Boundaries
Boundaries and gates
A single page for the question that matters most: what may this system be used for, and what may it never be claimed to do?
#What this is
A private, independently designed, multi-tenant synthetic prescribing sandbox, and the developer platform being built around it. The implemented milestone creates one synthetic, non-controlled prescription draft, validates it mechanically, and renders an immutable read-only review behind a one-time grant.
#What this is not
It cannot approve, sign, route, transmit, cancel, or renew a prescription. It has no pharmacy or prescription-network connection. It does not support controlled substances. It accepts synthetic fixtures only, and it makes no certification, compliance, licensure, clinical-safety, or production-readiness claim.
Local success is never evidence of live-prescribing eligibility. Every test passing and every simulator scenario succeeding says nothing about whether this system may lawfully be used to prescribe.
#Capability boundary
| Present and exercised | Deliberately absent or gated |
|---|---|
| Synthetic standard draft creation | Real patient, clinician, medication, or pharmacy data |
| Read-only review of one immutable version | Edit, approve, attest, sign, submit, cancel, or renew |
| Local fixed-token authentication fixture | Production OIDC, MFA, identity proofing, reauthorization |
| Mechanical sandbox checks | Licensed terminology or clinical decision support |
| Database-local outbox relay record | Broker, webhook, prescription network, pharmacy transport |
| Application tenant predicates and composite tenant keys | Row-level security and separately privileged database roles |
| Source-controlled OpenAPI and event schemas | Certification, regulatory approval, production operations |
#Data boundary
Only synthetic people, practices, identifiers, destinations, medications, and credentials may enter this system. A change that introduces real or plausibly real clinical data is treated as a blocker, not a fixture improvement.
Database check constraints and startup validation enforce synthetic markers — the application refuses to start if it finds an unflagged row. Pattern detection is documented as an aid, never as a complete privacy control.
#Engineering gates
Five items must land before any live data or connectivity, independent of any external authority:
| Gate | What it requires |
|---|---|
| Database privilege separation | A non-login schema owner, a one-shot migrator whose credentials never reach the runtime, and a restricted runtime role. |
| Complete aggregate seal | A canonical digest over every clinical and evidentiary field, bound into grants, sessions, and events, with external anchoring. |
| Key governance | A versioned keyring, retained-key validation, and a rehearsed rotation, rollback, and destruction procedure. |
| Atomic revocation | Authorization-version binding so a committed revocation deterministically defeats every in-flight operation. |
| Runtime transition API | Narrow database-authoritative functions so the runtime cannot fabricate state or evidence. |
#External gates
These cannot be closed by writing software. Each requires a decision, contract, licence, or certification from an outside party:
- Prescription-network authorization — a participation agreement, certification testing, and ongoing compliance obligations.
- Licensed clinical content — a drug database and clinical-rules licence permitting the intended use.
- Standards licensing — lawful access to the exact standard versions required.
- Identity assurance — real identity proofing and multi-factor authentication for prescribers.
- Controlled substances — a separate legal, identity, signing, audit, and certification regime that is currently disabled entirely.
- Regulatory and privacy review — jurisdictional obligations confirmed by qualified counsel.
- Operational readiness — retention, legal hold, backup, restore, disaster recovery, and incident response.
#Independent design
The contracts, code, presentation, fixtures, and examples were independently authored under checked independent-design, restricted-source, and provenance controls. That is a documented engineering process — not legal advice, trademark clearance, or a final intellectual-property opinion.
Third-party integration reference material is observation-only: usable to identify that a general problem category exists, never as a specification. Copying or closely translating a vendor's routes, field names, status identifiers, URLs, layouts, branding, schema, authentication transport, constants, prose, or undocumented behaviour is prohibited, and each observed category carries a recorded independent-transformation entry.
#Rights
FAST SCRIPTS is a private development repository. No open-source licence or permission to use, copy, modify, or distribute the software is granted. Production use remains blocked on the clinical, legal, privacy, security, terminology, network, certification, and operational gates recorded above.