How to read this page
- Every step is one screen, or one moment, in a real run. The label under the title names where it happens, and the step reads in the same order each time: what is happening, the evidence, and then what to look for in it.
- Screenshots are real pictures of the Munitas console, the web app that people open in a browser. Click any picture to enlarge it.
- Every name of a person, patient or card holder in the example data is invented, and every screenshot is unedited apart from being cropped to the part that matters.
Words used on this page
- Organisation
- A company or hospital group that uses Munitas. Each organisation sees only its own data.
- Data protection officer
- A person who watches how an organisation handles personal data. The role decides nothing about who may read it.
- Access level
- How restricted a dataset is. Raw is the most restricted, and nobody may read it without permission. Published is the most open.
- Lease
- Permission, given by the custodian, to read one dataset for one stated purpose and for a limited time.
- Dataset
- A named collection of records, such as a table of patient admissions.
- Custodian
- A person who holds the data custodian role, which allows deciding who may read data. A custodian decides for the departments they are an approver for.
- Department
- A team inside an organisation that owns some of its data, such as Cardiology.
- Platform administrator
- The person who runs Munitas itself. The role gives no say over who may read any department’s data.
- Version
- One sealed state of a dataset. Changing the contents means making a new version, never editing an old one.
- Agent
- A program registered on Munitas, with a named owner, that Munitas runs on somebody’s behalf instead of a person reading data directly.
- Pipeline
- A series of steps that Munitas runs on a dataset version, each step after the ones it depends on. The last step is a gate decision.
- Filter
- Keeping only the rows of a table that match values the custodian names, such as one patient’s id, so that other people’s rows do not leave with them.
- Locked column
- A column whose values are scrambled under a key made for each person. Reading them back needs permission. Destroying a person’s key later makes their values unreadable for good, while the sealed table itself never changes.
- Privacy auditor
- A person who checks how locked data was used. The role reads records of use and no personal data.
The record of every access decision
Every time somebody asks to read data, whether a person or a program, the platform decides and writes the decision down: who asked, what for, how restricted the data is, and the reason. The record keeps the refusals as well as the grants. A data protection officer is a person who watches how an organisation handles personal data. The role reads the record and decides nothing.
Nakamura is the data protection officer of the Health organisation. The home page of this role is about oversight and nothing else: it counts what has been asked, how much of it was refused, and shows the most recent refusals with the reason given for each. The access level of a dataset says how restricted it is, and Raw is the most restricted level. A lease is permission from the owning department to read one dataset for one stated purpose and for a limited time, and it ends by itself.
Nakamura follows the link to see every decision. Each request is recorded twice: once for whether the rules allowed it, and once for whether the access was actually given, and the two can differ. The columns say when, who asked and in what role, what was checked, the access level of the data, what it was for, the result and the reason. Only a data custodian, the data protection officer or a platform administrator may open this page: any other role is told that it is not for them, and the platform refuses it the data as well. The newest rows are not requests to read a dataset. They are Nakamura's own reads of the Locked data audit, and the privacy auditor Marlow's, because looking at the record is itself recorded, so the people who watch are watched in the same way.
Nakamura chooses Refused, and every row that remains is a request that was turned down. Each one keeps its date and time, the person who asked and the role they held, the access level they reached for, what they said it was for, and the reasons in plain sentences. A reason can be that no role reaches the Raw level, or that a lease which once covered the request has since been revoked, which means that it was ended early. A program is held to the same record: the oldest row on this page is a pipeline action that was refused, with the reason that it did not present the credential of the task it was acting for. A link on each row opens the dataset version that was asked for.
