Security of the write, not security of the chat

Most “AI security” is about prompts and models. This page is about the moment a finding becomes a fact other clinicians will trust. We are not an AI security company. We research that moment.

What can go wrong at the write.

None of these threats has had adversarial security testing.

T1 Unsupported write with permission
Tested
A scribe role may call update_note. The model emits “left TM perforated” with no exam. Permission was sufficient. Evidence was not.
Construction refused — Tested. Permission-only stacks still allow it.
T2 Injection after review
Not defended
Text in a transcript or attachment is quoted as evidence. The engine checks that evidence exists, not that it supports the value.
T3 Approve-then-swap
Proposed
Clinician approves wording A. Agent commits wording B.
Designed control: payload_hash. Kernel does not currently bind approval to bytes.
T4 Silent drop of refusal
Tested
Construction fails and the UI hides it. The clinician never learns the model tried to write a perforation.
Refusal can be surfaced. Still a product risk if a caller swallows it.
T5 No replay
Open
After the fact, nobody can reconstruct which payload was decided.
No durable audit module. In-memory draft versioning is not a log.

Controls, mapped to clinic.

Typed claim
The chart does not receive a paragraph of model prose. It receives concept + value.
Tested
Evidence required to construct
No source → no finding object.
Tested
Refusal stays visible
The clinician sees the attempt. Nothing is quietly omitted.
Presentation path.
Tested
Hash-bound approval
The person approved these bytes. Mutation → APPROVAL_HASH_MISMATCH.
Proposed
Append-only decision log
A later reviewer can replay what was decided.
Open
Policy version on the object
You can see which vocabulary ran.
Registry built. Clinical content unverified.
Built

Named gaps.

Approver identity is a string. Nothing authenticates the caller.
Not defended
payload_hash binding is specified, not enforced.
Proposed
Attachment is not support. A quote can be wrong.
Not defended
No persistence layer. Durability is not a property this kernel provides.
Open
No standalone gateway service. Callers can bypass the gate.
Open
No adversarial testing. Happy-path tests are not a red team.
Not defended
ENT schema not clinician-verified.
Open

Designed for clinical systems of record; not certified for production use.