A small staff evaluation, with a clear gate before each step.

Proposed scope

One ward. Named people. Fictional cases.

Invite 8–12 named evaluators across dietetics, nursing, kitchen operations, discharge coordination and service leadership. Run two observed shifts and a seven-day home simulation within a two-week evaluation. The sponsor must approve the actual roster and dates before invitations are issued.

• Use the existing eight fictional patients, synthetic recipes, supplier events and receiving services. Keep the public walkthrough in its separate browser workspace.
• Retain ingredient yields, purchasing approvals, menu review, named staff capacity, equipment clearance, bedside assistance, individual nutrition goals, staff receipts and the frozen discharge handoff.
• No real patient information, clinical decisions, real orders, real referrals, supplier purchases or external home-service messages in this beta scope.
• Every open concern keeps its original due date and owner. Returning staff, repaired equipment or new deliveries do not imply that overdue care happened.

Access model

Identity and care responsibility are separate.

A verified Cloudflare Access identity must also have an active Care invitation for its assigned ward. Care obtains the role from that invitation on the server. A client-supplied role, email header or anonymous demo cookie cannot grant staff access.

All assigned staff can currently inspect their fictional ward record so the cross-team dependencies remain visible. Real-patient use would require a separate minimum-necessary access design and privacy assessment.

Staff sessions use a secure, host-only, HttpOnly cookie, a separate CSRF token, an eight-hour maximum and a 30-minute inactivity limit. Revocation and role changes invalidate existing sessions. Each saved action is attributed to the staff grant and ward; the existing care checks still enforce actual synthetic roster availability.

Action plan and acceptance

Promote only when the evidence and owners are in place.

1. 1 · Secure foundation — built; admission review pending

   Owner: engineering. Add the staff boundary, fixed roles, ward isolation, session controls and actor audit. Preserve the workflow engine and existing records. Test denial paths, concurrent updates, revocation and the complete recovery journey on the Free plan. Exit: no unauthorized read/write/export in the defined test set; no lost or duplicate confirmed action; no unresolved critical defect.

2. 2 · Identity activation and independent review — pending

   Owner: access administrator and security reviewer, to be named. Connect the selected Microsoft organization sign-in provider, then configure a Cloudflare Access application for both /staff and /api/staff/*, exact named-user allow rules, organization sign-in and MFA. Set the trusted issuer, application audience and canonical origin. Enroll the approved ward roles. Exit: actual staff sign-in, MFA, logout, alias denial, leaver revocation and wrong-ward access observed end to end. Email codes alone do not satisfy the proposed MFA gate.

3. 3 · Staff rehearsal and operational acceptance — pending

   Owners: named dietitian, nurse, chef and discharge lead, supported by an observer. Walk the queue through a full shift, absence, equipment failure, delayed stock, changed order, late assistance, seven reassessments, discharge booking and missed home contact. Exit: each team completes its own work without impersonation; every unsafe release is blocked; overdue reviews and contacts remain visible; observers record task completion, time, confusion and workarounds. Fix and rerun any blocked critical task.

4. 4 · Controlled synthetic beta — not yet open

   Owner: product sponsor, to be named. Approve the cohort, boundaries, support contact, response hours, incident route, data retention and restore evidence. Review the previous gates in a signed release decision. Exit: publish “Controlled beta · synthetic staff evaluation,” invite only the approved cohort, and review incidents and unresolved care tasks daily during the staffed evaluation.

5. 5 · Any real-patient pilot — separate decision

   Owners: clinical safety, privacy, security, local operational leadership and the receiving service. Validate local recipes, measured yields, staffing assumptions, escalation routes and source-system reconciliation. Complete required privacy, contractual, clinical safety and regulatory reviews, integration testing and restore drills. Evaluate minimum-necessary access and durable audit retention. The synthetic beta does not authorize this stage.

Required rehearsal evidence

Test what can go wrong between teams.

The October 21 development verification completed 591 authenticated synthetic care actions on Cloudflare, retained 29 expected clinical/operational blocks and passed 45 staff-access and integration checks, plus 171 local tests and 81 public-workflow API checks. The temporary test Worker and synthetic accounts were removed. These tests used signed synthetic identities; real Microsoft sign-in, MFA and staff admission remain pending.

• Uninvited, expired, revoked, forged and wrong-application identities cannot open the staff ward. Editing role, workspace or export parameters cannot increase permissions.
• Two staff saves at the same revision produce a visible conflict; only one commits. Replaying an operation cannot duplicate work, and another person cannot claim that receipt.
• A diet change invalidates unsuitable meals. NPO review, allergy and texture checks remain clinical or physically tested responsibilities; resource recovery does not clear them.
• Absence and repair forecasts do not create staff or usable equipment. Receipt, clearance, available stock and actual staffed task windows remain distinct.
• Discharge requires an accepted transfer, confirmed dated food service, access and teach-back, and an accepted follow-up owner. A delivery promise does not establish usable food.
• A missed delivery or unanswered contact opens further work, preserves the original deadline and remains visible across the next shift and the first week at home.
• The release test report distinguishes local checks, signed synthetic identities on Cloudflare and actual organization sign-in. Missing evidence is a gate, never a pass.

Operating the evaluation

Bound usage, preserve records and know how to stop.

Support: appoint a support owner and backup before launch; record staffed response hours and an escalation channel. Stop writes immediately for unauthorized access, cross-ward disclosure, lost saves or an unsafe workflow. Revert to the existing local/manual rehearsal method and preserve the incident evidence.

Data: proposed fictional ward lifetime is 14 days, with an explicit maximum of 30 days at provisioning. Expiry closes access; it does not silently erase the care history. Session rows are cleaned when staff sign in. Agree retention for staff identities and audit records before enrollment, close the ward at evaluation end, export an authorized record, verify it, and delete evaluation data through an administrator-approved runbook. A restore drill is still required.

Capacity: retain Workers Free with no CPU override or subscription change. The documented limits include 10 ms CPU per request and 100,000 Worker requests per day; D1 Free includes 5 million rows read and 100,000 rows written per day, with a seven-day Time Travel window. Budgets are shared with other account workloads. Propose an initial evaluation budget of 10,000 Worker requests and 10,000 D1 writes per day; inspect actual account usage before admission and pause if headroom is inadequate. Quota exhaustion is an outage condition requiring a clear status and manual fallback.

Recovery: keep the pre-change source and codec-compatible release, export the staff ward before planned maintenance, test restore into an isolated synthetic ward and compare revision, patients, goals, tasks and audit. Roll back staff UI/server code together while preserving D1 tables; close staff access first if identity or permissions fail. Never roll back to a staff build that omits authorization.

Release decision: stay pre-beta until gates 1–3 pass and the sponsor approves gate 4. A successful synthetic journey is software evidence, not proof of patient benefit.

Platform references

Primary implementation references.

Cloudflare Access JWT validation · Workers limits · D1 quotas · D1 restore and storage limits · Cloudflare plan eligibility

The medical evidence remains available in the workspace's Method + evidence view. This access release introduces no new diet prescription or automatic treatment decision.