How to read this page
- Every step is one screen, or one moment, in a real run. The label under the title names where it happens, and the step reads in the same order each time: what is happening, the evidence, and then what to look for in it.
- Screenshots are real pictures of the Munitas console, the web app that people open in a browser. Click any picture to enlarge it.
- Every name of a person, patient or card holder in the example data is invented, and every screenshot is unedited apart from being cropped to the part that matters.
Words used on this page
- Organisation
- A company or hospital group that uses Munitas. Each organisation sees only its own data.
- Department
- A team inside an organisation that owns some of its data, such as Cardiology.
- Custodian
- A person who holds the data custodian role, which allows deciding who may read data. A custodian decides for the departments they are an approver for.
- Role
- A named set of permissions that a person can hold, such as the permission to decide who may read a department’s data.
- Platform administrator
- The person who runs Munitas itself. The role gives no say over who may read any department’s data.
- De-identification reviewer
- A role that allows a person to review data from which identifying details have been removed, and to decide whether it may be released.
Sam asks for a role
A role is a named set of permissions that a person can hold, such as the permission to review data from which identifying details have been removed. Anybody in an organisation may ask to hold a role. Nobody may decide their own request, so asking and deciding are two separate steps done by two different people.
The directory lists every person the Health organisation has registered, the role each one holds, the department each one belongs to, and what each one may approve. Sam is a researcher and belongs to no department.
Sam fills in two fields. The first chooses the role, here de-identification reviewer, the role that allows a person to review data from which identifying details have been removed. The second is a written reason, which is stored with the request and read by whoever decides it.
Sam's request now appears under Role requests waiting for a decision. It has no buttons next to it, and the page says in words why there are none. Sam does not hold the role yet, because a request records a wish and changes no permission.
The platform administrator is refused
Priya is the platform administrator, the person responsible for running Munitas itself and not for any one department's data. This part shows the platform administrator being refused. Somebody who could both run the platform and decide who holds a role on it could grant themselves anything, so the platform does not allow it.
Priya sees the same waiting request that Sam made. The page shows Priya the reason box and the two buttons, Grant it and Refuse, because the page does not decide in advance who may click. The platform decides when a button is pressed.
Priya types the reason seems reasonable and presses Grant it. The platform checks the request against its access rules and answers with the reason it was refused, written as a sentence a person can read.
A custodian grants the role, and the grant starts as never checked
Granting a role is the job of a data custodian, the kind of person who already decides who may read a department's data. Here that is Hartley, the data custodian of the Cardiology department.
Hartley opens the same page and writes a reason before deciding. The platform stores the reason together with the decision, on the same request that Sam made.
Sam now holds the role. The row in Roles held shows who granted it, the date on which it lapses by itself, and when somebody last checked that it is still needed. Being granted a role and having that grant checked are two separate facts, and the page keeps them apart.
Pressing Still needed records that a named person looked at the grant on a named day. It does not extend the grant or change what it covers.
Pressing Withdraw ends the grant immediately. Sam no longer holds the role, and the Roles held list shows what is true now.
