Design guidance
Integration anti-patterns
Sets out integration approaches that create fragile links, why they arise, and the pattern Pensieve supports for each in their place.
Some integration approaches read as quick to stand up, then hold a hospital to a brittle link that breaks under load or drift. This page sets out the integration shapes that create fragile connections, why each one arises, and the pattern Pensieve supports in its place.
The shapes to avoid
Each approach below arises from a reasonable wish to move fast, and each trades a durable connection for a shortcut that later costs more to hold together. The table names the shape, the fragility it introduces, and the pattern Pensieve provides in its place.
| Approach | Why the link turns fragile | The pattern in its place |
|---|---|---|
| Writing to the store | Bypasses parsing, authorisation and the audit trail | Enter through the bridge as a message the platform records |
| Parsing on the bridge | Puts sensitive logic on an exposed machine and ties it to each site | The bridge frames only; the platform parses and maps |
| Inbound openings | Exposes the hospital network to the outside | One outbound, authenticated connection; listeners stay local |
| Fire-and-forget delivery | A dropped link loses the message | A durable outbox with replay and de-duplication |
| Dual master data | Two copies drift apart unchecked | One system of record per data type |
| Point-to-point wiring | Many brittle links with scattered mappings | Every connection terminates at the bridge and the console |
| Hand-written mapping | Unreviewable logic that drifts over time | A typed, configured mapping validated by the platform |
Writing to the store
The anti-pattern
An outside system is given a direct route into the platform's data and writes records straight in. It arises when a team wants a datum to appear without building an interface.
Every external datum enters Pensieve as a message across the bridge. The platform parses it, maps its codes, makes one authorisation decision, records it, and writes the audit entry in the same step, so an inbound write carries the same controls as any other. A record written around those controls would lack the origin, the authorisation and the audit entry that make it trustworthy.
Parsing on the bridge
The anti-pattern
Clinical parsing and terminology mapping are placed on the on-site bridge, so the machine on the hospital network holds the platform's mapping logic. It arises when a team wants the bridge to hand the platform a finished record.
The bridge frames messages and forwards them opaquely, while parsing, validation and terminology mapping run inside the platform. Keeping interpretation off the on-site box means a machine on an exposed network holds neither the mapping vocabulary nor a decision, and one mapping serves every site rather than a copy per box.
Inbound openings
The anti-pattern
A firewall hole is opened so an outside system, or Pensieve, can reach into the hospital network. It arises when an integration is drawn as a two-way dial between peers.
The bridge opens one connection outward, and every hospital system reaches it on the local network. A single authenticated outbound path keeps the hospital firewall closed to the outside while still carrying every interface, so the estate gains an integration without gaining an exposed port.
Fire-and-forget delivery
The anti-pattern
A message is sent once and forgotten, with no local hold. It arises from treating a hospital link like a reliable pipe, and a dropped link then loses whatever was in flight.
The bridge writes each message to a durable local store before acknowledging the sender, replays what is outstanding on reconnect, and relies on Pensieve to recognise a repeat by its identifier. Delivery is at least once and recording is effectively once, so a dropped link delays a message rather than dropping it. The message failure and replay page follows this in full.
Dual master data
The anti-pattern
Two systems each treat the same data type as authoritative and sync both ways. It arises when neither owner is willing to defer, and the copies then drift apart with edits made on both sides.
Each data type resolves to one system of record; the other holds a following copy, and a write to that copy travels back to the owner. One authoritative copy keeps a single truth that the other follows. The system of record page sets out the assignment for each data type.
Point-to-point wiring
The anti-pattern
Each pair of systems is wired directly, each with its own mapping and its own monitoring. It arises as connections are added one at a time, and the estate becomes many brittle links with scattered configuration.
Every connection terminates at the bridge and is configured, mapped and monitored in Westron. One place holds the connections, so a change, a mapping and the outstanding queue are visible together rather than spread across pairs.
Hand-written mapping
The anti-pattern
A mapping is expressed as custom code or an embedded script, run per message. It arises when a format looks too particular for a configured rule, and the logic then resists review and drifts as it is edited.
Mappings are a closed, typed set of transforms configured in the console and validated by the platform. A code that lacks a mapping is set aside in a resolution queue for a person, so an unfamiliar code is surfaced for a decision rather than handled by unreviewed logic.
A durable integration
Read how Pensieve runs alongside an existing system in coexisting with an existing system.