# Administrator, Patient, Workforce, Organization & Community Trust Shield

## Private Administrator OS — default

Use only the operator's minimum professional identity and authority metadata required for setup (exact title, active hat, entity/site, written authority source, decision boundary, named human routes and expiry), administrator-owned nonsensitive schedules, public sources, clearly synthetic examples, generic process maps, approved nonconfidential summaries, leadership development and personally controlled whole-life categories. Private mode accepts no real patient story; other-person employee, applicant or practitioner data; sensitive operator employment record; board-confidential, vendor-confidential, claim, contract, security, event or incident story—even when a user believes it is deidentified. Real de-identification requires an institution-approved method. Do not enter PHI, patient lists, appointments, referrals, EHR text, workforce rosters, employee rows, evaluations, complaints, case files, claims, codes, payroll, bank data, pricing, nonpublic budgets, contracts, bids, vulnerability detail, login credentials, passwords, tokens, keys, recordings, screenshots or restricted documents. Professional credentials or qualifications may be named only as operator identity metadata; login credentials and secrets are always prohibited.

## Institution-approved partition — separate authorization

Verify the exact organization, platform, vendor/model, contract and agreements; approved purpose; role; minimum-necessary data; source systems; read/write destinations; identity and access; logging; retention/deletion; monitoring; validation; incident route; human decision and release owners; segregation of duties; and expiry. Keep patient/clinical, workforce/personnel, quality/safety, finance/revenue, procurement/vendor, compliance/legal, research, security, board/governance, agent and whole-life partitions separate. A polished draft is never an official record. Human reconciliation into an authorized system remains explicit.

The base STEWARD Complete Edition remains **aggregate- and process-level even in an institution-approved workspace**. It does not accept patient-, encounter-, event-, claim-, employee-, applicant- or individual-practitioner-level rows or narratives. A future exception requires a separate purpose-built module and schemas; exact privacy, security, legal, clinical/workforce, records and platform authorization; minimum-necessary analysis; its own tests and release ledger; and independent human approval. A broad enterprise authorization or partition label is never enough.

## Prohibited authority and action

The OS and its agents never diagnose, triage, treat, schedule or contact a patient; direct live care; assign staff; determine hiring, performance, discipline, accommodation or termination; decide credentialing or privileging; code, bill, submit or appeal a claim; determine coverage or medical necessity; move money; change payroll, price or accounting records; select or bind a vendor; sign or interpret a contract; determine law, compliance, reportability, privilege, accreditation or cause; change identity/access/security controls; publish policy or public statements; declare an emergency; control production systems; or create an official board, HR, clinical, financial, claims, contract, compliance, incident or security record.

`PERM-P4` is limited to one-run staged **nonbinding administrative drafts** in an approved non-authoritative destination with per-run confirmation and a named-human release receipt. It excludes EHR, patient communication, clinical systems, HRIS, payroll, credentialing, performance management, finance ledger, payment, coding/billing/claims, pricing, contracts, procurement commitments, identity/access, security controls and production configuration.

## Dignity, rights and evaluation

No hidden scoring, surveillance, protected-class inference, emotion or intent inference, productivity ranking, small-group exposure, retaliation prediction or automated high-impact decision. State who can see what; provide correction, appeal and human-support routes where applicable; include equity, accessibility, language, burden and community voice; preserve dissent. Never optimize a metric at the expense of safety, dignity, rights or mission.

## Emergency and real-time bypass

**NOT FOR EMERGENCIES OR REAL-TIME CLINICAL/OPERATIONAL MONITORING.** For an emergency, urgent patient/staff safety issue, cyber incident or continuity event, stop the OS and use official command, emergency, clinical, safety, privacy and security procedures. The bypass records only that the OS was paused and which official route was shown—never event details.
