How to read this page
- Every step is one screen, or one moment, in a real run. The label under the title names where it happens, and the step reads in the same order each time: what is happening, the evidence, and then what to look for in it.
- Screenshots are real pictures of the Munitas console, the web app that people open in a browser. Click any picture to enlarge it.
- Every name of a person, patient or card holder in the example data is invented, and every screenshot is unedited apart from being cropped to the part that matters.
Words used on this page
- Organisation
- A company or hospital group that uses Munitas. Each organisation sees only its own data.
- Department
- A team inside an organisation that owns some of its data, such as Cardiology.
- Dataset
- A named collection of records, such as a table of patient admissions.
- Custodian
- A person who holds the data custodian role, which allows deciding who may read data. A custodian decides for the departments they are an approver for.
- Department approver
- A custodian who is listed for one department and may approve access to its data and confirm claims about it. A department can have several, and any one of them can act on their own.
- Sealed
- Finished and closed for good, so that it can never be edited.
- Version
- One sealed state of a dataset. Changing the contents means making a new version, never editing an old one.
- Pipeline
- A series of steps that Munitas runs on a dataset version, each step after the ones it depends on. The last step is a gate decision.
- Run
- One execution of an agent or a pipeline, started for a stated purpose.
- Custom step
- A step of a pipeline whose script was written by the person who registered the pipeline, instead of one of the steps Munitas provides. It runs in a closed container with no internet, no key and no storage address, and can only ask the platform for the recordings it is allowed to read and send back the files it makes.
- Stage
- Where a version of a pipeline is in its life. In development means the version runs only on development data, which is a small sample or recordings with no real person in them. In production means it runs on any data the department allows. Retired means it has ended for good and cannot be run again.
- Development sample
- A few recordings drawn by the platform from a sealed version of locked recordings, for building and testing a pipeline version that is still in development. It names the same locked recordings as the original and copies none, and it ends on its own.
- Locked recording
- A recording stored scrambled under a key made for the one patient it is about. Reading it back needs the platform to open it, and destroying the patient’s key later makes it unreadable for good.
- Synthetic
- Made up, with no real person in it, such as sentences read aloud by volunteers from invented scripts.
- Lease
- Permission, given by the custodian, to read one dataset for one stated purpose and for a limited time.
- Container
- An isolated environment, with no network access of its own, where Munitas runs an agent.
Devi asks for a sample of the recordings
A pipeline is a series of steps that Munitas runs on a version of a dataset. A pipeline version that has a custom step, a step whose script was written by the person who registered the pipeline, starts in development, which means it may run only on development data. For recordings of patients, development data is a small sample of them, or recordings that hold no real person. This part shows where a sample comes from.
Devi is a data engineer in the Cardiology department of the Health organisation. A department is the team inside an organisation that owns some of its data. Devi has written a pipeline version whose step makes the first half second of each recording silent, and it is in development. Devi opens the sealed version of the consultation recordings, which means the version that is finished and closed for good, so that it can never be edited. Under the heading Development samples, Devi says how many recordings are wanted, for how many days, and what the sample is for. Devi cannot choose which recordings: the platform draws them.
Pressing the button records the request and does nothing else. A sample needs the agreement of an approver of the department that owns the recordings, and the approver cannot be the person asking. An approver is a data custodian, a person who may decide who reads a department’s data, who is listed for that department. Devi may withdraw the request while it waits.
Hartley is the data custodian for Cardiology, so the same page shows the request to Hartley, under Waiting for your decision. It says who asked, how many recordings, for how many days and why. Hartley may lower the number or the days, and may not raise them. Hartley may not pick recordings either: the platform draws them, so nobody can steer a sample towards particular patients.
Hartley lowers the request to 3 recordings for 3 days, adds a note, and approves. The platform then draws the recordings by one fixed method: at most one recording from each patient, spread across short, medium and long recordings, and picked by a value that comes out the same every time for the same person asking for the same purpose. Nobody chooses, including Hartley. The platform seals a new version, the sample, that names the same locked recordings as the original. No audio is copied.
Devi uses the sample
Devi now runs the pipeline version on the sample. Running it on the real recordings is still refused, which shows what development means.
The platform made the sample as a version of its own, in a dataset named after the recordings with dev-sample and a short code added. A dataset is a registered, owned collection of data. Devi opens the sample from the list of Devi’s own samples. The page counts 3 recordings about 3 people and says that the sample is for the person it was drawn for and for nobody else. Lower down, the section Where this came from names the platform’s own step that made the sample, and links to the recordings it was made from.
Devi opens the real recordings again, chooses the pipeline version and presses Start. The platform refuses before it starts anything. A pipeline version in development may run only on development data, and the real recordings are not development data for anybody. Nothing is left behind: no run, no file and no record of an attempt to read.
Devi opens the sample, chooses the same pipeline version and presses Start, and this time it runs. The script runs in a container, which is an isolated environment. This one has no internet and holds no key and no storage address. It asks the platform for its recordings and is told of exactly the 3 in the sample. The platform finds the stored files that the sample names, unlocks each with its own patient’s key inside the platform, and hands the sound over. What the step writes back becomes a new version that waits for a person’s review.
Devi follows the link Open the version it made. A version is one sealed copy of a dataset, here the files the step wrote. The page has a section called Files. It lists the three recordings the step made silent, each marked Locked, which means the platform keeps the file scrambled with the key of the one patient it came from, and unscrambles it only inside the platform. Devi may open them because Devi started the run, and the run read a sample drawn for Devi. A line under the heading says when the files are deleted: after seven days at the latest, or sooner if the sample they came from ends.
Devi presses Play on the first file. A sound player appears in the page and loads the recording. The platform unscrambles the file as it sends it, so the browser receives ordinary sound and never the key or the place where the file is stored. Each opening is written down: who opened which file, why the platform allowed it, and how many bytes were sent.
Hartley is the data custodian, the approver for the Cardiology department, and approved the sample. Hartley opens the same page. The files are listed, so Hartley can see that they exist and how large they are, but there is no Play button. A sample is for the person it was drawn for, and what a run makes from it is that person’s to open. Hartley could open real recordings only under a lease, which is a time-limited permission asked for on the page of the recordings and decided by a second person.
The sample ends
A sample ends when its days are over, or sooner when the person it was drawn for, or an approver, ends it. Nothing is left running on it afterwards.
Devi presses End this sample on the page of the real recordings. The row changes to Ended, and the form for asking appears again with Draw a sample for me selected, because the earlier request is over and a new one may be made.
Devi opens the ended sample and tries to run the pipeline version on it. The platform refuses at the start, for the same reason as on the real recordings: the sample is no longer development data for Devi. A step that is already running when a sample ends is refused at its next request.
Devi opens the version the step made once more. The page now says that the version was made for development and has ended. The platform deletes the files within a minute of the sample ending, so nothing made from a sample outlives it. The version itself stays on record, because a sealed version is never removed, and so does a note of how many files and bytes were freed and why. The real recordings the sample named are not touched: a sample holds only a short list.
Recordings that hold no real person
Some recordings hold no real person, for example sentences read aloud by volunteers from invented scripts. They need no sample.
Synthetic means made up, with no real person in it. An approver of the owning department may declare a version of recordings synthetic, and must give a reason. Hartley opens a version of recordings that volunteers read aloud and types why.
After Hartley presses the button, the page says who made the declaration, when, and why. From then on a pipeline version in development may run on these recordings for anybody in the organisation, because nobody real is in them. A development sample holds real recordings, so it can never be declared synthetic.
