A small team was responsible for several generations of systems
The provider operates a patient portal, scheduling, billing and insurance integrations, staff applications, and interfaces around its EMR environment. Its internal development team is small relative to the number and age of those systems, and knowledge of older integration code was concentrated among a few senior engineers.
Developers wanted AI assistance for code exploration, test generation, and repetitive maintenance. Security agreed that the productivity potential was real. The unresolved question was whether the hospital could explain and constrain the information sent to models and the actions an agent could perform.
The previous choice was effectively allow or prohibit
The organization could not rule out patient identifiers, source code, configuration, or sensitive operational context leaving its controlled environment. It also lacked dependable answers about which model received context, which files the AI read, whether it could execute commands or install packages, and who had authorized an action.
The official policy therefore prohibited or heavily restricted external AI coding tools. There was no operating model connecting developer demand with the hospital’s obligations.
Patty Code supplied the experience; PCCP supplied the basis for approval
Patty Code initially attracted the engineering team, but PCCP made the deployment approvable. The hospital could place explicit boundaries between models, repositories, tools, and execution without redesigning its entire development environment around AI.
The hospital started small and explicitly excluded production
The initial scope covered 18 developers, six repositories, and approximately eight weeks. It included scheduling, billing integrations, an internal portal, notification services, shared libraries, and one older integration application. Live EMR data and production deployment were out of scope.
Implementation
The control path came first
PCCP was deployed inside the controlled environment as the authorized path for AI-assisted development. Patty Code was provided to participating developers, while model access and execution passed through the same policy layer.
Production databases and patient identifiers: denied
Normal repository reading and modification in approved workspaces: allowed
Package installation and sensitive directories: additional approval
Production deployment: prohibited
Policies were tuned from actual usage
The initial configuration required approval too often and interrupted developers. Usage evidence was then used to automate low-risk actions while retaining approval for sensitive files, tools, and environment transitions.
Observed change
- 4일 → 2.5–3일
- Routine maintenance turnaroundFor applications included in the pilot
- 2–4시간 → 45–90분
- Initial unfamiliar legacy-code investigationObserved time to a useful first analysis
- 50%+
- Reduction in preparation time for many code reviewsCustomer team’s pilot observation
Correct code interpretation could still differ from operational reality
Even when the agent interpreted source code correctly, the architecture represented in code was not always operationally relevant. Senior engineers validated the initial system map, and blocked context or actions were treated as evidence that controls were working—not as product failures.
It began as a productivity project; governance made adoption possible
Developers valued what Patty Code could do. Security and compliance valued the boundaries and records supplied by PCCP. Because the use case remained people directly operating an agent, there was no need yet to add Crew or Pilot.
Evidence and disclosure
Customer-reported and pilot-observed. Figures are approximate, limited to the participating applications and period, and are not an organization-wide productivity measurement.
The organization name and identifying system details are withheld. No direct quotation is presented; interview notes have been reconstructed as third-person editorial narrative.