Concept explainer

Enforced architecture

Explains how Pensieve holds its own boundaries in code, so a system reaches another only through the paths the platform allows.

Pensieve holds its own boundaries in code, so a system reaches another only along the paths the platform allows. This page explains what those boundaries are, how they hold as the platform is built, and why the platform enforces them mechanically rather than by convention.

Boundaries in code

A boundary is a rule about which system may reach which, and along what path. Each system carries one responsibility, and the platform fixes the paths between systems rather than leaving them to habit.

Fixing the paths in code is what keeps the shape stable as the platform grows. A path the platform reserves stays reserved, whichever team adds the next system.

What the boundaries hold

The boundaries route every system through the shared foundation rather than into one another.

Boundary	What it holds
Reaching the record	A system reads and writes the patient record through the record's own path rather than a private copy.
Deciding access	A system resolves access through one authorisation decision rather than rules of its own.
Reaching outside	A system reaches an outside hospital system through one outbound path rather than opening its own.
Reacting to change	A system reacts to another through the event log rather than a direct call.
Recording a change	A committed change carries its audit entry, written in the same transaction.

Figure 1.Diagram showing admissions, orders and billing reaching the patient record through shared platform paths rather than one another.

How a boundary holds

A boundary holds by construction. An automated check runs across the whole platform and refuses a build that crosses a boundary the platform reserves.

Because the check runs on every build, the boundary is a property of the built platform rather than a note in a review. A path that a system reaches by an allowed route passes; a path that reaches around the foundation stops the build until it is corrected.

A guarantee that holds by construction

A reviewer reads the same boundary on any day, because the platform refuses to build in a shape that crosses it. The guarantee holds as the platform grows rather than eroding with each addition.

Each system reaches the record through the record's own path.

Each system resolves access through one decision.

Each system reaches outside through one outbound path.

Each committed change carries its audit entry.

Why enforce it

Enforcing the boundaries mechanically keeps the platform consistent from every direction. A rule lives in one place, so a change to it reaches every system at once, and the interface a person sees stays a faithful projection of the same decision.

The event log is one of these reserved paths. Read how systems react to one another through it in events.