Why We Built Our Own Workflow Engine
Most companies looking at a compliance workflow engine start with the established general-purpose options. We did too. Then we ran into regulatory requirements that made adapting them more expensive than building our own:
- Every change of status has to be auditable to 21 CFR Part 11 standards — not merely logged, but attributable to a person and provably unaltered.
- Signature requirements have to be absolute, not optional steps an administrator can switch off.
- Separation between customers has to extend to the processes themselves — one customer’s rules cannot affect another’s work.
- AI needs a way to ask “what would happen if…” before committing to anything.
This is a trade-off worth being honest about: building our own gives us control over regulatory specifics, and it also means more to maintain for a small team. Established alternatives have larger communities, better documentation, and more edge cases already discovered. Our bet is that the regulatory specificity justifies it.
How It Works: Stages, With Gates Between Them
Work moves through defined stages. There is a starting point, a series of stages in between, and an end — complete, cancelled or rejected. The stages in between can branch on a decision, run several things in parallel, repeat, wait for something external, or unwind cleanly if something fails.
Moving from one stage to the next involves three things:
- Conditions — what must be true before the move can happen
- Actions — what the platform does as part of the move, such as sending notifications or updating information
- Gates — absolute blocks that hold the move until a person acts, such as an electronic signature or a confirmed manual review
What the Engine Can Do
Managing work in progress
Start something new, move it forward, pause and resume it, or cancel and retry. A single entry point handles the most common case: find the work item or create it, then move it to the next stage, all in one go.
Tasks
List tasks by person, by team or by status. Complete, delegate, escalate, ask for clarification, or comment on any task. Tasks are the points where a person is involved in an otherwise automatic process.
Scheduling, recovery and connections
Time-based triggers; a holding area for anything that failed, with the ability to retry or resolve it; connections so other systems can be notified when something happens; and secure links in notification emails so people can complete a task without signing in first.
Looking Before You Leap
This is the capability we think matters most where AI is involved. Before moving anything forward, it can ask what would happen.
What comes back is a list of warnings, marked either as advisory or as blocking, along with whatever conditions are not yet met. Advisory means the move will succeed but conditions are not ideal. Blocking means it will be refused. AI can read the reasons and explain them to a person before trying.
This matters because AI should not fail silently. A person who clicks a button and gets an error can read the screen and work out what to do. Software that is simply refused needs to be told why, and what a person now needs to do to unblock it.
When Two Records Disagree
Where both people and software act on the same things, disagreement is inevitable. An item’s own status and the process tracking it can drift apart when:
- A person changes the status on screen while software is working from an older view
- A previous failed attempt left the process at the wrong stage
- Older parts of the platform updated the status without going through the process at all
The single entry point handles this by reconciling. If the caller supplies the item’s known status and it differs from what the process believes, the engine brings the process into line, records that the drift happened, and then proceeds.
The item’s own status is always the authority. The process tracks it, never the other way round.
What Can Set a Transition Off
- A schedule — at a set time or interval
- An external event — another system reporting something happened
- A document arriving in a watched location
- An incoming email to a watched mailbox
- Another process completing
- A deadline being missed
- A business calendar event
- An AI classification result
Never Doing the Same Thing Twice
Duplicate requests are caught at two levels: immediately, for anything repeated within a short window, and by checking stored records, which catches duplicates even if the platform restarted in between.
Anything that fails goes into a holding area rather than being quietly dropped. Each entry records what failed, what the error was, and what stage it had reached. An administrator can retry it, resolve it, or discard it.
What This Means in Practice
An AI assistant connected to DnXT can:
- Ask — “what is in progress for this dossier, and what stage is each one at?”
- Preview — “if I move this submission to Ready for Review, what happens? Is anything blocking it?”
- Act — “move this submission to Ready for Review.” And if a signature is required: “this needs a human signature, so I will notify the reviewer.”
- Monitor — “are any tasks assigned to the regulatory team overdue?”
- Recover — “what failed, and can the failed classification be retried?”
A compliance workflow engine built for AI is not just about what AI is allowed to do. It is about giving it enough information to make good decisions — including the decision to stop and ask a person.
This article was written by the DnXT Solutions team. We’ve aimed to present both the capabilities and trade-offs of our workflow architecture honestly. Questions are welcome at se******@***********ns.com.
