Concept explainer
How a permission is decided
Explains how the platform decides whether an action is allowed by reading the relationships between a person and a patient.
Every protected action in Pensieve passes one decision. The platform decides whether an action is allowed by reading the relationships between the person acting and the patient in front of them, and returns a single answer before the action proceeds.
Two inputs, one decision
Access rests on two things together. A person's role sets what they may do. Their relationship to the patient decides which records those actions reach.
Cirith Manager holds this decision for the whole platform, so each tool asks it rather than inventing access rules of its own.
Deciding from role and relationship together keeps access tied to a current reason to open a record. A role widens what a person may do across the hospital. The relationship narrows that to the patient the person is caring for now.
The two-plane model
The decision reads two planes. The first is the patient's consent, which lives on the central record and follows the patient across every site. The second is the site permissions a member of staff holds, which stay within a single site.
An admission joins the two planes. A patient's visit at a site is the gate that turns consent into real access and is the precondition for a member of staff to read the clinical record there.
What the decision confirms
Access to the clinical record is the intersection of a set of factors. Each factor is a condition the decision confirms, and access holds when they hold together.
| Factor | What it confirms |
|---|---|
| Consent | The patient's consent allows this site. |
| Admission | An active visit gates the record at this site. |
| Role and team | The person's role and care team reach this record. |
| Clearance | The person holds clearance for any sensitive category on the record. |
| Cross-site sharing | The patient's sharing includes this site. |
Reading these as an intersection, rather than one combined flag, keeps each factor legible to a reviewer. A change to any one of them is visible as a change to that factor alone.
Admission opens the record
A person at a site the patient is admitted to reaches the clinical record. A person at a site with no active visit sees basic identification only: the patient's name, their public identifier, and coarse demographics, enough to admit them.
Absence of an explicit denial reads as consent to allow, and access materialises once an active admission holds at that site. When a visit completes, the admission holds through a defined grace period and then ends on its own, so access closes without a manual step.
The three outcomes
The decision returns one of three answers. An action is allowed, refused, or held for a missing detail that the caller supplies before proceeding.
A fault is visible, not a silent refusal
When the platform reaches a fault while deciding, it returns that fault to the caller rather than a silent refusal. A refusal always means a genuine denial of access, so an outage reads as an outage and holds its own shape in the log.
Access is refused by default. Absence of a granting relationship leaves the action closed, so a new capability arrives only when a relationship grants it.
The patient lens
One decision covers each action, and it carries into the reads that follow it. A patient lens rides on the record read path, so a query a person holds a right to make returns their records and a query beyond that right returns an empty result at the boundary.
Carrying the one decision forward keeps a single answer in force for the whole action, so the interface a person sees stays a projection of what they are permitted to do.
Common questions
Does a senior role open every record?
A senior role widens what a person may do across the hospital. Which records those actions reach still follows the person's current relationship to each patient.
What does someone see at a site with no prior visit?
Basic identification only: the patient's name, their public identifier, and coarse demographics. Clinical data reaches a site once an active admission holds there.
What happens when the decision service is unavailable?
The action returns a fault the caller sees, rather than a silent refusal. A refusal is reserved for a genuine denial of access.
Read how roles and relationships combine to grant access.