Nurse AI OS
Design record · Version 0.1 · 23 August 2026

Three lanes of listening. One lane of building.

Nurse AI OS has a coherent architecture and almost no evidence that anyone will repeatedly use it or pay for it.

Three user archetypes carry the long-term product map — the Learner, the Manager, and the Nurse Builder–Organizer. They are sound as a portfolio of learning loops and dangerous as a quarterly plan. Interview all three continuously. Build exactly one lane per 90-day cycle.

Segmentation · strategy · implementation plan · evidence gates · operating playbook

Status: proposed segmentation, strategy, implementation plan, measurement plan, and playbook, version 0.1. These documents specify a direction, a build order, and a set of boundaries. They do not establish a product, cohort, curriculum, pricing, pilot, partnership, institutional authorization, clinical validation, or permission to process patient data. No date in the plan commits any person to perform work.
The decision

A portfolio of learning loops, not three products

The three-group structure gives Nurse AI OS a coherent progression — learn, lead, build — where each group tests something the others cannot. The Learner tests whether the system improves individual capability and earns repeated use. The Manager tests whether it improves consequential professional work and creates institutional value. The Builder–Organizer tests whether users can create reusable capabilities rather than only consume them.

Treating them as three simultaneous products is how the project arrives at one more broad platform before any single job is proven. Each archetype asks for a different system: the Learner wants study, explanation, memory and progress; the Manager wants planning, policy, governance, communication and measurement; the Builder wants projects, content, collaboration, distribution and intellectual property.

Discovery is cheap and parallel. Construction is expensive and serial. The rule separates them.

Who each lane serves

The Learner is two markets, not one

The most consequential correction to the three-group model: a prelicensure student and a licensed nurse pursuing certification share a verb and nothing else that matters. The certification learner has a dated personal goal, full agency, a recurring cycle, and their own money. The prelicensure student is bounded by faculty, program and accreditation, and cannot be served without an institutional partner. One is a buildable lane; the other is a research subgroup, developed only with an educator or program partner.

SegmentUserBuyerApproverSteward
ManagerNurse manager, QI, informatics, educator with program responsibilityDepartment or institutionAuthorized leader or local governanceQI, staff nurses, policy and safety reviewers
Certification learnerNurseNurse, or employer if sponsoredThe nurse; employer if work-sponsoredEducator or content steward
Builder–OrganizerNurse builderSelf, sponsor, or organizationCommunity or organizational authorityAffected community, rights and governance reviewers
Prelicensure learner
research only
StudentStudent or schoolFaculty and programFaculty, student, accessibility and integrity reviewers

The person who loves the product is rarely the person who pays for it, and almost never the person who may authorize it.

Three groups that matter enormously and are not lanes

Executive sponsors — CNO, CNIO, quality and AI-governance leaders — are buyers and approvers, not daily users. Their questions are different in kind, and the packet is what crosses that gap.

Build order

Manager first. Then the certification learner. Then the builder.

CycleWhat it is chosen to proveWhy here
1 · ManagerThat governance improves consequential work, survives a reviewer, and someone pays for a bounded outcomeClosest to the differentiated asset; least contested by general-purpose assistants; the only lane with institutional budget within reach, and none of it needs patient data
2 · Certification learnerFrequency, retention, personalization, longitudinal value, direct individual paymentTests what Cycle 1 cannot: whether value accrues over months rather than in one artifact. Retention experiments need something to retain around
3 · Builder–OrganizerExtensibility, contribution, reusability, rights-aware distribution, network effectsRequires a workflow already proven worth reusing. Packaging nothing is how marketplaces die

Why this does not mean three separate builds

Roughly seventy percent of each lane is the same machinery. The spine is built in Cycle 1 with a single consumer, and each later lane becomes a schema plus a workflow on top of it: the intake contract, the refusal set, the source and rights ledger, the section engine, the provenance and uncertainty display, the human correction record, the session record, and the evaluation harness.

That is the difference between “we will get to the Learner in Cycle 2” and “the Learner lane is a schema, a workflow, and three refusals away.” If Cycle 2 costs as much to build as Cycle 1, the reuse thesis was false and the sequencing argument weakens with it — which is stated in advance as a falsifier.

Cycle 1

One segment, one artifact, ninety days

Turn one no-PHI unit, workforce, education, quality, or AI-adoption problem into a review-ready Governed Project Packet.

Fifteen fixed sections. The schema does not grow mid-cycle. The differentiating sections are the unglamorous ones that a general-purpose assistant will not produce unprompted and a reviewer notices first:

What is unknown

Baseline and missing information are listed, not filled in. An unanswered section stays visibly unanswered.

Whose work increases

Staff burden assessed in whose minutes, named by role — the question that decides whether an initiative survives contact with a unit.

What would stop this

Stop and escalation conditions, and who may invoke them. Two named humans own the decision and the action; never the system.

What remains unresolved

Dissent survives to the reviewer intact rather than being smoothed away in the draft.

The increments

  1. Weeks 1–2 · Intake contract and refusal set, running end to end with no drafting at all.Exit: every refusal fires on a crafted input and states its reason in the user's terms.
  2. Weeks 3–4 · Section engine and packet schema, browser-first, no installation.Exit: a packet renders with every section either answered or explicitly marked missing.
  3. Weeks 5–6 · Source and rights ledger; provenance and uncertainty display.Exit: no claim renders without a source, an inference marker, or an unknown marker.
  4. Weeks 7–8 · Guided workflow and correction capture; ten supervised sessions.Exit: ten packets exist, each from a real problem a partner brought.
  5. Weeks 9–10 · Reviewer acceptance round — partners submit to their actual approvers.Exit: written reviewer feedback on at least six packets.
  6. Week 11 · Evaluation harness seeded from the cycle's own failures.Exit: twenty stored cases run against the current model on demand.
  7. Week 12 · Price test — a Nurse-Led AI Governance Readiness Sprint.Exit: a yes, a no, or a counter-offer from every partner asked.

Governance disposition: Yellow risk · D1 data · Recommend ceiling. Institution-specific work is Yellow even with no patient data, because it names real units, real staffing conditions and real local policy. Every packet carries a named human reviewer who approves the exact artifact rather than the workflow in general. The system drafts and recommends; the human submits, sends, schedules and decides.

Evidence

What would count as this working

They bring a second real problem without being asked. Everything else is instrumentation around that sentence.

Signals that are not evidence

Not evidenceWhat it actually indicates
Sign-upsCuriosity, or a good headline
Positive reactions after a demonstrationPoliteness, and the founder's credibility
“I would definitely use this”A prediction people are reliably bad at making
A pilot discussed but unscheduledA polite decline with a longer timeline
Founder-run sessions producing good artifactsThe founder's expertise, not the system's
Reviewer approval of an authoritative-looking packetThe most dangerous signal in the plan

The planted-omission test

A reviewer may accept a packet because it is complete, or because it reads like something that has already been approved. Twice per cycle, a packet is submitted with a known material omission — a genuinely missing piece of information or a genuinely unresolved concern. If reviewers accept it without noticing, the artifact is manufacturing confidence and the format is wrong regardless of every other number. The test is disclosed to design partners in advance, and never run on an artifact driving a real institutional decision.

Gate 1, at day 90 — every condition, not most

Stated in advance: what would make this plan wrong

  • Managers value the drafting and discard the governance sections — the differentiation is imaginary.
  • Approvers accept packets with planted omissions — the artifact manufactures confidence.
  • Learners return for streaks and reminders rather than for the plan — the value is habit design, available elsewhere.
  • Every paying customer is a personal contact of the founder at both gates — there is no acquisition path, only credibility.
  • Cycle 2 costs as much to build as Cycle 1 — the shared spine does not carry.
  • Capability packs are only ever authored by the founder — there is no platform, only a template library.
Boundaries

What no lane does

Every lane operates at or below the public ceiling: D0/D1 data, Green/Yellow risk, Observe/Draft/Recommend action, with Recommend beginning at Yellow. Three prohibitions hold across all three without exception — no patient data, no employment or competency determination about a named person, and no clinical decision support. A lane that needs one of these to be useful is not ready, and does not proceed by being useful anyway.

Also absent, deliberately: additional ecosystem names, generalized agents or swarms, EHR integration, a native model, a marketplace, certification or competence claims, exam-performance claims, and patient-outcome measurement — no lane here is positioned to affect a patient outcome, and measuring one would imply otherwise.

Where an employer sponsors a learner, the learner's reflections and self-identified weaknesses are closed to the sponsor by default and by data model, and stated to both parties at intake.

The record

Documents

Segments

Who each lane serves, why the Learner is two markets, the five-role separation, and the cross-cutting roles that are not lanes.

Read SEGMENTS.md →

Strategy

The one-lane-per-cycle rule, the sequencing argument, the shared spine, the commercial ladder, and the stop conditions.

Read STRATEGY.md →

Implementation plan

Cycle 0 through Cycle 3 — input contracts, artifact schemas, week-by-week increments, and founder-only versus delegable work.

Read IMPLEMENTATION.md →

Evidence gates

What counts as a lane working, the reliance and deskilling checks, the planted-omission test, and the falsifiers.

Read EVIDENCE.md →

Playbook

Discovery conduct, session rules, onboarding, the refusal ritual, commit-then-compare, incidents, rights, and cadence.

Read PLAYBOOK.md →

Directory index

Status, governing maxims, the first cycle in one paragraph, and how this relates to the rest of Nurse AI OS.

Read README.md →

Related records: the governance kit supplies the risk, data and action dimensions; Nurse Formation supplies Cycle 2's learning method; Knowledge Commons supplies the distribution contract Cycle 3 depends on; Care Workforce Surge supplies the workforce context the Manager lane operates in.