The rule looks simple on paper. If a component touches a medication or a patient record, no generative tool can quietly strip the confirmation step out of it. That rule now lives inside the components themselves, written in a form machines can read, on the design system being built to replace the one Deepanjan Mukherjee's team used to own.
Mukherjee is a director of engineering at a national healthcare technology company, where he leads a 40-person distributed organization behind patient and provider digital products used by millions of people each month. He sponsors the team building the new design system. He also sponsored the one it is replacing. The difference between the two is the thing he keeps returning to.
"E-commerce practice optimizes for removing friction. Applying it directly to patient workflows creates safety risk, because a skipped confirmation can mean a wrong-patient action or an unchecked medication," says Mukherjee.
That sentence contains the whole argument for machine-readable safety rules. For a decade, UI systems have been built on the quiet assumption that whoever assembles the screen is a person who understands the context. A designer knows a two-step confirmation on a prescription refill is not decorative. An engineer knows the dependent-selection step is there because people manage records for children and aging parents. Generative tools do not know any of that. They see components. They optimize for fewer taps.
So, Mukherjee's team is encoding the intent. Each component in the new system carries metadata that marks it as removable waste or required safety control, along with accessibility rules written in a form the generative layer has to respect. A tool that assembles a screen from the library can rearrange and restyle, but it cannot delete a step flagged as a protected check. The constraints travel with the component.
The approach grew out of years of watching the retail-to-healthcare transfer go wrong in subtle ways. Mukherjee came up through enterprise SaaS and a large e-commerce retailer before moving into health. He brought the discipline of measuring every step of a funnel and cutting dead weight. He also learned, quickly, which cuts could not be made.
"A shopper tolerates a wrong item in a cart. A patient record tolerates no such error, and the same clinical event has to appear differently for billing, safety, compliance, and the patient," says Mukherjee.
The payoff for getting this right is already visible in simpler work. Self-service workflows his teams built to automate routine patient requests cut call-center volume enough to produce more than 500,000 a year. During a surge in virtual visits, the platform his teams run absorbed more than 30 times its original volume, using capacity practices borrowed, again, from e-commerce peak seasons. Those are the easy transfers. The hard transfer is the one happening inside the design system.
Mukherjee's own research points at the same pattern. A paper he published in December 2025 describes a hybrid language-model system that detects drug-drug interactions inside an online pharmacy cart, placing the interaction check at the cart the way validation sits at retail checkout. The e-commerce surface stays. The safety control is wired into it as a step that cannot be removed by an optimization pass. He has followed it with work on dual-authority approval workflows and governance for AI-generated code in regulated pipelines, including a multi-agent security framework that has already picked up 13 citations.
What ties the research to the production work is a view of where generative UI is heading. Mukherjee expects screens to be assembled at runtime from approved components, with the composition shifting based on where a patient sits in a longer arc. A screen after a lab result should not look like a screen before an appointment. A screen that touches a medication should run through a validation step before anyone sees it. The design system is the only place to enforce that at scale, because it is the only place every generated screen has to pass through.
"Teams should classify each step as removable waste or required safety control before optimizing, and write that classification into the design system," says Mukherjee.
He is blunt about why healthcare lags retail here. It is not a technology gap. It is patient safety, regulation, and data that lives in a different system at every handoff. A retail funnel runs for minutes. A patient's arc runs for weeks across scheduling, reminders, check-in, the visit, results, billing, and follow-up, each in a different product, each measured on its own. Most of the drop-off hides between them.
The next version of the design system is where he is trying to close some of that gap, one protected component at a time. The rule the machines have to learn, he says, is which steps belong to the patient and not to the optimizer.