- Shipped
- August 26, 2026 at 9:59 PM UTC
- Author
- kamo
- Commit
- 7f2d30f
The break-glass review endpoint had a client function that nothing called: every emergency chart access was recorded and there was no screen to read them on. A break-glass nobody reviews is an audit trail rather than a control, which is the opposite of why the grant is time-boxed and reason-bearing in the first place. It is a sixth tab on the records office, the compliance surface, and it shows the stated reason verbatim — that sentence is the whole substance of the review, and a summarised version of it decides nothing. Two gates that were missing. The break-glass button is now offered only to a role that holds BREAK_GLASS_PATIENT_ACCESS; showing it to somebody who cannot use it teaches them the refusal is arbitrary, when the honest answer is that their role does not include emergency access — so they get that sentence instead. And the disclosure accounting is its own segment behind VIEW_DISCLOSURE_ACCOUNTING: producing a copy for a patient and reading the ledger of everywhere their record has already gone are different jobs. That is the last of the 26 clinical rights to gate something a person can reach.