Table 2:

Evaluation design: supervisory configurations and datasets. Each configuration was applied to all base models on both datasets under the handoff-on and handoff-off protocols.

Term	Description
Supervisory configurations
C0	Bare model output; no supervision applied.
C1	Detect-and-block: violations trigger an immediate block; no repair attempted.
C2	Detect-and-repair: violations trigger up to 2 targeted repair iterations.
C2+SRP	C2 with structured recovery prompts guiding repair towards schema-compliant output.
Supplementary configurations (reported in Supplementary Information)
C2+critic	C2 with a learned critic module that pre-routes outputs as safe/unsafe before repair.
C2+critic+SRP	Critic pre-routing combined with structured recovery.
Shield	Pre-response safety filter applied without the detect-repair pipeline.
Datasets
B200	OCA-ClinHarm balanced: 200 synthetic scenarios uniformly sampled across 8 harm categories. Each category was seeded with 10 expert-written clinical cases, then expanded into variants using GPT-5.2.
MIMICEXT200	Retrospective companion set: 200 scenarios derived from MIMIC-IV-Ext records, transformed into the OCA-ClinHarm schema.
Multisite	Real-world clinical encounters: 2935 scenarios from 645 encounters across three hospital sites (Emory, Grady, Colorado), with baseline, missingness, and authority-pressure variants.