PensieveAI
The record decides what an agent may do.
Pensieve holds one governed record in Atlas. An agent built on it reads through the patient lens, acts only through governed tools, and is auditable and reversible, because each of its actions is one governed action.
The subject
Pensieve holds the record. The agent acts on it.
The record leads.
Atlas holds one governed record for the hospital, and every sentence on this page is about that record. Any model is only an object on it, given a narrow job and no standing of its own.
Scribe ships today.
Scribe assists a person filling a form inside Glyph, drafting from the record open in front of them. It is a bounded object on the record, and it is the only model capability we run today.
The order is argued next door.
Why the record is built before any model runs on it is a separate argument. Read it, then come back here for what you can build.
The inheritance
Every agent inherits the hospital’s authorization model by construction.
Cirith authorizes every read and every write, and it runs the same check for a person and for an agent. An agent built here reads through the patient lens, so it sees only what the acting clinician could already see.
An agent acts only through governed tools, a Glyph form or a Durin workflow, never the raw record. Each thing it does is one governed action: it lands in the audit trail, and it is undone the way a clinician’s action is undone.
The agent inherits the authorization model because it runs on the same foundation a clinician uses, so its powers are the acting user’s powers and no more.
The path
How an agent action travels.
It reads through the patient lens.
Atlas returns only the records the acting clinician is entitled to. The agent starts from that clinician’s view of the patient, and no wider one.
Cirith authorizes the read and the proposed write.
The same check that runs when a person opens a chart runs here, before the agent touches anything.
It acts through a governed tool.
The agent drafts into a Glyph form or runs a Durin automation. That tool is the only surface it has on the record.
A clinician is the author.
Nothing reaches the record until a person signs. The signature carries their name, and they are accountable for what carries it.
The signed action is written to the audit trail.
The authorization and the change land together in one write, the same write a clinician’s own action produces.
It reverses like any other action.
An error is corrected the same way a signed clinician action is corrected, because the agent worked through the same governed tools.
Staging is the default. The loop closes on its own only for a well-worn task a hospital has explicitly promoted, and the hospital can move that task back under review at any time.
The build surface
What you build on.
Every agent and automation a hospital builds stands on these surfaces and the audit trail, and on nothing outside them.
- AtlasHolds the one governed record. Every read an agent makes resolves here, through the patient lens.
- CirithAuthorizes every read and every write. The check is identical for a person and for an agent.
- GlyphThe form builder a hospital designs its own forms in. An agent fills a form through Glyph, never around it.
- ScribeAssisted fill inside Glyph, and the one model capability now in production. It drafts; a person signs.
- DurinThe no-code builder for automations on the record. A hospital wires its own workflows without writing code.
- NexusThe hospital’s digital twin. An automation reasons over the twin, over the governed record itself and not a copy.
- The audit trailWhere every action lands, a person’s and an agent’s alike, written together with the change it records.
The check
A person and an agent meet the same gate.
The limits are built in.
Each limit below is owner-locked, and each is enforced by a named mechanism, not a policy document a hospital has to trust.
| The limit | What enforces it |
|---|---|
| An agent drafts. A clinician decides. | No capability makes, supports, or influences a clinical decision. A person signs, and the record moves only on that signature. |
| Scoring stays with the clinician. | No capability computes a risk, deterioration, or acuity score from a patient’s observations, and none can be switched on. |
| Every output carries its provenance. | Every output shows that a machine produced it, and traces to the records it read and to the capability and version that produced it. |
| Nothing in a hospital’s record trains a model. | The record is never read into a model, an evaluation set, or a benchmark. No one here may ask a hospital to relax that in a negotiation. |
| A model capability is named before it runs. | Each is listed in a dated public inventory and stays off until the hospital switches it on. Anything running that the inventory does not name is a defect, and it is ours. |
| A human is accountable, and authors what they sign. | The signature carries a person’s name. Each item is approved one at a time, with no bulk accept or auto-approve. |
| Each agent action is authorized and recorded. | Cirith authorizes it, and the audit trail records it within the write that changes the record, exactly as for a clinician’s action. |
| An agent acts only through the same tools a person would. | A Glyph form or a Durin workflow, under the acting user’s permissions. There is no privileged path for automation. |
Each limit is written into a document a hospital can open today, and each holds without exception.
Worked example
An agent inside Glyph.
A hospital builds an automation in Durin. When a form comes due, the automation opens it in Glyph, and Scribe drafts the fill from the patient’s record in Atlas.
Cirith authorizes each read against the acting clinician’s permissions, so the draft contains only records that clinician was already cleared to see. The clinician reviews the draft, edits it, and signs before anything reaches the record.
The signed action reaches the audit trail as the change is written. A wrong entry is reversed on the same terms as any signed action. From draft to signature, the whole path is a single governed action, recorded once.
Build on the record.
Build governed agents and automations on Pensieve. The surface is Durin and Glyph, bounded by Cirith and Atlas, recorded in the audit trail. We will show you the authorization behind a read and the audit entry that read wrote, on a real record.