DeskGate BAA active · Vertex AI · 28 Sep 2026

Architectural ground truth

Why DeskGate works this way: matching, memory and the non-API reality.

DeskGate does not call payer APIs. Gemini reads each portal form and matches its boxes to chart facts, so no portal needs its own script. Live portals start empty. Case memory lives in the side panel until GATE or close. In PHI mode, screen reads and form matching run only on Google Cloud, on Vertex AI in the project deskgate-production, under the Google Cloud BAA executed on 28 September 2026. The coordinator clicks Submit.

See it run (synthetic) How a form gets filled

  • 0Payer APIs called by the extension. It works inside the coordinator's own logged-in portal session.

  • 15 sHow long DeskGate waits for Gemini before the backup word list in lanes.js fills a box

  • 28 Sep 2026Google Cloud BAA executed. Screen reads go to Gemini on Vertex AI in deskgate-production.

01 · How a form gets filled

Gemini matches the boxes. lanes.js is the backup.

No payer API and no per-portal script. Gemini reads the form the coordinator already has open and says which chart fact belongs in which box. The coordinator reviews and clicks Submit.

Gemini matches the boxes

When the coordinator presses STAGE, DeskGate lists every box on the form, including boxes inside embedded frames, and sends Gemini the box labels and the names of the facts in panel memory. Gemini answers which fact belongs in which box. It never sees the patient values: DeskGate types those from memory and reads every box back.

A portal Gemini has never seen fills the same way, so there is no per-portal script to write or to break. That is shown on our synthetic pages; on a live desk it gets proven on the named portal family during the free month.

lanes.js is the backup

lanes.js (2.6.8) fills in only when Vertex AI does not answer within 15 seconds. Its word lists also act as a second opinion: when Gemini and the word list read a box differently, the panel says so before Submit.

Its showroom entries hold the synthetic packets for the test pages, which are the only sandboxes.

A lane is access control

A desk's lane now means one thing: the list of sites its desk key may be used on.

That is access control, checked by deskgate.app before every screen read and every match.

Lane ID What it is Matched hosts Packet Sandbox?
showroom-product Synthetic five-slot workstation (showroom) deskgate.app/product, localhost Jane Rivera (synthetic) Yes, sandbox
showroom-healthpayer Synthetic prior-authorization form (showcase-portal.html) file://, first-party showcase paths Vargas packet (synthetic) Yes, test harness
showroom-denial Adverse determination letter (showcase-denial.html) file://, first-party showcase paths Denial reason and code keys Yes, test harness
showroom-appeal Reconsideration form (showcase-appeal.html) file://, first-party showcase paths Quoted draft from panel memory (Vargas) Yes, test harness
availity Availity Essentials availity.com, apps., essentials. {} No, live portal
covermymeds CoverMyMeds prior authorization covermymeds.com, portal and dashboard {} No, live portal
uhc UnitedHealthcare provider portal uhcprovider.com, secure.uhcprovider.com {} No, live portal

Optum, eviCore, Waystar, Office Ally, state Medicaid? No lane entry needed: Gemini reads those forms like any other. No packet, no sandbox. As on every site, the runtime refuses any control that looks like Submit, File or Send.

lanes.js entries: backup and showroom

Choose an entry to see its hosts, its packet and what it is used for.

02 · APIs and portals

The extension does not call payer APIs.

EDI and clearinghouse APIs cover the structured slice. The residual work stays on the portal: attachments, clinical review, exempt ERISA plans, and specialty-drug prior authorization that still opens a browser.

Not called

  • Payer APIs. There is no Availity, CoverMyMeds or UHC API token in this runtime.
  • Private portal endpoints. We do not reverse-engineer a hidden submit path.

Called

  • The live tab's page, through the content script, in the coordinator's already-logged-in session.
  • The DeskGate backend, for /api/pilot-event, screen reads, form matching (/api/map-fields) and model reasoning. In PHI mode that reasoning runs on Google Cloud, on Vertex AI (now Gemini Enterprise Agent Platform) in deskgate-production, under the Google Cloud BAA executed 28 September 2026, using generally available models only.

When the API path stops, the instruction on the desk is still the same: log into the portal and finish the packet. That is the work STAGE PORTAL is for.

03 · Production testing reality

There is no payer web-portal sandbox.

Clearinghouses sometimes publish API test endpoints. They do not give this extension a disposable Availity, CoverMyMeds or UHC web interface with mock 2FA and fake members. The only sandboxes we ship are the synthetic showroom pages you can watch on the walkthrough.

An API sandbox is not a portal sandbox

JSON fixtures do not recreate the live form the coordinator actually fills.

One production login

Measurement happens on the desk's real session. That is why Submit stays human.

Implication. The human gate is an operational rule on live queues, not a slogan. DeskGate may stage the form. It refuses Submit, File and Send.

04 · Reading the page

What STAGE actually does.

content.js reads the active document, including its embedded frames. It does not read the payer's backend queue.

1Enumerate
Every input, select, textarea and editable region in every frame of the tab.
2Label
Each box, from its label, aria-label, placeholder, name and options.
3Match
Gemini gets box labels and fact names, never values, and returns box → fact. The word list covers if Vertex AI is silent.
4Type and verify
Values are typed from panel memory, every box is read back, and anything the portal refused or reformatted is flagged.
5Refuse
Any control whose text or type looks like Submit, File or Send.

Live portals start with packet: {}. Jane Rivera, the synthetic showroom patient, cannot be typed onto Availity. Facts arrive from READ CHART, which reads the chart or denial letter on screen into panel memory, not from a baked-in production packet. Anything the chart does not say stays marked [MISS] for the coordinator.

05 · Session memory and the HIPAA boundary

One panel, one case in memory. No chart data in DeskGate databases.

Case state is not written to disk as a patient file. Closing the side panel drops it.

Store Where Lifecycle
caseSession Side-panel memory (RAM) Survives tab switches while the panel stays open. GATE starts a new case. Closing the panel drops it.
lastDomSnapshot Side-panel memory (RAM) The last GET_DOM_STATE of the active tab. Temporary, not a durable EHR extract.
Upstream AI: screen reads, form matching, reasoning Google Cloud, project deskgate-production (BAA link 2) Google Cloud BAA executed 28 Sep 2026. Covered, generally available products only; pre-GA offerings are excluded from the BAA. Under Google's terms, customer data is not used to train models without permission. Retention on Google's side follows the BAA and the project's data-retention settings (Master Terms §4).
Desk BAA (link 1) DeskGate with each desk Signed before that desk sends any live PHI. Until then, measurement runs on synthetic or de-identified cases.
Desk code and backend URL chrome.storage.local Workstation configuration only. No clinical data.
Schedule M ledger Server JSONL (/pilot) The payer reference is stored only as a one-way SHA-256 hash. No patient names or chart text.
Session rule. One open side panel holds one caseSession. Actions reach the active tab only. The portal keeps whatever the coordinator already typed there; DeskGate does not write that packet to disk. Chart notes and member IDs are not written to DeskGate databases, and the pilot ledger stores only a SHA-256 of the payer reference. Screen reads go to Vertex AI under the Google Cloud BAA, whose terms govern Google's side (Master Terms §4).
See it run (synthetic) Master Terms Free month and pricing

06 · Commercial alignment: Schedules S, I and M

How the architecture shows up in the paper.

The runtime stages in the coordinator's browser. The contract follows that: per desk and named portal family, not seats, not cases.

Schedule S: per desk, per named portal family

  • S-Practice$490/month or $5,400 prepaid for the year (CHF 490.–/Mt.). One named portal family, 1–3 seats, zero case metering.
  • S-Desk$1,950/month or $21,000 prepaid for the year (CHF 1'950.–/Mt.). One named portal family, unlimited coordinators on that desk, zero case metering.
  • S-Agency$4,900/month or $54,000 prepaid for the year (CHF 4'900.–/Mt.). Up to three named portal families, multi-lane exception desks, zero case metering.

Larger networks: talk to us.

Schedule I: onboarding, not mapping

No per-portal field mapping is needed, because Gemini reads each form.

Onboarding is the install, the desk BAA and one live session, included in the subscription.

Schedule M: the ledger

There is no disposable payer interface, so measurement happens on the live queue over 30 days.

Units are completed cases per coordinator-day against that desk's own pre-period baseline, plus gate-accepts with no material edit. No dollar savings are claimed until that ledger exists.

The first 10 desks get 30 days free on one named portal family, in exchange for one coordinator, a pre-period baseline and a blinded ledger DeskGate may publish, with practice-manager or billing-director sign-off. After day 30, the desk stops or subscribes.

Free month and pricing White paper Portfolio and SAFE