Concept explainer
One door in and one door out
Explains how each request enters and leaves Pensieve through a single controlled path, and why that keeps behaviour consistent.
Every request enters and leaves Pensieve through a single controlled path. This page explains what happens at that door, how the outbound path to other hospital systems mirrors it, and why one path keeps behaviour consistent across the platform.
The single entry path
A request is any action a person or a connected system asks the platform to take, such as reading a record or placing an order. Every request enters through one path.
That single path is where the platform establishes who is asking, decides whether the action is allowed, carries a trace of the work, and shapes any error the same way. No tool reaches this work on its own terms.
Concentrating this at one door means a rule is written once and holds for every tool. The same request from the ward, the console, or a connected system meets the same checks.
What happens at the door
The door runs the same steps in the same order for every request.
- 1
Establish the caller
The platform resolves who is asking, from the caller's own identity, before the action proceeds. Each member of staff acts as themselves, so the work stays attributable.
- 2
Decide the action
One authorisation decision resolves whether this caller may take this action on this patient. The decision reads the caller's role together with their relationship to the patient in front of them.
- 3
Carry a trace
The request carries a trace from end to end, so the path of a single action stays followable across the tools it touches.
- 4
Shape the outcome
A success returns in one shape, and a failure returns in one shape, so a caller reads any outcome the same way whichever tool produced it.
The single exit path
The outbound side mirrors the inbound side. Every connection to an outside hospital system leaves through one controlled path.
A connection is a governed link between Pensieve and another system, such as a laboratory analyser or a radiology archive. Connections reach the hospital's own machines through orophin, the on-site bridge the hospital installs on its own network.
orophin opens one outbound, mutually authenticated link to the platform and carries many connections through it. Staff configure and monitor those connections in Westron, the console that mirrors the bridge.
One outbound path
Holding every outside exchange to one path keeps the boundary between the platform and the hospital's machines in one place, where its behaviour under fault is defined and observed.
Why one path
One path is what keeps behaviour consistent. Access, tracing and the error shape are properties of the door, so they hold for every tool by construction rather than by each tool remembering to apply them.
The result is a platform that behaves the same way from every direction. Read how those boundaries are held in code in enforced architecture, or follow the access decision itself in the authorisation model.