Capability
Who may see what, and who did what.
Authorization is checked on every read and every write by one plane the whole platform routes through, and every action it decides is audited in the same transaction as the change.
One authorization plane.
Cirith decides, for every single action in the platform, whether the person asking is allowed to take it.
Eliminate the access model that is implemented once per tool and reconciled by policy afterwards. Cirith is a single plane, every read and every write passes it, and no tool inside Pensieve implements access control on the side, so there is no seam between two tools for a permission to leak through.
The interface follows the decision rather than the other way round. Entitlement is computed before a screen is drawn, which is why a user is not offered an action the platform would then refuse, and why removing a permission removes the button rather than adding a warning.
The plane is relationship-based. Access follows the relationship between a person and a patient, so a role is a shorthand for a set of those relationships rather than a bag of checkboxes maintained by hand.
The decision
Four facts, one gate, one entry in the log
Mechanism
How the decision is made
Three properties of the check, each of which is a thing the platform does rather than a thing it promises.
- The lens sits at the database read pathThe patient lens applies the same authorization to the data rather than to the screen. Records outside a user’s entitlement are never returned and never filtered out afterwards, because they never leave the store. It is the strongest of the controls precisely because nothing in the application layer can undo it.
- Consent and admission are read togetherNeither alone opens a record. Consent alone leaves a patient unreadable to a hospital that is not treating them, and an admission never overrides a withdrawal. The gate takes both, on every access.
- Access is scoped to purposeAn access happens for a reason, and the reason is part of the decision rather than a note beside it. Purpose limitation under India’s DPDPA and minimum-necessary access under HIPAA both ask a system to guarantee that structurally.
Consent, on two planes.
The first plane is ownership
A medical record describes a person. Consent to use it is held against that person as a modelled data object rather than as a signature filed at the front desk, and withdrawal is a first-class action on that same object. Both the grant and the withdrawal are audited, so the scope an access ran under is provable afterwards rather than asserted.
The second plane is basis
A hospital never holds standing access to a person because it treated them once. An admission opens a scoped path for the care team, and that path closes when the basis for it ends. Gate records the visit, so the basis half of every access decision is produced by the work the hospital was doing anyway.
The check reads both, every time
Purpose limitation and withdrawal are properties of the check rather than of staff memory, because the check is where they are evaluated. There is no nightly job that reconciles consent with access, and no list of people to notify when a patient changes their mind.
The manager panel
What an administrator can actually do
The panel is hosted inside Nexus, where roles and permission rules are defined against the same modelled structure they apply to: the sites, the units, the teams and the rosters.
- See who can see this patientOpen a patient and read who currently holds access to that record, with the basis each of them holds it on. The question is asked of the record rather than reconstructed from a roster and a permission matrix.
- Look up one personOpen a staff member and read everything they can reach, across every tool, as one list. A leaver, a transfer or a complaint is answered in one place rather than in fourteen permission screens that were never guaranteed to agree.
- Simulate the change before making itModel a permission change and see what it would grant and what it would revoke, before it applies. A change to a role is a change to what a ward can do at three in the morning, so it is rehearsed rather than discovered.
- Grant emergency access, on the recordAn urgent case that falls outside the normal basis takes a break-glass path. It is deliberate, it exists because the alternative is a shared login, and every use of it is logged as exactly what it was.
- Read the complete access logEvery access, by whom, to what, and when. It is written by the system rather than assembled from it, which is the only condition under which the answer to a question asked months later is worth having.
The audit is part of the write.
Move past the access log that is compiled from application logs after an incident. Every action in Pensieve is audited inside the same database transaction as the change it describes, and the archive it lands in cannot be rewritten.
Why the same transaction is the whole point
A log written beside a change has states available to it that a log written with the change does not: a failed write that logged anyway, a successful write that did not, a logging service that was down while the work was up. An access record produced by the transaction that made the change has none of them, which is what makes it admissible after the fact.
What the institution can then answer
Who read this record, on what basis, and at what time. That answer comes out of the system rather than out of an interview, which is the difference between an investigation and a reconstruction.
Why none of this drifts
A guarantee that depends on every future engineer remembering it is a policy. In Pensieve the core systems are the only path to the database, the only identity and session system, the only authorization check, the only audit trail and the only route out to an external system, and an automated check fails the build when a tool reaches around one of them.
So the property holds for code that has not been written yet, including code written for one hospital by a forward-deployed engineer and code a hospital builds itself in Durin. Anything composed on the platform inherits the same check and the same trail, because there is no second way to reach the data.