> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usehasp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Example: Scheduled Compliance Scan

> A headless scheduled workflow that scans entity records for compliance gaps, generates an AI summary, and emails the compliance officer weekly.

This example walks through building a weekly compliance scan — a headless scheduled workflow that audits patient records for open compliance tasks, generates a structured AI summary, and delivers it to the compliance officer. No UI surface needed.

## What you're building

| Resource                 | Description                                                  |
| ------------------------ | ------------------------------------------------------------ |
| **Workflow** (Scheduled) | Weekly compliance scan — fires every Monday at 8am           |
| **Entity**               | `compliance_task` — outstanding compliance items per patient |
| **Integration**          | Email over SMTP (`email_smtp`) — weekly summary              |
| **Setting**              | `compliance_officer_email`, `scan_cadence`                   |

## Step 1: Create the project

Click **New Project**. Name it *Compliance Operations*.

## Step 2: Author the workflow

In chat:

> *"Every Monday morning at 8am, I want to scan all open compliance tasks — things like overdue HIPAA consent reviews, missing BAA acknowledgments, and patients flagged for follow-up — and send a summary email to the compliance officer. The email should group findings by severity and include a count of how many items have been open for more than 30 days."*

The system asks: *"What starts this? It sounds like a weekly schedule — shall I make this fire every Monday at 8am Central?"* → Confirm.

The system:

* Creates a `compliance_task` entity with fields: `patient_id`, `task_type`, `severity` (low/medium/high), `due_date`, `status`, `opened_at`
* Creates the compliance scan workflow with trigger: schedule (every Monday 08:00 America/Chicago)
* Compiles steps: query open tasks → group by severity → identify overdue (>30 days) → AI summary generation → email delivery

## Step 3: Configure the schedule

The system infers the schedule from your description. To adjust:

> *"Change the cadence to every first Monday of the month instead."*

The contract updates. The schedule is expressed in natural language during authoring and compiled to a cron expression in the contract.

## Step 4: Add a setting for the email address

```
compliance_officer_email = compliance@acme-health.com
scan_cadence             = weekly
```

The notification step references `compliance_officer_email` by name.

## Step 5: Run a manual test

From the test/run console, click **Run Now (Sandbox)**. This fires the workflow immediately without waiting for the Monday schedule.

The trace shows:

1. `query_tasks` — retrieved 47 open compliance tasks from the `compliance_task` entity.
2. `group_by_severity` — high: 3, medium: 12, low: 32
3. `flag_overdue` — 11 tasks open more than 30 days
4. `generate_summary` — AI inference (PHI-processed): *"3 high-severity items require immediate action: two patients have BAA acknowledgments expired more than 90 days ago, one patient consent review is 45 days overdue. 11 total items are beyond the 30-day threshold."*
5. `send_email` — **sandbox:** *"would have sent summary email to [compliance@acme-health.com](mailto:compliance@acme-health.com)."*

## Step 6: Review the AI summary step

Open the `generate_summary` step in the trace. The AI call:

* **Model**: Claude Haiku (low-cost summarization, appropriate for this step)
* **Input**: anonymized record counts and task metadata (no patient names or identifiers passed to inference)
* **Output schema**: `{ summary: string, high_count: int, overdue_count: int, action_required: boolean }`
* **PHI guard**: active — all patient identifiers stripped before inference; summary is non-PHI output

To change the summary format, describe it in chat: *"Include a bulleted list of high-severity items with their task type and how many days they've been open."* The system updates the inference step's prompt in the contract.

## Step 7: Add a condition for empty scans

In chat:

> *"If there are no open compliance tasks, skip the email."*

The system adds a condition step before the summary: `if open_task_count == 0 → end`. No email fired when everything is clean.

## Step 8: Release

Click **Release**. Summary: *"Initial release: weekly compliance scan workflow. Fires every Monday at 8am Central. Sends summary to compliance officer when open items exist."*

Review the diff and publish.

## What happens in production

Every Monday at 8am Central:

1. The workflow fires on schedule.
2. All open `compliance_task` records are queried.
3. Counts are computed by severity and overdue threshold.
4. AI generates a structured summary — PHI stripped before inference.
5. The email integration sends the real email to the compliance officer.
6. The run trace is audited and retained.

If there are zero open tasks: the condition exits early; no email is sent; the run is still traced.

## Extending the example

* **Add Slack notification** for high-severity items: if `high_count > 0`, post a direct message to the compliance officer on Slack in addition to the email.
* **Multi-org scan**: extend the entity to include `org_id` and run the scan across multiple orgs in the same account.
* **Dashboard app**: add a role-gated app (`/compliance`) that shows live task status — the same `compliance_task` entity, rendered as a filterable table. Clinical admins can view and close tasks without waiting for the Monday email.
* **Automated remediation**: for specific task types (e.g., auto-resend consent forms), add a step that fires a remediation workflow on each open high-severity task rather than just reporting.