- Shipped
- 25 Agosti 2026, 14:40 UTC
- Author
- Kamo
- Commit
- b105d67
PhiAccessBasis gained CARE_TEAM and BREAK_GLASS last commit; without these two tables those values are decorative. Nothing on the platform modelled a provider-patient relationship at all — the survey found no such join anywhere — so authorization could only answer "may this person read charts", which every clinician in a practice can. The question minimum-necessary turns on is whether they may read THIS one. CareRelationship is a persisted FACT, deliberately not a RoleRightType, and each reason bites on its own. Rights are snapshotted into *** at login, so a revocation would not reach a live session — an ended relationship has to stop granting access now. A new right silently arrives GRANTED for grant-all administrator roles, which is catastrophic for something meant to be per-patient. And checkRight() returns true for everything under god mode, whereas a relationship either exists or it does not. Rows are closed with validTo, never deleted. "Was this person on the care team when they opened the chart last March" cannot be answered by today's care team, and that is exactly what an access review asks. BreakGlassGrant exists because refusing to build it is not the safe choice. A patient arrives unconscious and the treating clinician is on no care team yet; a system that says no is one people work around, and the workaround is a shared login. The control is not prevention — it is that the access is narrow, stated, time-boxed and READ AFTERWARDS. The reason is free text and required, because its value is that a human wrote it and another human reads it; a dropdown gets clicked without reading. Deliberately NOT god mode: that is platform-staff break-glass, server-owned. Routing a covered entity's clinical emergencies through Kamo's vendor backdoor is the one control a BAA reviewer will not move past. Both temporal predicates treat their end instant as EXCLUSIVE, and the tests pin the boundary in both directions — an inclusive end silently extends every ended relationship and every expired override by a tick, and neither failure raises anything. 1644 tests green.