Chains of Trust

Good Agent Practices will unlock Pipeline-in-a-Person

This morning, I swallowed a pill. How did I know the drug I took works as advertised?

Honestly, I didn’t. Could I have “verified” that pill?¹ Realistically, not. When we take medications, we implicitly trust the pill is the drug. Why? Because it is supported by a Chain of Trust. The FDA reviewed it and polices its marketing claims, the drug’s developer ran clinical trials to establish its safety and efficacy, the manufacturer followed the FDA-approved process to produce it, the analytical chemist tested the drug product, and so on. We trust that if, at any point, a step fails, someone will step in and stop the sale of the drug. Typically, that’s how it works.² In the absence of formal verification, consumers need confidence in the products they purchase.

How do we build trust in the absence of verification? What implications does this have for using AI agents in biotech?

We bridge the verification loop with unbroken Chains of Trust. For success, the chain must remain intact. AI agents will give drug-hunters operational leverage once we establish the guardrails for ground truth. This infrastructure will prove foundational for letting agents operate while preserving the Chain of Trust. Provenance becomes increasingly important as smaller teams adopt the operational leverage towards realizing Pipeline-in-a-Person.

Still Waiting

Often, a decade separates the conception of a drug’s therapeutic hypothesis and its ultimate clinical validation. The decade is bridged by punctuated milestones, each supported by well-documented clinical, manufacturing, and laboratory results. The unbroken Chain of Trust lets us trust the output of the ultimate clinical studies verifying the therapeutic hypothesis. Until then, we’re waiting for the world to stop hating. Find a good reason for the world to believe.

This weekend, the full results from two large Phase 3 cardiovascular (CV) outcomes trials for anti-IL-6 ziltivekimab (ZEUS) and anti-Lp(a) ASO pelacarsen (HORIZON) were presented at the American Heart Association Scientific Sessions. Each trial took at least half a decade to run. Each drug hypothesis took over a decade of work. How did we know that we were on the right track towards validating the concepts?

Well, we had intermediate checkpoints. The anti-IL-6 and anti-Lp(a) programs had similar development patterns.

• Phase 2 - markers of target engagement: decreases in hsCRP, a downstream marker of IL-6 signaling, with ziltivekimab, and -10-15% LDL-C

• Phase 1 - verified safety, tolerability, and drug exposure in healthy volunteers

• Pre-clinical - safety in large and small animals, efficacy in transgenic models

• Human Genetics - genetic variants proxying the drug’s action were associated with a reduced risk of adverse CV events

These checkpoints all increased the expectation that ZEUS and HORIZON would show a reduction in major adverse CV events.

Prior to the readouts, we knew that each drug engaged its target. The target engagement moved a relevant biological marker. The safety and tolerability profile supported long-term use.³ We can trust that the results of the studies — Phase 1 through Phase 3 — are reliable because the studies adhered to GCP (Good Clinical Practice). These intermediate readouts were, in turn, also supported by extensive characterization of the drug product to ensure patients received the intended intervention. The manufacturing process was supported by extensive documentation and quality control practices collectively known as cGMP (current Good Manufacturing Practice). Furthermore, we had confidence in the safety and tolerability of the drug products because the toxicology studies were conducted in laboratories following GLP (Good Laboratory Practice). While the human genetic evidence is inherently post hoc and non-randomized, both targets are supported by the best available evidence from large databases using the most statistically sophisticated methods (see Marios Georgakis at his excellent Substack The Codon: IL-6 genetics, Lp(a) genetics).

So, regardless of the result of ZEUS and HORIZON, we can be confident that the studies tested the therapeutic hypotheses — inhibition of IL-6 or lowering of Lp(a) reduces MACE — robustly. The foundation built by years of clinical and pre-clinical work enabled the test of the therapeutic hypothesis. Without success at the intermediate Phase 1 and Phase 2 checkpoints verifying markers of drug activity, we probably couldn’t trust that ZEUS or HORIZON would test the therapeutic hypothesis.

So, when both read out negatively — HR: 0.99 (0.88–1.11) for 3-point MACE in ZEUS and HR: 1.02 (0.90–1.15) for 4-point MACE in HORIZON — we can trust that the therapeutic hypotheses, for these agents in these populations, are falsified. Now, that doesn’t preclude success for these agents in different indications or different patient populations. It’s entirely plausible that, to show a MACE benefit, both agents depend on elevated LDL-C that was present in the human genetics cohorts but absent in the populations studied. But, the therapeutic hypotheses have been tested: negative.

At this point, we can’t predict which new therapeutic hypotheses will work with high fidelity. We need clinical validation. That takes years of meticulous effort. A decade of work only counts if every input into the Chain of Trust is sound.

Push it to the limit

Hypotheses are fast and cheap. Experimental validation is slow and expensive. To triage the therapeutic hypotheses towards identifying ones worth pursuing, we filter based on a slate of criteria: mechanistic plausibility, therapeutic tractability, animal models, human genetic evidence, clinical observations, and so on. As stewards of patient health, capital, and time, we prioritize testing the best therapeutic hypotheses. While many groups may have strict evidentiary hierarchies, it’s not clear to me that one form of evidence is strictly superior. To me, what’s most important is that the evidentiary points are all well supported and well documented. If there’s a break in the causal chain — say mice don’t express your target — then, that’s not invalidating, but advancing without in vivo support is a risk. What likely is invalidating is inclusion of incorrect or invalid results.

A year ago, LLM hallucination was a major barrier to use. Now, it’s an occasional frustration. But, that can still be fatal. As we abstract people from the generation of ideas and leverage LLMs to automate scientific discovery, we risk introducing poison into our Chains of Trust.

Today’s AI agents are like prodigious and prolific employees who struggle with documentation. They can produce great work quickly. It usually replicates. But, tracing the origin of the results isn’t always straightforward. “Usually reliable” can be fine. It can also be fatal. In drug development, it’s often the latter. A single DNA base can transform success into failure. How do we manage?

When making decisions for a therapeutic program, the precise evidence and its quality must be clear. If an AI agent makes an error — a hallucination, a misinterpreted reference, papers describing a non-existent phenomenon — that propagates into the therapeutic hypothesis’ Chain of Trust, then you’re building on a foundation of sand. Even at 98% accuracy, an Agent executing 50 tasks will only produce a pristine record just over a third of the time. As the horizon extends, the errors compound. The probability of emerging unscathed shrinks exponentially.

Not all mistakes are fatal. Everything may work out. But you may have introduced risks into your program that you don’t know of and can’t comprehend. Over time, the risk of introducing false information that compromises the integrity of the therapeutic Chain of Trust compounds and lowers the probability of success. This isn’t an insurmountable problem, but it’s certainly a frustrating one.

Everything’s Principal-Agent Problem

The astute reader might pose the following question: Why does this matter if humans make errors already? Even if, on the surface, it might seem like a weak objection, it’s central to the issue. How do we manage information integrity today?

Let’s explore an oversimplified example.

Has the CEO of your typical public biotech company reviewed the CMC package for every IND the company submits? No. Typically, the job of a public, development-stage CEO is to:

1. Set and align strategy

2. Raise funds for operations

3. Build the team and delegate responsibility

I’d guess the typical public biopharma CEO wouldn’t know how to review the Module 3 (CMC) for every IND filed. Usually, that responsibility is delegated to a trusted employee or partner. But — crucially — there’s ultimately a human accountable.

Now, of course, the head of CMC could mislead the CEO. The head of CMC could be misled by the CDMO that makes the drug. The CDMO could be misled by a rogue employee falsifying cGMP records (or, as in the case of Ranbaxy, falsification can be company policy). Implicitly, a Chain of Trust runs from the line workers of the CDMO through to the CEO.

Economists talk about the Principal-Agent problem. A principal contracts an agent to do work on its behalf. The agent knows more about the work than the principal. The interests of the Principal and the Agent generally align. However, they are not identical. Over the course of the relationship, the Agent can make choices, blind to the Principal, in its self-interest. This is your mechanic recommending a more expensive service than you need. Or your real estate agent pushing for a quick sale below your target price. Principal-agent problems emerge wherever parties have asymmetric information and non-aligned incentives.

The CEO-to-CDMO relationship is a Chain of Trust plagued by principal-agent gaps. We do our best to solve the chain of principal-agent problems — CEO-to-CMC lead, CMC lead-to-CDMO, CDMO-to-worker — with additional mechanisms: we align financial incentives of the company and the CDMO, all parties have “skin-in-the-game” via their reputations, we cooperate on small projects to signal competence, and we write contracts to be explicit and enforceable.

Pipeline-in-a-Person will help AI accelerate R&D

But, if we take the Pipeline-in-a-Person concept seriously, what happens when we replace the head of CMC with an expert AI agent? The Chain of Trust still exists. It has to. Responsibility still lies with the CEO, but now directly. The AI agent says “it’s all fine”. The CEO might not know what “fine” looks like. But, the CEO trusts the expert AI agent. It’s 98% correct. It’s probably “fine”. But, oops, the GLP-tox lot wasn’t fine. The Agent and CDMO missed subtle signals of contamination. The program blows up six months later.

Instead of resolving principal-agent problems, introducing AI agents makes many principal-agent problems worse! The agents remove the levers we use to manage them. Now, an unknown number of steps separates the CEO from the ground truth. An AI agent doesn’t have high-level financial incentives to align. Nor does the AI agent have skin-in-the-game like a professional reputation. Realistically, aside from task-specific Reinforcement Learning, evaluation design and extensive monitoring are the most tractable ways to reliably and productively align AI agents in a biotech. For the near future, companies pursuing the Pipeline-in-a-Person vision will need to rely on expert human agents for verification. But, as frontier LLMs progress to become more capable than human experts, the desire for verifiability remains.

Chains of Trust

Chains of Trust aren’t new. Nuclear energy, medicine, aerospace, and biopharmaceuticals all run on them.

To maintain its Chain of Trust, the pharmaceutical industry uses GxP standards — Good “G” Practices “P” — for each sub-discipline: manufacturing (GMP), laboratory (GLP), clinical (GCP), documentation (GDocP), and pharmacovigilance (GVP). These regulations compel documentation and tracking to ensure that patients, providers, companies, and regulators can all maintain confidence in drug products, like the pill I took this morning.

ZEUS and HORIZON show GxP at work. Even if we dislike the results, we trust the results because the studies followed GCP. We trust patients received the right drug because production followed cGMP. Every conclusion can be traced through an unbroken Chain of Trust. But, perhaps, Chains of Trust might better be understood as linked trees of trust.

Every input into a GxP process must be documented. GxP compliance forms a burden, but it also forces businesses to validate inputs into the process and maintain the Chain of Trust. GxP is part of what gives us confidence in clinical development. The Chain of Trust remains unbroken because all its inputs are tracked, characterized, and verified with qualified and validated processes. Failure of a single input, say a contaminated GLP toxicology lot, breaks the Chain of Trust and impairs all downstream activities.

What does this mean for biopharma businesses aiming to leverage AI agents? Well, it means that, as humans operate at higher levels in the operations and knowledge production loops, we need new GxP for agents: Good Agent Practices. Plainly: deterministic infrastructure that ensures the traceability and provenance of inputs into the reasoning chains. We must build guardrails help humans and AI agents keep line of sight to ground truth.

Anyone who has worked with AI agents in a scientific context can appreciate how much progress has been made in the past year to reduce errors. Agentic tools now genuinely support and advance discovery. As agent tasks get increasingly complex, the risk of introducing contaminated information — false, unvalidated, unverified — that in turn contaminates the reasoning traces supporting our therapeutic hypothesis compounds. Today, assembling the trees that support the links in our Chain of Trust is largely a human-guided endeavor. Audit and validation of the conclusions is already human-bottlenecked. As agent use grows, we will need to develop new infrastructure to help drug developers move beyond human-directed audit and validation of every input. Good Agent Practices should buy every program what a decade of diligent GxP work bought HORIZON: a result we can trust, even if it’s one we didn’t want.

Still unwritten

Perhaps the dominant vision of AI in biopharma is “AI as replicator”. Millions of tokens have been spilled arguing that in the future AI will “design” me-too drugs, saving weeks on a years-long timeline. While certainly possible, it’s not clear how that’s useful or valuable. It’s already quite possible today with experimental tools only. Yes, the success rates of “AI” may appear higher than industry averages as the “AI as replicator” eschews biological risk. ROI? I bet that will be a different story. Winning in drug discovery requires a deep understanding of the problem and solution. The AI me-too factory lacks vision. It unlocks nothing.

The “AI as oracle” vision is more optimistic. Perhaps LLMs can solve our predictive validity problem and point us towards better models of disease. How would that happen? Not clear. Does AI enable you to run “agents across 20,000 genes in parallel”? I don’t know what that means. But, sure, it probably does. It’s also a problem nobody has. At this point, “AI as oracle” is a leap of faith. We’ll start to find out if this vision has legs in the clinical validation loops of the next decade.

Pipeline-in-a-Person offers a different direction. Drug discovery and development is a team sport. Few people have the end-to-end breadth and slide-to-instrument depth to understand a whole drug program. Today’s virtual biotech leverages a team of experts to advance a novel (or not) program efficiently. By giving low-N teams of visionary drug-hunters more operational leverage, AI enables them to expand their horizons. On the margin, each isolated improvement — cost savings, improved decision making, better project management — appears mundane. But, when compounded, these gains unlock Pipeline-in-a-Person. Soon, human-AI teams may begin to develop the breadth, depth, and leverage needed to pursue multiple novel, first-in-class programs in parallel. That’s new and impactful.

Getting there will take work. AI agent support infrastructure isn’t as flashy as “AI-designed” “peptides.” It means solving mundane information provenance problems. But, that foundational infrastructure unlocks Pipeline-in-a-Person. Without it, AI-leverage builds on a foundation of sand. The gains from AI in biotech come from mastering the orchestration layer by working on real, live programs, not contrived LLM-generated benchslop. Enhancing the capabilities of human-AI drug-hunter teams shifts the bottleneck again: to the scarce convergence of vision paired with scientific, clinical, or patient insight. Without vision and insight, AI agents — and Pipeline-in-a-Person — are just another AI for biotech solution in search of a problem.

1. Given I have a PhD in Chemical Biology and extensive small and large molecule characterization experience, could I have ground up a random sample of pills and run LC-MS/MS and 1H NMR to positively identify the API and assess purity? Given enough time and resources, sure. Does that confirm that the drug works as promised? No.

2. But, anyone familiar with generic drugs, or the name Ranbaxy, knows that’s not always true. But, for progress it has to be true.

3. This is debatable, of course. Patients on ziltivekimab were more likely to experience a serious infection. Patients on pelacarsen were more likely to experience AEs: Drug-related AEs 57% vs 18%; discontinuation related to AEs 21% vs 8%; flu-like reactions 32% vs 6%. It’s hard to prove those AEs didn’t impair on-target drug efficacy.