How to read this page
- Every step is one screen, or one moment, in a real run. The label under the title names where it happens, and the step reads in the same order each time: what is happening, the evidence, and then what to look for in it.
- Screenshots are real pictures of the Munitas console, the web app that people open in a browser. Click any picture to enlarge it.
- Every name of a person, patient or card holder in the example data is invented, and every screenshot is unedited apart from being cropped to the part that matters.
Words used on this page
- Organisation
- A company or hospital group that uses Munitas. Each organisation sees only its own data.
- Department
- A team inside an organisation that owns some of its data, such as Cardiology.
- Dataset
- A named collection of records, such as a table of patient admissions.
- Custodian
- A person who holds the data custodian role, which allows deciding who may read data. A custodian decides for the departments they are an approver for.
- Department approver
- A custodian who is listed for one department and may approve access to its data and confirm claims about it. A department can have several, and any one of them can act on their own.
- Role
- A named set of permissions that a person can hold, such as the permission to decide who may read a department’s data.
- Platform administrator
- The person who runs Munitas itself. The role gives no say over who may read any department’s data.
- Lease
- Permission, given by the custodian, to read one dataset for one stated purpose and for a limited time.
- Access level
- How restricted a dataset is. Raw is the most restricted, and nobody may read it without permission. Published is the most open.
- Version
- One sealed state of a dataset. Changing the contents means making a new version, never editing an old one.
- Locked column
- A column whose values are scrambled under a key made for each person. Reading them back needs permission. Destroying a person’s key later makes their values unreadable for good, while the sealed table itself never changes.
Who is who in the Health organisation
Thirteen fictitious people are registered in the Health organisation. Each holds a role, which is a named set of permissions, and a data custodian is an approver for one department. Step 3 shows the screen that this table comes from.
| Person | Role | What the role is for | Approves access for |
|---|---|---|---|
| Priya | Platform administrator, Support and reliability | Runs Munitas itself and looks after the organisation's setup, with no say over who may read a department's data. | No department |
| Ravi | Platform administrator, Support and reliability | Runs Munitas itself and looks after the organisation's setup, with no say over who may read a department's data. | No department |
| Hartley | Data custodian | Decides who may read the data of one department, and can approve access to that department's data only. | Cardiology |
| Mensah | Data custodian | Decides who may read the data of one department, and can approve access to that department's data only. | Oncology |
| Lindqvist | Data custodian | Decides who may read the data of one department, and can approve access to that department's data only. | Orthopaedics |
| Okonjo | Data custodian | Decides who may read the data of one department, and can approve access to that department's data only. | Radiology |
| Devi | Data engineer | Brings data in, and registers pipelines and agents. | No department |
| Sam | Researcher | Asks to read data, and works with data that has already been de-identified. | No department |
| Imani | De-identification reviewer | Decides whether a result with the names removed may be released. | No department |
| Marlow | Privacy auditor | Checks how locked data was used, and reads records of use but no personal data. | No department |
| Nakamura | Data protection officer | Watches how the organisation handles personal data, and decides nothing about who may read it. | No department |
| Okafor | AI risk owner | Answers for how the organisation holds its AI agents: writes the risk levels and the approved tools list, confirms each agent's level, and gives the second approval. | No department |
| Turner | Network architect | Decides which external hosts an AI agent may call. | No department |
Who owns what, and who may do what
Priya is the platform administrator at a hospital group that uses Munitas. The platform administrator keeps Munitas itself running and looks after the organisation's setup, but has no say over who may read a department's data. That belongs to the departments that own the data and to their approvers.
Priya types an email address and a password. Munitas never takes a typed name as proof of who somebody is. Everyone signs in for real, and what the console shows afterwards depends on who signed in and which organisation they belong to.
A department is the part of an organisation that owns a set of datasets, and a dataset is a named collection of data that Munitas keeps. Each card is one department of the Health organisation, with the number of datasets it owns and its approvers. The approvers are data custodians, people who hold the role that lets them decide who may read the department's data. Permanent means the entry has no end date. Only an approver of a department can change that department's list, so even Priya, who runs the platform, cannot add anybody to it.
In the console, the menu entry People and roles opens the screen that the table at the top of this page comes from. The last column of the screen says which department a data custodian may approve for.
This page is the same in every organisation. It lists each role a person can hold, the most sensitive data that role may read without asking, and whether the role may approve access beyond that. An access level says how restricted data is, and Published is the most open. Anything more sensitive needs a lease, which is permission to read one version of one dataset for one stated purpose and for a limited time. Somebody else has to approve it.
When somebody asks for access, they say what they want, why, and for how long. This page shows the limits the organisation has set on how much a person may ask for. A locked column holds values that identify a person, and a locked file is a file that stays unreadable until somebody is allowed to open it. For each limit the page shows the value in force now, the default, and the highest value the platform allows. An approver still decides every request.
