Offerings
Roles are written for your hospital.
Pensieve ships no list of roles. Every role a hospital runs on is built against that hospital’s own structure while the platform is being deployed, and the authorization system decides each action against it afterwards.
There is no role catalogue.
Hospital software usually arrives with a fixed set of roles, and the hospital bends its staffing to fit them. The person who does three jobs gets three logins. The nurse covering a ward for one night is given standing access to it. The role called administrator ends up holding whatever nobody could classify.
A role in Pensieve is a written statement of which actions a person may take, on which records, through which relationship to the patient, at which site, and on which shift. It is authored for one hospital and it exists only there.
A forward deployed engineer writes them
Roles are part of the deployment. The engineer who builds them is inside your hospital while the survey is running, and they are drawn from the wards, teams, services and rosters you already run. The exercise is a description of your hospital rather than a configuration of our software.
How a role is made
Structure first, then the role, then every action.
Permission is a relationship.
Pensieve uses relationship-based access control, in the Zanzibar lineage. A decision is a question about a relationship: is this clinician on the team currently treating this patient, at the site the record belongs to, on a shift that is running now, for a purpose the patient has agreed to. The answer is computed at the moment of the action.
A permission list attached to a job title cannot answer that question. It knows what a nurse may do. It has no way of knowing which patients this nurse is responsible for tonight.
Two gates open a record
Consent and admission are read together. Consent is a modelled object rather than a signed sheet in a folder, and the admission is what scopes it to an episode of care. Both have to hold before a record opens, and withdrawing either closes it.
The lens sits at the read path
Authorization is applied to the data itself at the database read path, so a user is unable to query records they are not entitled to. A screen a person should never see is a screen with nothing in it to render.
Cirith decides, and Cirith answers.
Cirith is the authorization system inside Pensieve. Every read and every write in the platform is checked by it, and no tool carries an access model of its own. Because there is one plane rather than one per tool, the questions an administrator is actually asked have answers.
Who can see this patient
An administrator opens a patient record and lists everyone who currently has access to it.
What this person can reach
The same question in reverse. One staff member, and everything they can open, in one place rather than across a dozen screens.
What a change would do
A permission change is simulated before it is applied, against the hospital as it stands. Nobody has to make it at midnight and reverse it by morning.
The emergency path
Urgent care has an access path that opens a record immediately. It is fully logged: who opened it, when, and under what declaration.
The access log
Every access is recorded. The log is the standing evidence an accreditation assessor asks for, written as the work happens.
Nexus holds the digital twin of the hospital.
A role is only as precise as the structure it is written against. Nexus holds that structure: the physical locations, the teams, the resources and the services; every staff member’s identity and the teams they belong to; the physical assets and what is in use right now; and the duty rosters, so the platform always knows who is on shift and where.
That model is the digital twin of the hospital. A ward, a theatre, a bed, an analyser, a department, a site: each is a modelled object rather than a string typed into a form. That is what lets a role say "this ward, this shift" and have it refer to something real.
The roles panel lives inside it
Nexus hosts the Cirith Manager panel, where roles and the permission rules under them are managed. Structure and authority sit in the same place, so a new ward, a renamed unit or a changed roster reaches the access decision at once.
What people ask
At the bedside
- A patient arrives at two in the morning under a consultant who is off shift, and the record belongs to a ward nobody on duty is attached to.Cirith carries an emergency access path that opens the record at once, and writes the person, the time and the declared reason into the access log.
- A nurse covering another ward for one night is either given standing access to it, or spends the night asking somebody else to open records.Nexus holds the duty roster, so access follows the shift and lapses when the shift ends.
At the desk that signs
- Somebody asks who read a patient file, and answering it means a query nobody can run across six systems that never agreed on the patient.Cirith lists everyone who currently has access to a given record, and the access log says who opened it and when.Atlas
- Consent is a signed sheet in a folder, and no software reads it before a record opens.Cirith treats patient consent and hospital admission together as the gate that unlocks a record.Atlas
When something has to change
- A permission change on a running hospital is a change nobody can rehearse, so it is made at night and reversed by morning.Cirith simulates the change against the hospital as it stands, and shows what it would allow and refuse before anything is applied.
- A staff member leaves and the login outlives them, because withdrawing it means finding it in every system separately.Nexus holds identity and team membership once, and Cirith reads that one place on every action.
Where everyone does three jobs
- In a forty bed hospital one person runs the front office, the pharmacy counter and the insurance desk, and a fixed role list has no row for that person.The role is written for the hospital, so it carries the actions their day actually contains.
- An assessor asks for evidence that access is controlled, and the quality cell assembles screenshots in the week before the visit.The access log is a standing record written as the work happens, so the evidence exists before anyone asks for it.Vigil
After go-live, the hospital owns it.
The roles built during deployment belong to the hospital. They are edited from the Cirith Manager panel inside Nexus, by whoever the hospital says may edit them, and every edit can be simulated first.
Structure moves. Wards open, services are added, a second site joins the group. A change to the twin is read by the access decision immediately, which is why the model has to be the hospital’s own rather than a snapshot taken at go-live.
The engineering relationship continues
The same team that wrote the roles stays with the hospital past go-live, because the hospital that runs in year two is a different shape from the one that was surveyed.
What a security review will want
The authorization model, the audit guarantees and the residency position are published as governed documents with a version, a date and a checksum on each.
See it against your own wards.
The fastest way to judge this is to name the three roles your hospital argues about most, and watch them decided on work shaped like yours.