Twelve rules the software is not allowed to break

No agent path writes to the clinical record without a licensed clinician’s sign-off. Anything that touches the record, or that involves clinical judgement, drafts into a store that is not the chart and stops there.

There is no flag, pilot mode or demo setting that turns this into an automatic write, because a setting that does is the one that will be switched on in the busiest week of the year. Sign-off is recorded against a named person and a time, and an unsigned artifact is visibly unsigned everywhere it appears.

When a draft is rejected by a clinician or fails the critic, it does not enter the record in any form. Not inactive, not filtered from a view, not superseded — absent from the assembled bundle.

This is asserted by a test named for it, because it is the single most important behaviour in the product and the one whose failure would be invisible from the outside. A safety guarantee you can only observe by trusting a screen is not a guarantee.

The intake agent collects information and, on any red-flag pattern, hands off to a human and says plainly that it has done so. It does not suggest what is wrong and it does not suggest what to do about it.

It is also not permitted to reassure. A triage surface that tells somebody it is probably nothing is more dangerous than one that says nothing at all, because the person who most needs to be wrong about that is the person most likely to believe it.

Drug–drug and allergy interaction checking, dose ranges, controlled-substance refill limits, bed assignment, charge maths and reorder arithmetic are deterministic engines. The model may call them and explain their output.

A language model that computes a dose will one day compute a fluent, confident, wrong one, and no amount of prompt discipline changes that. The engines hard-block rather than warn, and their outputs are frozen by snapshot tests — so a rule change is a reviewed decision rather than a discovery on a ward.

Authentication is scoped clinical authorisation in one jurisdiction and the national consent flow in the other. The platform validates a token issued elsewhere.

There is no second identity system inside the product, so there is no second place for a credential to be stored, rotated, forgotten or leaked. A hospital’s access review covers this system because this system did not invent its own.

Every jurisdictional concern — identity, profiles, exchange, claims, terminology, directories, prescribing, telehealth, matching, payment, compliance — is an interface with an implementation per country, resolved from the facility.

There is no country conditional in the clinical core, the pharmacy, the agent graph or the sign-off machine. A jurisdiction can never be the reason a safety gate behaves differently, because a jurisdiction never reaches one.

Clinical data is held FHIR-shaped: the canonical resource is the stored payload, and typed columns index only what the application queries.

Exchange is a projection of the record rather than a nightly rebuild into a shape nobody works in, which is why interoperability here is a read rather than a project. A standard you only serialise into on the way out is a translation layer with a deadline.

Facility and jurisdiction sit on every clinical row and are applied by a dependency every clinical request passes through. Every database query lives in one layer, so scoping has exactly one place it can be forgotten.

A cross-facility read, list or search is denied where the query is built, not in a handler somebody can forget to guard. A new endpoint inherits the scope instead of remembering it, and a query written outside that layer fails the build.

A summary cites what it summarised. Where the system has nothing, it says so — an absent allergy list and a confirmed empty one are different things and are never rendered alike.

A summary sentence with nothing behind it does not survive the critic, and an empty state that reads as a clean bill of health is treated as a defect rather than as a design choice. In this domain, a confident blank is the most expensive thing an interface can produce.

Clinical data is the working record for that facility and nothing else. It is not training data, and it does not improve anybody else’s output.

Retrieval is scoped per facility and never crosses one, a request that attempts to is denied and audited, and consent — including its withdrawal — is a record in the system rather than a policy about it.

Model inference is deployed per jurisdiction rather than routed to whichever provider is cheapest that quarter. The same applies to the video provider for a consultation.

If the data cannot leave a region, the model comes to the region. A residency commitment that depends on a vendor’s routing table is not a commitment, and in this domain it is also somebody else’s medical history.

No part of this counts as working because a test went green. It counts when it produces something a person can open.

A rejected draft provably absent from an assembled record. A cross-facility request that came back empty. An audit row naming who opened a chart at three in the morning and why. An interaction the engine blocked, with the rule it blocked on. An export a receiving system actually read. Anything less is a claim, and this page is not for claims.