Data Use Agreement Lifecycle Platform
From a single requirements document to a working, multi-tenant SaaS platform, built by a small, expert-led team using a spec-driven, AI-agent-assisted engineering pipeline. Developed internally ahead of a prospective FDA opportunity, demonstrating the same delivery approach behind our active federal engagements.
Expert-Directed
AI-Executed · Small, Senior-Led Team
9
CDK Infrastructure Stacks
12+
AWS Services Integrated
80+
API Endpoints Built
The Challenge
Data Governance Trapped in Email and Spreadsheets
Organizations that share sensitive data (research institutions, healthcare systems, government agencies) are legally required to execute Data Use Agreements (DUAs) before any data transfer. But the reality of managing those agreements was painful, manual, and fragile.
There was no system of record. No audit trail. No enforcement. Just email threads, PDF attachments, and spreadsheets that someone had to remember to update. The pain was real, and it was slowing down programs that depended on timely data access.
Data Use Agreements were negotiated over email chains with no version control, so teams lost track of what was agreed, when, and by whom
Signatures were collected as PDF attachments, offering no legal traceability and requiring manual re-filing for every amendment
Agreement status lived in spreadsheets: no centralized view, no automated reminders, no audit trail
Data access restrictions agreed in a DUA had no automated enforcement; once signed, compliance was purely manual
Cycle times stretched to weeks, delaying research programs and data sharing initiatives that depended on timely approvals
Scaling to dozens of simultaneous active agreements required proportionally more staff, which is an unsustainable model
Federal Applicability
The architecture patterns and delivery methodology used here are directly applied to active programs at FDA and ED, and completed VA past performance. The same expert-directed, AI-executed pipeline that built this platform is the foundation of our federal technology subcontracting capability.
How We Build with AI
The Multi-Agent Pipeline
One requirements document. Six specialized AI agents. A production platform. Each agent performs a discrete role: no context drift, no assumption shortcuts.
Input
requirements.md
Requirements
spec-requirements
EARS-format acceptance criteria derived from a single requirements document: complete, unambiguous, testable.
Architecture
spec-design
Complete system architecture, data models, and API contracts, with every architecture decision documented before a line of code.
Task Planning
spec-tasks
Atomic, reviewable implementation tasks breaking architecture into discrete, dependency-ordered work units.
Implementation
spec-impl
Production code generated per task: pure feature logic across backend, frontend, database, and infrastructure.
Security Audit
spec-review
Autonomous security review: RBAC, RLS, OWASP Top 10, injection risks, and access control, applied to every implementation task.
Test Generation
spec-test
Independent test suites generated by a separate agent: unit tests, Playwright E2E tests, and a full backend test suite.
Output
Production Platform
The Solution
End-to-End Data Agreement Governance
A secure, multi-tenant SaaS platform that manages the full lifecycle of Data Use Agreements, from drafting through enforcement.
Full DUA Lifecycle Management
From creation through negotiation, signing, amendments, and expiration: the entire agreement lifecycle in one place. Auto-generated DUA numbers, HHS DUA Policy fields pre-built, status tracked at every step.
Multi-Party Clause Negotiation
Both parties discuss and negotiate individual terms inline with threaded comments, with no email required. Every round of negotiation creates a new version with a complete edit history.
Digital Signatures with Legal Traceability
Canvas-based drawn signatures with exact timestamps and immutable signing history. Not a checkbox: a real signature, captured with full audit context.
Machine-Readable Rule Export
On signing, agreements are automatically exported as structured JSON policies, enabling external data platforms to programmatically enforce DUA restrictions without manual intervention.
Immutable Audit Trail
Every action (DUA creation, status changes, term edits, signatures, comments) is logged at the database level. Records cannot be altered or deleted. Compliance-ready from day one.
Multi-Tenant Architecture
Schema-level tenant isolation, not just row-level filtering. Multiple organizations share one platform with zero cross-tenant data leakage and independently configurable workflows.
Also Delivered
AI Value-Add
What Our AI Approach Added Beyond Code
The AI didn't just write code. It brought architectural rigor, security discipline, compliance intelligence, and operational quality that traditional development rarely achieves consistently.
Architecture-First Thinking
Architecture decisions documented before a single line of code, ensuring system integrity by design.
Security by Default
OWASP Top 10 reviewed on every implementation task. Security isn't a phase; it's built into every step.
Compliance Intelligence
Full HHS DUA Policy (HHS-OCIO-CDO-2023-01-001) compliance built in, not bolted on after delivery.
Multi-Tenant Isolation
Schema-per-tenant, RLS on every table. Isolation at the database level, not just the application layer.
Async Event Architecture
Multiple notification event types via SES + SNS async pipeline: scalable, reliable, loosely coupled.
Living Documentation
5 role-specific user guides auto-generated: Admin, Data Provider, Data Recipient, Reviewer, Auditor.
Zero-Downtime Migrations
23 Alembic migrations: every schema change forward-only, tested, and zero data loss.
Full Infrastructure as Code
9 CDK stacks, 12 AWS services, reproducible environments: dev, staging, and production from one codebase.
Self-Improving Quality Loop
3-agent review cycle on every change: implement → security review → independent test generation.
Expert-Validated Output
Every AI-generated artifact, including architecture decisions, implementation tasks, security reviews, and test suites, was reviewed and approved by the senior architect before integration. AI executes; the expert decides.
The Impact
Architecture Discipline, Built with a Small, AI-Assisted Team.
Small Team
Senior-led delivery
AI-agent-assisted pipeline, not a large multi-role team
9
CDK infrastructure stacks
Reproducible dev, staging, and production environments
80+
API endpoints built
Across 12 AWS services
Multi-Suite
Automated test coverage
Unit, integration, and end-to-end suites covering the core platform
Low-Cost
Infrastructure cost
Pay-per-request · scales with usage · multi-tenant
Multi-Layer
Codebase
Backend, frontend, and infrastructure-as-code
20
Database tables
Row-Level Security enforced on every one
Documented
Architecture decisions logged
Before a single line of code was written
By the Numbers
A Different Kind of Development
The direct comparison: what this engagement delivered vs. what traditional development would have required.
Traditional Approach
This Platform
Internal Build, In DevelopmentTechnologies Used
The Stack Behind the Platform
Frontend
- Next.js 15 (App Router)
- React 19
- Tailwind CSS 4
- shadcn/ui
- TanStack Table
- React Hook Form
- TipTap (Rich Text)
Backend
- FastAPI (Python 3.12)
- SQLAlchemy 2.0 (async)
- PostgreSQL 16
- Pydantic 2.7
- Alembic (23 migrations)
- pytest / pytest-asyncio
AWS Cloud (12 Services)
- Lambda (API + Email)
- RDS PostgreSQL 16
- AWS Cognito (Auth)
- S3 (Storage)
- CloudFront (CDN)
- SES (Email)
- SNS / SQS
- Amplify
- ECR (Docker)
- EventBridge
- Secrets Manager
- CloudWatch
Security & Compliance
- JWT RS256 / JWKS verification
- Row-Level Security (RLS)
- Schema-per-tenant isolation
- HHS DUA Policy fields
- Immutable audit logging
- AWS Secrets Manager
- 3-tier VPC network
DevOps & Testing
- GitHub Actions + OIDC
- Infrastructure-as-Code (CDK)
- Vitest (unit tests)
- Playwright (E2E tests)
- Multi-environment (staging / prod)
- Automated deployment pipeline
This engagement is managed under the direction of Shweta Nagpal, Founder & President, elfOvations LLC.
Have a Similar Requirement?
This platform demonstrates how an expert-directed, AI-executed pipeline pairs senior architecture with a small, AI-agent-assisted delivery team. Tell us your requirement and we will show you what is possible.