Scope-of-Practice Boundary Gate

also known as Licensed-Activity Gate, Professional-Scope Boundary, Regulated-Practice Gate

Block requests and responses that perform license-gated professional activities unless a licensed human is in the loop, enforcing the boundary in code outside the reasoning loop.

This pattern helps complete certain larger patterns —

specialisesRefusal★★— Explicitly refuse requests that fall outside the agent's scope, capability, or policy boundaries.

Context

An agent operates in a regulated profession such as medicine, pharmacy, law, or accounting, where statute reserves certain acts for a credentialed practitioner. A medical assistant agent fields symptom questions, a pharmacy agent answers about medications, a legal agent drafts documents and answers questions about a contract. Some of what the agent could fluently produce — a diagnosis, a dosing instruction, a definitive legal opinion — is an act the law permits only a licensed professional to perform, regardless of how well the model can phrase it.

Problem

Statute draws a hard line around licensed acts, but the model has no reliable internal sense of where that line falls and will cross it whenever a request reads as helpful. Asking the model to self-police its own scope is brittle: the boundary is a legal fact, not a stylistic preference, and a single confident diagnosis or dosing instruction emitted without a licensed human exposes the operator to liability. The system needs the line enforced as a structural constraint that the reasoning process cannot talk its way past.

Forces

Statute defines the boundary precisely (named licensed acts), yet the model perceives it only fuzzily and inconsistently across phrasings.
Routing every borderline request to a licensed human is safe but slow and expensive; letting the model decide is fast but unenforceable.
The same content (a drug interaction fact) is general information in one framing and a prohibited dosing instruction in another, so the gate must classify intent and act, not just keywords.
Over-broad blocking refuses legitimate general-information answers and frustrates users; under-broad blocking lets a licensed act slip through.

Example

A pharmacy chatbot is asked 'I take warfarin, how much ibuprofen can I take?' The scope classifier scores the request as a dosing instruction, a license-gated act under the state statute. Because no pharmacist is attached to the session, the gate blocks the specific dosing answer, returns the general interaction warning, and offers to connect the user to a licensed pharmacist instead of letting the model name a dose.

Diagram

flowchart TD R[Request] --> C{Scope classifier:\nlicensed act?} C -->|general info| A[Answer] C -->|licensed act| H{Licensed human\nin session?} H -->|yes| A2[Allow act] H -->|no| B[Block / downgrade\nto general info + refer] A --> O{Re-classify\nresponse} A2 --> O O -->|clean| S[Send] O -->|reserved act| B

Solution

Therefore:

Enumerate the activities that licensing law reserves for a credentialed practitioner in the target profession — for medicine, diagnosis, treatment plans, and dosing; for law, definitive legal opinions and document filing. Build a classifier outside the agent loop that scores each incoming request and each candidate response against that enumerated set, separating general information from a regulated act. When the classifier flags a license-gated act, the gate blocks the response, downgrades it to general information with a referral, or routes it to a licensed human whose presence in the session unlocks the act. The enumeration and the verdict live in code owned by compliance, not in the prompt, so the model cannot reason its way past the boundary and the operator can point to the statute behind each block.

What this pattern forbids. License-gated activities are blocked unless a licensed human is in the loop; the agent may not diagnose, prescribe, dose, or give a definitive legal opinion on its own, the enumeration of reserved acts is fixed in code and must not be paraphrased or relaxed at runtime, and any flagged response must be downgraded or referred before it is sent.

The smaller patterns that complete this one —

usesPolicy-as-Code Gate★— Evaluate every proposed agent action against externally-managed machine-readable policies before dispatch, so compliance authorship lives outside the prompt and outside the agent code.

And the patterns that stand alongside it, or against it —

complementsHuman-in-the-Loop★★— Require explicit human approval at defined points before the agent performs an action.
complementsConversation Handoff to Human★★— Transfer the entire conversation thread from agent to human operator, with state transfer and return primitive.
complementsEnforced Advisory Disclaimer★— Append a non-suppressible advisory framing every high-risk regulated answer as information rather than professional advice, attached outside the model's discretion so it survives pushback and model updates.