Design guidance
Governance anti-patterns
Sets out access and audit practices that weaken governance, why they occur, and the arrangement Pensieve supports in their place.
Some access and audit habits weaken governance even where everyone means well. This page names the common ones, why they arise, and the arrangement Pensieve supports in their place, so a reviewer can tell a weak pattern from a sound one.
Why these persist
Each habit below trades a governance property for a moment of convenience. Pensieve keeps the convenience and holds the property, so the trade stops being necessary.
The shared ward login
The habit
One ward account that every member of staff signs in with, so the record names the ward rather than the person.
Why it happens. Repeated sign-in feels slow on a busy ward, so a team settles on a single standing login to save time.
What Pensieve supports. Each person signs in with their own PIN on an enrolled shared workstation, and the next sign-in supersedes the last. Quick sign-in keeps the pace, and the record names the acting clinician for every entry.
Access from a role alone
The habit
A role that opens every patient's record, so anyone holding it reads any chart whether or not they are caring for the patient.
Why it happens. A single broad role is simple to reason about, and it avoids the work of tying access to a current relationship.
What Pensieve supports. Access is decided from the role and the person's relationship to the patient in front of them together. A role sets what kind of work a person may do, and a current care relationship, established by admission and consent, brings a specific record into view.
Standing emergency access
The habit
A broad override left switched on at all times, so an urgent read has no separate record and no boundary.
Why it happens. A team fears being held back in a crisis, so it keeps the override permanently open as insurance.
What Pensieve supports. Emergency access is a defined path, opened for one case with a stated reason and a time-boxed window. It is fully logged with the clinician, the time and the reason, so an urgent read stays available and stays accountable.
The audit kept to one side
The habit
Access and change logs collected in a separate system that lags behind the work, or that an operator can edit after the fact.
Why it happens. The log was added late, so it sits beside the clinical system rather than inside it.
What Pensieve supports. The audit entry is written in the same transaction as the read or change it describes, so a committed action always carries its entry. The trail is append-only, so the history a reviewer reads is the history that happened.
The all-seeing administrator
The habit
A super-user account that sees every record by design, outside the access model that governs everyone else.
Why it happens. A single account that bypasses the rules is convenient for support and for one-off fixes.
What Pensieve supports. The interface a person sees is a projection of what they are permitted to do, and that holds for an administrator too. An administrator acts within the model, and their access is logged like any other, so support work stays inside the audit trail.
The switched-off timeout
The habit
Idle locks removed so staff sign in less often, leaving unattended clinical screens open on the ward.
Why it happens. Signing in again felt slow, so the lock was turned off to spare the interruption.
What Pensieve supports. Quick sign-in makes the lock affordable, so a shared workstation locks on idle and the clinician signs back in with a PIN. The session length and idle period are tuned per site within the platform's limits.
The patterns side by side
The table below pairs each habit with the property it puts at risk and the arrangement Pensieve holds in its place.
| The habit | The property at risk | What Pensieve supports |
|---|---|---|
| Shared ward login | Attribution | Per-person quick sign-in on a shared workstation |
| Access from a role alone | A current reason to see the record | Role and relationship decided together |
| Standing emergency access | Accountability of an urgent read | A time-boxed, logged emergency path with a reason |
| Audit kept to one side | A complete, tamper-evident trail | The audit entry written with the change |
| All-seeing administrator | Access as a projection of permission | Administrators act within the model and are logged |
| Switched-off timeout | An unattended screen returning to locked | A tuned idle lock with quick sign-in |
Each sound alternative rests on the same two mechanisms: an access decision from role and relationship, and an audit entry written with the change. Read how a permission is decided at the authorisation model, and how each access is recorded at the audit trail.