled — scope questions, review body, open items and confidence
L1 – L2
Test whether a pack may stand
L3
Leaves the signature with the investigator
L4 – L5
Keep the project and the body behind it
L6
Narrows to register assembly when signals degrade

How Nestack evaluates it

Evaluate the oversight workflow — not only the finished pack.

Coverage runs the whole depth of the workflow, and every layer is cut by slice.

Surface — the pack the investigator reads

  1. E1Final-output evaluationDid every item in the pack trace back to the record it came from?
  2. E2Step-level evaluationDid the agent use the right project, review body and the rules in force that day?
  3. E3Tool evaluationDid it read and write the correct project and the correct field?
  4. E4Confidence calibrationDo low-confidence packs actually attract more investigator edits?
  5. E5Slice evaluationHow does performance change across specific project types?
  6. E6Business outcomeHow many packs needed an investigator edit or a correction after the award?

Floor — the outcome the institution answers for

Failure modes

Where each failure originates in the agent

Seven failure modes, each placed at the stage where it originates.

Agent lifecycle

Direction of processing →

  1. 01 · Retrieval

    1 mode

    • EJ-03

      Superseded framework

      Scope read from a policy that was replaced in 2025.

    Stage gathers

    Proposals, registrations, training records and rules

  2. 02 · Reasoning

    2 modes

    • EJ-04

      Scope sweep too narrow

      Privately funded work never enters the portfolio.

    • EJ-06

      Amendment read as approved

      Submitted is shown as cleared and the work starts.

    Stage proposes

    Scope questions, the review body and confidence

  3. 03 · Tool / write

    2 modes

    • EJ-02

      Attestation never collected

      The proposal goes out on the sponsor deadline.

    • EJ-05

      Person-level clock missed

      Access expires between two registration renewals.

    Stage writes

    Only where write access and approval policy allow it

  4. 04 · Output

    1 mode

    • EJ-01

      Flag ages in a queue

      A flagged project waits and no review body convenes.

    Stage returns

    The pack the investigator reads before signing

  5. 05 · Change / Version

    1 mode

    • EJ-07

      Silent scope drift

      A rule change narrows what the agent will flag.

    Stage tracks

    Model, prompt, scope rules and review-body config

  • Sev-1 · a project ships without review
  • Sev-2 · a wrong item reaches the pack
  • Sev-3 · records degrade, pack goes to review
See the complete Biotechnology failure-mode catalogue

Affected slices

A whole-institution figure can hide one review body

An institution-wide scope-coverage figure can look acceptable while a few project cohorts absorb most of the rework behind it. Nestack reports the pack-rework rate by slice, not only in total.

Slice performance — reported separately, not only in aggregate

Illustrative example
SliceFailure rateLiftLift vs. thresholdStatus
Non-federally funded projects7.8%3.6×Review
Foreign subaward sites5.6%2.6×Review
Select-agent registered work3.5%1.6×Watch
Single-site IBC projects1.4%0.7×Normal

Bar: pack-rework-rate lift vs. the single-site IBC baseline · scale 0–4.0× · tick marks the 2.0× review threshold

2 of 4 slices over threshold

Evidence-linked improvement

Each cycle leaves one more standing case

A cycle is done when the unreviewed project has become a case the next release must pass. That suite is what the next attestation prepared is measured against.

Improvement cycle · five stages

Switchback — the path turns at Improve and returns at Learn

  1. 01

    Detect

    Pack-rework rate rises in a project slice.

  2. 02

    Diagnose

    The project that changed shape after the review it was scoped against is read back until the cause narrows to one.

  3. 03

    Improve

    Number the change; the projects that drove it are filed under it.

  4. 04

    Verify

    Each touched register case is run once more, and one red holds it back.

  5. 05

    Learn

    It stays as a standing test, and the scope rules move with it.

  6. Learn → Detect

    The return edge. The next proposal is worked against a suite one case longer.

Typical build scope

Twelve workstreams across six weeks

The build scope read against the delivery timeline. Week structure follows the six-week plan — discovery, sources, oversight workflow, evaluation, integration, then production validation and handover.

Workstream

Week 1Week 2Week 3Week 4Week 5Week 6

  1. 01Oversight workflow and scope-boundary definition.Week 1
  2. 02Grants and committee source assessment.Week 1, Week 2
  3. 03Scope-rule, registration and currency-clock mapping.Week 1, Week 2
  4. 04Project-record ingestion and mapping.Week 2
  5. 05Register logic and record binding.Week 2, Week 3
  6. 06Confidence scoring and pack routing.Week 3
  7. 07Investigator review workflow.Week 3, Week 4
  8. 08Proposal and committee-system integration.Week 5
  9. 09Scope and currency cases.Week 4, Week 5
  10. 10Guardrails and attestation controls.Week 4
  11. 11Register-trail instrumentation.Week 5, Week 6
  12. 12Deployment, documentation and Agent Care handover.Week 6

12 workstreams · 6 weeks · bar shows the weeks a workstream is active — several run in parallel

Final scope and sequence confirmed in discovery

Engagement tiers

What each tier includes

Rows are the capabilities named in each tier's scope. Higher tiers include everything below them.

Capability✓ in scope · — not at this tierPilotOne programme, one committeeProductionProduction oversight systemsAdvancedMultiple programmes / sites
Introduced at Pilot
Scope sweeps to your rules✓✓✓
Investigator review✓✓✓
Scope-coverage baseline✓✓✓
Introduced at Production
Reporting by review body—✓✓
Review workflow in your systems—✓✓
Approved write-back—✓✓
Proposal-system integration—✓✓
Introduced at Advanced
Multi-agency oversight rules——✓
Multi-stage committee approvals——✓
High proposal volume——✓
Multi-programme oversight controls——✓
Build priceFrom $5,000From $8,000Custom quote
Final build price
Confirmed after discovery based on integrations, workflow complexity, proposal volume, review controls and deployment requirements.
Separate from build
Build pricing is separate from recurring Agent Care, which covers managed monitoring, evaluations, incidents and verified improvements after launch.

What we need from you

What you bring, and what we build with it

Each input maps to a piece of build scope and a week in the delivery timeline.

  1. 01Your project list and funding sources

    Project-record ingestion and mapping

    Week 1

  2. 02Representative past proposals and packs

    Register baseline, scope extraction and record binding

    Week 2

  3. 03Your scope, registration and currency rule sources

    Scope-rule, registration and currency-clock mapping

    Week 1

  4. 04Access to relevant APIs, feeds or exports

    Grants, committee and training assessment, then integration setup

    Week 2

  5. 05Registers you would not want audited

    Scope cases and failure-mode testing

    Week 4

  6. 06What no attestation may assume

    Confidence scoring, pack routing, guardrails and attestation controls

    Week 3

  7. 07Named investigators to read packs

    Investigator review workflow, then pilot and production validation

    Weeks 5–6

Nothing else is required

Deployment, documentation and Agent Care handover are ours.

Delivery timeline

Four phases across six weeks

The plan sits on elapsed weeks rather than on slide space, so the overlap in week five is real.

Phase

W1

W2

W3

W4

W5

W6

  1. DiscoveryW1
  2. BuildW2 – W3
  3. EvaluateW4 – W5
  4. Pilot & LaunchW5 – W6

Week focus

W1Oversight workflow discovery, rule mapping and the scope boundary

W2Grants, committee and training integration and the register baseline

W3Oversight workflow, confidence logic and investigator-review controls

W4Evaluation suite, scope-rule checks and failure-mode testing

W5Registration-system integration, pilot projects and targeted corrections

W6One award cycle run under the institutional official, then Agent Care handover

Reading the band
A bar covers the weeks its work is named in, and nothing else. The week 5 overlap is real, not padding.
At the end of W6
When the register validates, Agent Care takes the agent on.
Duration
Six-week plan shown · typical delivery 4–6 weeks depending on scope confirmed in discovery.

Next step · Biotechnology AI agent

Build an oversight agent that points at the project nobody sent to review.

The framework most institutions were scoped against was superseded on 5 May 2025 and not replaced until 28 July 2026, with agency implementation guidance still unissued as at 20 August 2026 — so we build on 42 CFR Part 73 and the NIH Guidelines and re-point the rest as it lands. Show us your proposal pipeline, your registrations and who signs, and we will map the scope sweep, the attestation register and the clocks. This sits before an experiment is designed: it governs whether work needs review and by whom, not how an approved campaign is planned or run.

Typical delivery
4–6 weeks
Deployment
Your grants and committee systems
PI attestation
Portfolio-wide
After launch
Agent Care available

Nestack Agents · Research oversight

AGT-BT-15 · Agent Care available after launch

Build an oversight agent

Four questions so the call starts from your actual setup — then pick a time that suits you.

About you
Your projects

No obligation. We’ll map the workflow, name the automation boundary and tell you if an agent is the wrong answer.