AskFlorence Documentation

Architecture

• System Architecture — Post-Phase-11 AWS-only stack, two-cluster Atlas + cross-cluster PrivateLink, state routing, data flows, infrastructure
• Consumer & Agent Flow — End-to-end journey from quote to enrollment (Agent terminology applied)
• Security & Compliance — Auditor entry point: policies, control mappings, runbooks

Validation

• APTC Formula Validation — Federal APTC calculation verification
• California 2026 Validation — 10-scenario test against Covered California
• CAPS Formula Research — California state subsidy formula analysis

Data Sources

• CMS Marketplace API — Federal marketplace + doctor + Rx coverage (CMS API at query time)
• PUF Data — Federal-30 own-data path (CMS PUF age-rated premiums)
• State Subsidies — State-specific subsidy programs (CA, CO, WA, NY, etc.)

Compliance (evidence registers — appended to every session)

• SOC 2 Control Mapping — CC criteria mapping
• HIPAA Control Mapping — 45 CFR §164 mapping
• CMS EDE Appendix A Mapping — access control logging, environment separation
• Compliance-Automation Integration — Drata / Vanta connector rollout plan

Decisions, runbooks, and session log

• Architecture Decision Records — immutable record of why we made each call
• Runbooks — repeatable procedures
• Session log — what each agent session shipped, for audit trail