Trust & Security
AI should not decide what data a user is allowed to see. Authorization should.
The ClearPlan Assistant retrieves records only after the authorization layer resolves what the signed-in person is permitted to access. Same assistant, same data, same prompt — the only variable is enforcement.
Authorization service
Checking…No tenant credentials detected — decisions use the local relationship simulation.
How access is granted in the deployed model
A patient record is readable by a viewer of that patient, and a viewer is one of three things: the patient themselves (patient_user), an authorized guardian (guardian), or a member of that patient's care team (member from care_team).
Practitioner access therefore runs through a care team object rather than a direct practitioner relationship — Dr. Lee is a member of care_team:sarah-care, which is Sarah's care team. Same outcome, but care team membership is what real clinical systems assign and revoke. Insurance plan membership is modelled too, and deliberately grants nothing: sharing a family plan is not a path to another person's health records.
Guided Demo
Walk through the narrative step by step, or explore manually.
Authorization Graph
Relationships that govern record access
Retrieval / Authorization Trace
Run a query to see the authorization trace.