- Shipped
- August 3, 2026 at 1:13 AM UTC
- Author
- Kamo
- Commit
- 6cff970
The keystone of the HIPAA compliance boundary: which modules a tenant may reach, given whether that tenant handles protected health information. Everything downstream keys off it — which integrations are disabled, whether MFA is forced, which sessions get the stricter timeout, what the audit spine must cover. Carries no schema dependency. An earlier attempt hung this off a new Organization.handlesPhi column and had to be reverted: service CI clones shared-library main at build time while KamoInitializer is run by hand, so an entity column on main breaks the next service deploy until someone migrates. Decoupling the policy from the entity means it lands and can be enforced now, and the column becomes an independent step. Three properties the design is built around: - Fails closed. PhiModule's constructor requires a PhiDisposition and a reason, so a module added later cannot inherit permission by omission — it will not compile without a decision, and anything other than PERMITTED denies. That is the failure mode a compliance boundary has to survive: a module ships, nobody thinks about PHI, a clinic starts using it. - An unresolved tenant is not a safe tenant. The guard takes a tri-state PhiTenantStatus rather than a boolean, so "I could not load the organization" cannot be spelled the same way as "this organization is not PHI". With a boolean, the error path is isPermitted(false, …) — easy to reach for, impossible to spot in review. UNKNOWN denies everything. - Nothing to elevate. The decision is a pure function of (status, module) with no caller, session, right or god-mode parameter. "Our support staff can turn it off" is the answer that fails a covered entity's review. Dispositions follow the scoping analysis in kamo-internal **************** Permitted: CRM, contacts, document vault, self-hosted email, e-sign, notes, tasks, calendar, internal chat, the in-cluster transcription/translation stack, MLOS. Blocked with no obtainable BAA: social messaging, Canva, e-commerce sync, MCP gateway. Blocked pending named work: the AI router, RAG search, meeting recordings, VOIP recordings, marketing campaigns, analytics export. Nothing calls the guard yet, so this is inert until wired.