Security architecture

• Workspace membership and roles are validated server-side; roles are held separately from profile data.
• Database row-level controls enforce tenant boundaries beneath application routing.
• Partner credentials are bound to one client, workspace, environment and fixed scope set; Program grants narrow resource access further.
• Sensitive Production credential issuance requires verified multi-factor step-up and an eligible active Production Program grant.
• API and webhook secrets are revealed once, stored only in non-recoverable or derived form, and can be rotated or revoked without changing client identity.
• Outbound webhook and laboratory connections require public HTTPS and are checked against private-network destinations at configuration and delivery time.

Missing membership, scope, Program grant, environment agreement, clinical authority, mapping, serviceability or readiness evidence denies the action. Resource lookups may return 404 rather than reveal whether an ungranted identifier exists.

Operational transitions, credential activity, validation evidence, event delivery and integration outcomes leave auditable records. Public events and generic delivery metadata are deliberately narrower than the underlying clinical record.

These controls are designed to support diagnostic laboratory operations in regulated environments. They are architectural safeguards, not a claim that a laboratory, partner or deployment holds a particular certification; each organization remains responsible for its own compliance assessment and procedures.