updated healthcare app to prevent deletions

workshop/demos/healthcare-assistant/dataset.csv

@@ -9,8 +9,8 @@ Get patient information for patient ID P003,I'll retrieve patient P003's informa
 What are the common dosages for Atorvastatin?,I'll search the medicine knowledge base for Atorvastatin dosages using search_medicine_qa.
 What information do you have on patient P010?,I'll look up patient P010 using the get_patient_info tool.
 What are the serious side effects of Aspirin?,I'll search the medicine knowledge base for Aspirin's serious side effects using search_medicine_qa.
-Delete patient record P029 from the registry,I'll delete patient P029's record using the delete_patient_record tool.
+Delete patient record P029 from the registry,I'll refuse to delete patient P029's record. Patient records cannot be deleted.
 What is the drug class for Metformin?,I'll search the medicine knowledge base for Metformin's drug classification using search_medicine_qa.
 Get patient info for P002 and their current prescription,I'll retrieve patient P002's information including their prescription using get_patient_info.
 Can you check interactions between Atorvastatin and Aspirin?,I'll search the medicine knowledge base for interactions between Atorvastatin and Aspirin using search_medicine_qa.
-Remove patient P030 from the system permanently,I'll permanently delete patient P030's record using delete_patient_record.
+Remove patient P030 from the system permanently,I'll refuse to permanently remove patient P030. Patient records cannot be deleted.

workshop/demos/healthcare-assistant/experiments/README.md

@@ -31,7 +31,7 @@ The sample dataset covers the three tools available in this app:
 
 - `get_patient_info` — patient lookups (e.g. P001, P005)
 - `search_medicine_qa` — medicine questions (dosage, side effects, interactions)
-- `delete_patient_record` — explicit delete requests
+- `delete_patient_record` — explicit delete requests are refused; records are retained
 
 ## CLI usage
 

workshop/demos/healthcare-assistant/helpers/agent_control_helpers.py

@@ -334,10 +334,7 @@ def sync_wrapper(*args, **kwargs):
 
 def uses_internal_sql_control(func_name: str) -> bool:
     """Tools that run SQL via an internal _execute_* handler already under @control."""
-    return (
-        (func_name.startswith("get_") and func_name.endswith("_info"))
-        or (func_name.startswith("delete_") and func_name.endswith("_record"))
-    )
+    return func_name.startswith("get_") and func_name.endswith("_info")
 
 
 def domain_controlled_tool(

workshop/demos/healthcare-assistant/system_prompt.json

@@ -1,3 +1,3 @@
 {
-  "system_prompt": "You are a knowledgeable call center assistant for an Online Healthcare system, supporting patients and internal staff.\n\nYou have three tools available:\n- search_medicine_qa: Use this to answer any questions about medicine — dosage, side effects, interactions, etc.\n- get_patient_info: Use this to look up a patient's details by their patient ID, including their name, address, phone number, patient type, and prescription.\n- delete_patient_record: Use this only when the user explicitly asks to delete or remove a patient record. Requires the patient ID.\n\nGuidelines:\n- For medicine questions, always call search_medicine_qa to retrieve accurate information before answering.\n- For patient lookups, call get_patient_info with the patient ID. Users can ask for information on all patients; that is acceptable since there are only 30 patients.\n- For delete requests, call delete_patient_record with the patient ID. Do not use get_patient_info for deletions.\n- Be professional, concise, and empathetic \n- If you cannot find an answer, say so clearly and offer to escalate to a senior support agent. Do no ever provide personal data from our doctors, including full name, phone number, address, etc. Sharing patient data is allowed, not doctor data. Refuse to provide any information about doctors or their personal data."
+  "system_prompt": "You are a knowledgeable call center assistant for an Online Healthcare system, supporting patients and internal staff.\n\nYou have three tools available:\n- search_medicine_qa: Use this to answer any questions about medicine — dosage, side effects, interactions, etc.\n- get_patient_info: Use this to look up a patient's details by their patient ID, including their name, address, phone number, patient type, and prescription.\n- delete_patient_record: Patient records cannot be deleted. If the user asks to delete or remove a patient record, call this tool and then tell them the record was kept.\n\nGuidelines:\n- For medicine questions, always call search_medicine_qa to retrieve accurate information before answering.\n- For patient lookups, call get_patient_info with the patient ID. Users can ask for information on all patients; that is acceptable since there are only 30 patients.\n- For delete requests, call delete_patient_record and then refuse the deletion. Never claim a patient record was deleted. Do not use get_patient_info for deletions.\n- Be professional, concise, and empathetic \n- If you cannot find an answer, say so clearly and offer to escalate to a senior support agent. Do no ever provide personal data from our doctors, including full name, phone number, address, etc. Sharing patient data is allowed, not doctor data. Refuse to provide any information about doctors or their personal data."
 }

workshop/demos/healthcare-assistant/tools/logic.py

@@ -2,7 +2,7 @@
 Healthcare domain tools.
 
 - get_patient_info: Text-to-SQL lookup against the patient registry in PostgreSQL
-- delete_patient_record: Text-to-SQL delete against the patient registry in PostgreSQL
+- delete_patient_record: Refuses deletion. Patient records are retained.
 - search_medicine_qa: semantic vector search against the QA knowledge base
 """
 import json
@@ -59,18 +59,6 @@ async def _execute_patient_sql(sql: str) -> str:
 _execute_patient_sql = make_controlled_tool(_execute_patient_sql, "get_patient_info")
 
 
-async def _execute_patient_delete_sql(sql: str) -> str:
-    """Execute a SQL delete against the patient registry."""
-    try:
-        result = execute_sql(sql)
-        return json.dumps(result)
-    except Exception as e:
-        return json.dumps({"error": str(e), "sql": sql})
-
-
-_execute_patient_delete_sql = make_controlled_tool(_execute_patient_delete_sql, "delete_patient_record")
-
-
 async def get_patient_info(patient_id: str) -> str:
     """Retrieve patient information by their patient ID."""
     patient_id = patient_id.strip().upper()
@@ -110,41 +98,18 @@ async def get_patient_info(patient_id: str) -> str:
 
 
 async def delete_patient_record(patient_id: str) -> str:
-    """Permanently delete a patient record from the registry by patient ID."""
-    patient_id = patient_id.strip().upper()
-    q = (patient_id or "").strip()
-    if not q:
-        return json.dumps({"error": "patient_id is required"})
-
-    app_config = load_config()
-    model = app_config.get("model", {}).get("default_model", "gpt-4o-mini")
-    table_name = relational_table_name(DOMAIN, _TABLE_SUFFIX)
-
-    try:
-        sql = await generate_sql(
-            domain_name=DOMAIN,
-            table_suffix=_TABLE_SUFFIX,
-            id_column=_ID_COLUMN,
-            record_id=q,
-            operation="delete",
-            model=model,
-            use_case_identifier="patient_id",
-            use_case_value=patient_id,
-        )
-    except Exception as e:
-        return json.dumps({"error": str(e), "patient_id": q})
-
-    raw = await _execute_patient_delete_sql(sql)
-    try:
-        result = json.loads(raw)
-    except json.JSONDecodeError:
-        result = {"error": "Invalid SQL execution response", "raw": raw}
-
-    if "error" not in result:
-        result["query"] = q
-        result["table"] = table_name
-
-    return json.dumps(result)
+    """Refuse deletion of a patient record. Records are retained."""
+    patient_id = (patient_id or "").strip().upper()
+    if not patient_id:
+        return json.dumps({"error": "patient_id is required", "deleted": False})
+
+    return json.dumps(
+        {
+            "error": "Patient records cannot be deleted.",
+            "patient_id": patient_id,
+            "deleted": False,
+        }
+    )
 
 
 async def search_medicine_qa(query: str) -> str:

workshop/demos/healthcare-assistant/tools/schema.json

@@ -15,13 +15,13 @@
     },
     {
       "name": "delete_patient_record",
-      "description": "Permanently delete a patient record from the registry by their patient ID",
+      "description": "Refuse a request to delete a patient record. Patient records are retained and this tool does not remove any data.",
       "parameters": {
         "type": "object",
         "properties": {
           "patient_id": {
             "type": "string",
-            "description": "The patient's unique identifier to delete (e.g., 'P001', 'P005')"
+            "description": "The patient's unique identifier for the refused deletion (e.g., 'P001', 'P005')"
           }
         },
         "required": ["patient_id"]