---
component_id: "HCADMINAIOS-LIFE-OPERATIONS-1.0"
lane: "hospital_clinic_administration"
namespace: "hcadmin_steward.*"
default_context: "private_administrator_os"
---

# Hospital & Clinic Administrator Life, Leadership & Operations Foundation

Build a private administrator-controlled foundation for mission, strategy, decisions, access, flow, finance, resources, workforce, quality, compliance, equity, resilience, digital governance, leadership growth and whole-life sustainability. It is an organizational preparation and learning system—not an EHR, HRIS, payroll or finance ledger, claims platform, scheduling system, credentialing system, incident-reporting system, contract repository, security console, emergency command system, legal service, compliance authority or source of truth.

## Identity, setting and authority truth

*Hospital administrator* and *clinic administrator* cover very different jobs. Record separately the exact job title; employer or legal entity; ownership/governance model; operating level; hospital, clinic, service line, network or enterprise; site; jurisdiction; active administrative or clinical hat; delegated decision rights; dollar/approval threshold; committee or board role; data-access authorization; source; named functional owners; and expiry. Never infer authority from title, access, seniority, a professional license, committee membership or AI-OS visibility. A clinician-administrator must explicitly switch hats; neither hat silently expands the other.

## Default boundary

Private Administrator OS • no PHI • no patient-level data • no personnel file or employee-level evaluation • no real incident/event narrative • no claim-level, vendor-confidential, contract-confidential, security-sensitive or nonpublic financial data • conversation/model memory session-only • connectors, schedules, sharing and external actions Off • all agents PERM-P0 Disabled • all powers Available Inactive • Preview-first. Only an explicitly approved workspace artifact may persist with visible owner, ACL, retention, correction, export and deletion. An institution-approved workspace requires separate authorization for the exact organization, platform, vendor, model, purpose, data, integrations, logging, retention, monitoring, incident route and human owners. Installation does not create that authorization.

## Eighteen typed administrator-owned schemas

Create only under `hcadmin_steward.*`. The type names below are closed, versioned aliases. There is no unbounded `object`, free-form enum or implicit cross-partition reference.

| Schema | Context and ACL | Required typed fields | Validation, relationships and retention |
|---|---|---|---|
| `administrator_authority_profile` | Private operator metadata or approved governance partition | exact_title:str; legal_entity_id:id_str; ownership_model:ownership_model_enum; provider_facility_type:facility_type_enum; operating_level:operating_level_enum; site_ids:list[entity_site_ref]; jurisdiction_codes:list[code_str]; active_hat:active_hat_enum; active_hat_verified_by:id_str; active_hat_verified_at:datetime; authority_scope:list[authority_item]; decision_threshold:money_or_null; committee_roles:list[committee_role]; local_enterprise_scope:scope_level_enum; escalation_routes:list[human_route]; expires_at:datetime | Only operator minimum metadata in Private mode; entity/site references are immutable IDs; hat and authority require verifier/source/expiry; title, credential, committee role and delegation remain separate |
| `source_claim_record` | Public/private nonsensitive or approved source partition | publisher:str; exact_title:str; canonical_url:uri; publication_date:date; version:version_label; source_status:source_status_enum; retrieved_at:datetime; claim:str; applicability:str; exclusions:list[str]; local_override:ref_or_null; reviewer:id_str | Proposed, retired, superseded, unavailable and conflicting sources remain labeled; hub dates cannot substitute for document dates |
| `strategic_mandate` | Approved governance partition | mandate_id:id_str; governing_owner:id_str; mission_link:str; approved_commitments:list[str]; proposed_items:list[str]; stakeholders:list[str]; measures:list[ref]; constraints:list[str]; review_at:datetime | No invented board/owner direction, public promise or strategy; proposals never display as approved commitments |
| `decision_option_record` | Private synthetic or approved decision partition | question:str; decision_owner:id_str; options:list[decision_option]; evidence:list[ref]; assumptions:list[str]; uncertainty:list[str]; equity_review:str; dependencies:list[ref]; reversibility:reversibility_enum; decision_status:decision_status_enum; review_at:datetime | Status quo is explicit; AI recommendation is labeled for human consideration; only the named human records the decision |
| `portfolio_initiative` | Approved portfolio partition | initiative_id:id_str; sponsor:id_str; charter_ref:ref; strategic_link:str; lifecycle_state:initiative_lifecycle_enum; resource_demand:resource_demand; dependencies:list[ref]; benefits:list[benefit_claim]; risks:list[ref]; stop_rules:list[str]; next_gate_at:datetime | No hidden score or automatic funding/status change; benefit attribution requires human validation |
| `governance_meeting_action` | Approved meeting partition | body:id_str; charter_ref:ref; item_type:meeting_item_type_enum; owner:id_str; decision_right:str; conflict_state:conflict_state_enum; due_at:datetime; acknowledgment:str; official_record_ref:ref_or_null; action_status:action_status_enum | Not official notice, minutes or vote; counsel/chair/secretary verifies conflicts, quorum and official records |
| `outcome_metric_registry` | Approved aggregate mission/operations/workforce/quality/finance/community/AI partition | metric_id:id_str; outcome_domain:outcome_domain_enum; legal_entity_id:id_str; site_id:id_str; service:str; plain_language_definition:str; population_definition:str; period:datetime_range; numerator:float_or_null; denominator:float_or_null; unit:str; exclusions:list[str]; source_system_ref:ref; refreshed_at:datetime; expected_lag:str; owner:id_str; baseline:metric_value; human_target:metric_value_or_null; uncertainty_missingness:list[str]; allowed_stratifiers:list[str]; small_cell_rule:str; balancing_metric_ids:list[id_str]; decision_supported:str; review_at:datetime; correction_route:human_route | No individual row or composite organization score; targets are human-approved; site variation, lag, uncertainty, denominator and suppression remain visible |
| `process_improvement_record` | Synthetic in Private; approved QI/operations partition otherwise | process_scope:str; sponsor:id_str; human_qi_research_determination:ref; current_state:list[process_step]; bottleneck_hypotheses:list[str]; change_theory:str; measures:list[ref]; balancing_measures:list[ref]; equity_burden_review:str; stop_rule:str | Sponsor authorizes any test; AI does not determine QI versus research, root cause or live operational change |
| `financial_scenario` | Private synthetic or approved finance partition | budget_version:version_label; period:datetime_range; currency:currency_code; source_refs:list[ref]; actuals:financial_snapshot; budget:financial_snapshot; forecast:financial_snapshot; assumptions:list[str]; sensitivities:list[sensitivity_case]; variance_drivers:list[str]; finance_reviewer:id_str | Not an accounting record, journal, statement, price or commitment; finance validates units, treatment and decisions |
| `revenue_procurement_learning` | Private public/nonsensitive or approved business partition | topic_type:business_topic_type_enum; aggregate_scope:str; requirements:list[str]; source_refs:list[ref]; vendor_or_payer_claims:list[str]; evidence:list[ref]; questions:list[str]; risks:list[ref]; reviewers:list[id_str]; decision_state:business_decision_state_enum | No patient account, claim, code, coverage, contract interpretation, vendor selection, signature or purchase |
| `workforce_aggregate` | Approved aggregate workforce partition | role_group:str; period:datetime_range; metric_definition:str; aggregation_rule:str; small_cell_rule:str; fte:float; productive_hours:float; workload_measure:workforce_measure; vacancy_or_turnover:vacancy_turnover_measure; equity_burden_review:str; hr_owner:id_str | No employee row, hidden score, assignment, performance or staffing-adequacy conclusion |
| `change_adoption_record` | Private synthetic or approved change partition | change_id:id_str; sponsor:id_str; decision_status:decision_status_enum; affected_groups:list[str]; impact_map:list[stakeholder_impact]; accessibility_language_plan:str; communications:list[communication_item]; learning_plan:list[learning_item]; feedback_routes:list[human_route]; adoption_measures:list[ref]; stop_rules:list[str] | No deceptive messaging, external send, hidden readiness score, policy enactment or launch |
| `quality_compliance_readiness` | Approved quality/compliance partition | requirement_source:ref; requirement_text:str; applicability_owner:id_str; entity_site_service:str; policy_ref:ref_or_null; control_owner:id_str; evidence_refs:list[ref]; evidence_status:evidence_status_enum; gap:str; remediation_owner:id_str; due_at:datetime | No compliance, accreditation, privilege, legal, reporting or attestation conclusion; no fabricated evidence |
| `equity_experience_review` | Approved aggregate or engagement partition | decision_or_initiative:ref; affected_groups:list[str]; approved_data_refs:list[ref]; missing_voices:list[str]; accessibility_requirements:list[str]; language_access:list[str]; distributional_effects:list[distributional_effect]; mitigations:list[mitigation_action]; engagement_owner:id_str | No protected-class inference, individual score, token consultation or civil-rights determination |
| `resilience_cyber_risk` | Synthetic in Private; approved risk partition otherwise | risk_or_scenario:str; owner:id_str; essential_functions:list[str]; dependencies:list[str]; data_classes:list[data_class_enum]; trust_boundaries:list[str]; controls:list[ref]; gaps:list[str]; continuity_actions:list[str]; incident_route:human_route; recovery_owner:id_str; next_review_at:datetime | No real emergency control, vulnerability test, production access, legal determination or authorization-to-operate |
| `whole_life_private` | Personally controlled isolated store only; disabled institutionally | values:list[str]; leadership_purpose:str; protected_life_needs:list[str]; family_categories:list[str]; finance_categories:list[str]; recovery_commitment:str; minimum_mode_trigger:str; sharing_choice:sharing_choice_enum; review_at:datetime; delete_at:datetime | Owner-only ACL; no passwords, account numbers, diagnoses or employer access; UI hiding is not isolation |
| `agent_charter_trace` | Private synthetic or separately approved agent partition | agent_id:id_str; objective:str; owner:id_str; beneficiary:str; agent_state:agent_state_enum; permission:permission_enum; data_classes:list[data_class_enum]; tools:list[id_str]; destinations:list[id_str]; tests:list[ref]; human_checkpoints:list[str]; stop_rules:list[str]; expires_at:datetime; kill_status:kill_status_enum | ORBIT required; PERM-P0 Disabled by default; no self-approval, recursive delegation, permission escalation or hidden persistence |
| `control_audit_receipt` | Same partition as controlled object; immutable to agent | receipt_id:id_str; object_ref:ref; action:receipt_action_enum; before_state:state_snapshot; after_state:state_snapshot; requested_by:id_str; approved_by:id_str; executed_by:id_str; occurred_at:datetime; result:receipt_result_enum; blocker:str; rollback_ref:ref_or_null; purge_ref:ref_or_null | Named-human approval for consequential action; append-only audit; a receipt cannot grant authority |

### Concrete type and validation contract

**Normative compilation rule.** Hermes must compile all 18 tables to JSON Schema Draft 2020-12 with `$id`, `$schema`, semantic `schema_version`, closed `$defs`, `additionalProperties:false` and `unevaluatedProperties:false`; store the compiled schema and SHA-256 hash outside agent-writable state; and validate every create, import, preview, update, export and migration. A parser count is structural QA only. `RA-O08` and `RA-INT08` may pass only when the target validator executes the schema fixtures below and stores expected/observed evidence.

- Lexical primitives: `str` is trimmed UTF-8 text of 1–4,000 characters; `code_str` matches `^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$`; `id_str` matches `^[a-z0-9][a-z0-9_-]{2,63}$`; `version_label` is 1–64 visible characters; `semver` matches `^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$`; `currency_code` matches `^[A-Z]{3}$` and must be an assigned ISO 4217 code; `uri` must be absolute `https` unless a qualified owner records an approved alternative. `date` is ISO 8601 `YYYY-MM-DD`; `datetime` is ISO 8601 with explicit timezone; `datetime_range = {start_at:datetime, end_at:datetime}` with `end_at > start_at`; `float` and `int` must be finite; ratios must be in `0..1`; `list[T]` has `maxItems:100` and rejects type mismatches.
- Nullable aliases are discriminated unions, never silent blanks: `float_or_null`, `int_or_null`, `money_or_null`, `ref_or_null`, `metric_value_or_null` and `datetime_or_null` are either the named value or `{value:null, reason:null_reason_enum, verification_route:human_route}`, where `null_reason_enum = missing | not_applicable_by_human | unavailable | withheld_by_owner | unknown`. `unknown` blocks consequential use.
- `ownership_model_enum = public_government | nonprofit_tax_exempt | for_profit_private | publicly_traded_parent | joint_venture | management_agreement | tribal_sovereign | other_verified | unknown`.
- `facility_type_enum = acute_care_hospital | critical_access_hospital | specialty_hospital | ambulatory_clinic | physician_practice | fqhc_grantee | fqhc_lookalike | rural_health_clinic | ambulatory_surgery_center | urgent_care | diagnostic_or_specialty_clinic | academic_health_entity | tribal_or_ihs | other_verified | unknown`.
- `operating_level_enum = enterprise | legal_entity | facility | region | service_line | department | clinic | program | project`; `scope_level_enum = enterprise_standard | local_standard | local_exception | cross_entity_proposal | unknown`.
- `active_hat_enum = board_support | chief_executive | operations | clinic_practice_admin | finance_revenue | quality_risk_compliance | privacy_legal | people_labor | data_security_ai | procurement_facilities | clinical_admin_hat | analyst_consultant_trainee | other_verified | unknown`.
- `outcome_domain_enum = mission_strategy | access_flow | people_culture | quality_safety | equity_experience_community | finance_resources | resilience_cyber | data_ai`.
- Closed lifecycle enums: `source_status_enum = current | proposed | retired | superseded | unavailable | conflicting | unknown`; `reversibility_enum = high | medium | low | unknown`; `decision_status_enum = proposed | under_human_review | accepted_by_human | revised | deferred | rejected | expired | unknown`; `initiative_lifecycle_enum = idea | proposed | approved_by_human | active | paused | stopped | complete | retired | unknown`; `meeting_item_type_enum = decision | discussion | information`; `conflict_state_enum = none_declared | disclosed_pending_review | recused | resolved_by_human | unknown`; `action_status_enum = draft | assigned_by_human | acknowledged | complete_verified | overdue | cancelled | blocked`; `business_topic_type_enum = revenue_cycle | payer_contract_question | procurement | vendor | asset | sustainability`; `business_decision_state_enum = learning_only | questions_ready | under_human_review | recorded_in_official_system | expired | unknown`; `evidence_status_enum = present_unverified | verified_current | stale | missing | contradictory | not_applicable_by_human | unknown`.
- Closed control enums: `sharing_choice_enum = owner_only | named_person_preview | none`; `agent_state_enum = disabled | preview | one_run_active | human_review | paused | blocked | retired`; `permission_enum = PERM-P0 | PERM-P1 | PERM-P2 | PERM-P3 | PERM-P4 | PERM-P5`; `kill_status_enum = not_applicable | armed | invoked | verified_stopped | containment_failed`; `receipt_action_enum = preview | activate_power | run_workflow | record_human_decision | pause_all | kill_agent | rollback | purge | safe_reset | remove_power | remove_overlay | uninstall | switch_hat | migrate_schema | export | delete`; `receipt_result_enum = succeeded | failed | blocked | rolled_back | partial_verified`.
- Closed common enums: `context_enum = private_administrator_os | public_nonsensitive | synthetic_sandbox | institution_approved | personally_controlled_isolated | unknown`; `data_class_enum = public | synthetic | administrator_owned_nonsensitive | approved_aggregate | confidential_governance | confidential_finance | confidential_workforce_aggregate | confidential_quality_compliance | confidential_security | personally_controlled_private | prohibited_sensitive | unknown`; `fact_interpretation_enum = verified_fact | reported_claim | human_interpretation | ai_generated_draft | assumption | unknown`; `record_status_enum = draft | under_human_review | approved_for_limited_use | rejected | blocked | expired | archived`; `correction_state_enum = none_requested | requested | in_human_review | corrected | rejected_by_human | unknown`; `export_state_enum = not_requested | human_authorized | completed | failed | revoked`; `deletion_state_enum = active | deletion_requested | legal_or_owner_hold | deleted | deletion_failed`; `acl_permission_enum = own | read | propose | approve | audit | export | delete`.
- `entity_site_ref = {legal_entity_id:id_str, site_id:id_str, provider_facility_type:facility_type_enum, local_owner:id_str, active:bool}`; references use immutable IDs, never display names as keys.
- `authority_type_enum = reserved | delegated | consultative | advisory | execution | unknown`; `authority_item = {authority_type:authority_type_enum, action_domain:str, source_ref:ref, verifier:id_str, verified_at:datetime, expires_at:datetime, exclusions:list[str]}`; `committee_role = {body_id:id_str, role:str, authority_type:authority_type_enum, charter_ref:ref, starts_at:datetime, expires_at:datetime}`.
- `human_route = {function:str, role_title:str, channel_label:str, urgent:bool}`; no personal contact detail is required in Private mode.
- `money = {amount:decimal_string, currency:currency_code}`, where `decimal_string` matches `^-?(0|[1-9][0-9]{0,14})(\.[0-9]{1,4})?$`; money never uses binary float. `metric_value = {value:float, unit:str, period:datetime_range, source_ref:ref}`; `decision_option = {option_id:id_str, description:str, status_quo:bool, benefits:list[str], harms:list[str], costs:money_or_null, dependencies:list[ref], reversibility:reversibility_enum}`.
- Named planning types: `resource_demand = {fte:float_or_null, hours:float_or_null, money:money_or_null, dependencies:list[ref], assumptions:list[str]}`; `benefit_claim = {benefit_id:id_str, description:str, metric_ref:ref, baseline:metric_value_or_null, human_target:metric_value_or_null, attribution_status:attribution_status_enum, validation_owner:id_str}`, with `attribution_status_enum = proposed | evidence_pending | human_validated | rejected | unknown`; `process_step = {step_id:id_str, label:str, owner_role:str, input_label:str, output_label:str, expected_minutes:float_or_null, source_ref:ref_or_null}`.
- Named finance/workforce types: `financial_line = {line_id:id_str, label:str, amount:money_or_null, source_ref:ref_or_null, classification:financial_line_class_enum}`, with `financial_line_class_enum = revenue | expense | capital | cash | noncash | assumption | unknown`; `financial_snapshot = {as_of:date, lines:list[financial_line], source_complete:bool}`; `sensitivity_case = {case_id:id_str, variable:str, low:decimal_string, base:decimal_string, high:decimal_string, output_metric:str, reviewer:id_str}`; `workforce_measure = {definition:str, value:float_or_null, unit:str, period:datetime_range, source_ref:ref, approved_aggregate:bool}`; `vacancy_turnover_measure = {vacancy_rate:float_or_null, vacancy_denominator:int_or_null, turnover_rate:float_or_null, turnover_denominator:int_or_null, period:datetime_range, source_ref:ref, approved_aggregate:bool}`.
- Named change/equity types: `impact_direction_enum = benefit | burden | mixed | uncertain`; `stakeholder_impact = {group_label:str, impact:impact_direction_enum, evidence_refs:list[ref], uncertainty:list[str], human_owner:id_str}`; `communication_channel_enum = meeting | email_draft | intranet_draft | print_draft | training | other_approved`; `communication_item = {audience_group:str, channel:communication_channel_enum, purpose:str, draft_owner:id_str, proposed_timing:str, external_send_allowed:bool}`, where `external_send_allowed` must be `false` in this base product; `learning_modality_enum = live | self_paced | simulation | job_aid | coaching | other_approved`; `learning_item = {objective:str, audience_group:str, modality:learning_modality_enum, owner:id_str, evidence_of_learning:str}`; `distributional_effect = {group_label:str, effect:impact_direction_enum, evidence_refs:list[ref], uncertainty:list[str]}`; `mitigation_action = {action_id:id_str, description:str, owner:id_str, review_at:datetime, action_status:action_status_enum}`.
- Named control types: `state_snapshot = {state_label:str, state_hash:sha256_hex, captured_at:datetime, config_refs:list[ref], notes:str}`, where `sha256_hex` matches `^[a-f0-9]{64}$`; `acl_entry = {subject_id:id_str, permissions:list[acl_permission_enum], granted_by:id_str, granted_at:datetime, expires_at:datetime_or_null}`; duplicate subject/permission pairs are rejected. `ref = {record_id:id_str, schema_version:semver, partition_id:id_str}`; `migration_record = {schema_name:id_str, from_version:semver, to_version:semver, migration_owner:id_str, preview_hash:sha256_hex, field_diff:list[str], partition_diff:list[str], backward_compatibility:migration_compatibility_enum, rollback_ref:ref, approval_receipt:ref, migration_status:migration_status_enum}`, with `migration_compatibility_enum = compatible | breaking | unknown` and `migration_status_enum = previewed | approved_by_human | executed | rolled_back | blocked`.
- Required fields are those listed in each schema plus the common fields below. Empty strings, NaN/infinity, unknown fields, invalid identifiers, invalid enum values and malformed dates/currency are rejected. `unknown`, `prohibited_sensitive`, missing owner, expired authority, cross-partition reference or condition failure blocks persistence or consequential transition and emits a non-sensitive failure receipt.
- `active_hat` is valid only when `active_hat_verified_by`, `active_hat_verified_at`, at least one current `authority_item` and `expires_at` are present. Switching hats creates a new receipt; it never mutates past artifacts. Enterprise scope never implies local authority, and a multi-site record requires one local owner and metric definition per site.
- A `ref.partition_id` must exactly equal both the record's `partition_id` and the authenticated caller's authorized partition. The target must exist, use a compatible schema major version and be permitted by both ACLs. Cross-partition joins fail validation; no UI, prompt, administrator title or agent may override this invariant.
- Whole-life records require `context=personally_controlled_isolated`, `data_class=personally_controlled_private`, one ACL entry whose subject equals `owner_id`, permissions exactly `own|read|export|delete`, and no institutional subject. Institution-managed context or any extra ACL entry is invalid.
- Schema migration requires a valid `migration_record`, read-only preview, field/partition diff, compatibility result, rollback reference and a named-human approval receipt. `from_version` must equal the stored version; `to_version` must exceed it; breaking/unknown or major-version drift blocks binding. The overlay never recreates or silently migrates foundation schemas.

Every schema also requires `record_id:id_str`, `schema_version:semver`, `partition_id:id_str`, `acl:list[acl_entry]`, `owner_id:id_str`, `context:context_enum`, `data_class:data_class_enum`, `source_version:version_label`, `fact_interpretation:fact_interpretation_enum`, `human_decision_owner:id_str`, `record_status:record_status_enum`, `created_at:datetime`, `updated_at:datetime`, `expiry:datetime`, `retention_rule_id:id_str`, `correction_state:correction_state_enum`, `export_state:export_state_enum` and `deletion_state:deletion_state_enum`. `acl` must have 1–20 entries; `owner_id` must have `own`; `created_at <= updated_at < expiry`; and records with `record_status=approved_for_limited_use` require a current human approval receipt. Private, patient/clinical, workforce/personnel, finance/revenue, procurement/vendor, board/governance, quality/safety, compliance/legal, research, security, agent and whole-life partitions cannot be joined by default. Unknown consequential fields display `Unknown — human verification required` and fail closed.

### Executable schema fixture contract

| Fixture | Input condition | Expected validator result |
|---|---|---|
| `SCHEMA-FX-VALID-01` v1.0 | Synthetic `decision_option_record`; valid IDs/SemVer/timestamps; one owner ACL; same-partition refs; one status-quo option | `passed`; create preview only; stored receipt contains compiled-schema hash |
| `SCHEMA-FX-INVALID-ID` v1.0 | `record_id="Admin Record 1"` | `blocked`; `pattern` failure; no record persisted |
| `SCHEMA-FX-INVALID-ENUM` v1.0 | `decision_status="AI_APPROVED"` | `blocked`; closed-enum failure; no coercion or fallback |
| `SCHEMA-FX-CROSS-PARTITION` v1.0 | Record partition `admin_private` references `workforce_confidential` | `blocked`; partition/ACL invariant failure; no joined value or sensitive echo |
| `SCHEMA-FX-HAT-EXPIRED` v1.0 | Authority item or profile expiry precedes validation time | `blocked`; CHART human route; no consequential transition |
| `SCHEMA-FX-WHOLE-LIFE-ACL` v1.0 | Personally controlled record includes an employer/institution subject | `blocked`; record rejected; owner warned to use isolated store |
| `SCHEMA-FX-MIGRATION-01` v1.0 | 1.0.0→1.1.0 read-only preview with complete `migration_record`, compatible diff, rollback and human approval | `passed` for the fixture; migration may execute once and records before/after hashes |
| `SCHEMA-FX-MIGRATION-BLOCK` v1.0 | Source version mismatch, missing approval/rollback, cross-partition diff, or breaking/unknown compatibility | `blocked`; existing schema/data remain unchanged |

The target adapter must execute all eight fixtures against every applicable compiled schema, plus field-boundary variants for dates, decimals, list limits and required values. A passing example cannot offset a failing negative fixture. Save validator name/version, fixture/hash, schema/hash, expected/observed result, timestamp, tester and independent reviewer in the RA evidence ledger.

Whole-life, family, personal finance, health-care-time and recovery details require a personally controlled isolated store. Disable these fields and the personal leadership agent function in institution-managed contexts unless technical isolation is proven; route labels—not personal details—are the safe organizational default.

## Canonical Source Watch registry

| Authority/publisher | Exact source | Canonical URL | Publication/effective date | Version/status | Intended claim/use | Applicability | Exclusions | Local override/precedence | Retrieved/reviewed | Reviewer/expiry |
|---|---|---|---|---|---|---|---|---|---|---|
| HHS OCR | HIPAA Minimum Necessary Requirement | https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html | Unknown — human verification required | Seed source — verify current document, version and status | Privacy design context; local privacy/legal owners determine applicability | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| HHS OCR | HIPAA De-identification Guidance | https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html | Unknown — human verification required | Seed source — verify current document, version and status | Approved de-identification methods; user self-redaction is not accepted in Private mode | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| HHS OCR | HIPAA and Cloud Computing Guidance | https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html | Unknown — human verification required | Seed source — verify current document, version and status | Cloud risk analysis, authorization and business-associate context | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| HHS OCR | HIPAA Security Rule Guidance | https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html | Unknown — human verification required | Seed source — verify current document, version and status | Current Security Rule guidance and risk-management context; do not treat proposals as current mandates | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| HHS OCR | HIPAA Security Rule Notice of Proposed Rulemaking | https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html | NPRM issued 2024-12-27 | Proposed — not a current mandate; current Security Rule remains in effect | Proposal watch only; the current Security Rule remains in effect until a final rule becomes effective | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| CMS | Conditions for Coverage and Conditions of Participation | https://www.cms.gov/medicare/health-safety-standards/conditions-coverage-participation | Unknown — human verification required | Seed source — verify current document, version and status | Federal participation source hub; verify exact provider type, rule and effective date | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| eCFR / CMS | 42 CFR Part 482 — Conditions of Participation for Hospitals | https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482 | eCFR current through 2026-07-14 | Current electronic text; authoritative but unofficial | Current electronic federal hospital requirements; eCFR is authoritative but unofficial and applicability requires qualified review | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| eCFR / CMS | 42 CFR Part 485 — Conditions of Participation: Specialized Providers | https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-485 | eCFR current through 2026-07-14 | Current electronic text; authoritative but unofficial | Current electronic requirements including relevant specialized-provider and Critical Access Hospital provisions; verify exact subpart | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| eCFR / CMS | 42 CFR Part 491 — Certification of Certain Health Facilities | https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-491 | eCFR current through 2026-07-14 | Current electronic text; authoritative but unofficial | Current electronic RHC/FQHC certification requirements; verify exact facility type and section | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| HRSA | Health Center Program Compliance Manual | https://bphc.hrsa.gov/compliance/compliance-manual | Unknown — human verification required | Seed source — verify current document, version and status | Health Center Program compliance reference; confirm current chapter, applicability and related guidance | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| CMS | Measures Management System | https://mmshub.cms.gov/ | Unknown — human verification required | Seed source — verify current document, version and status | Measure lifecycle and specification context; exact measure versions remain authoritative | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| CMS | Interoperability and Prior Authorization Final Rule CMS-0057-F | https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-prior-authorization-final-rule-cms-0057-f | Unknown — human verification required | Seed source — verify current document, version and status | Actor- and program-specific readiness context; verify dates, exclusions and current implementation guidance | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| ASTP/ONC | HTI-1 Final Rule | https://www.healthit.gov/topic/laws-regulation-and-policy/health-data-technology-and-interoperability-certification-program-updates-algorithm-transparency-and-information-sharing-hti-1-final-rule | Unknown — human verification required | Seed source — verify current document, version and status | Certified-health-IT transparency context; applicability requires qualified review | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| ASTP/ONC eCFR | 45 CFR 170.315(b)(11) — Decision Support Interventions | https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-170/subpart-C/section-170.315 | eCFR current through 2026-07-14 | Current electronic text; actor-specific certification criterion | Actor-specific certified-health-IT criterion and procurement-question context; not blanket approval of every AI tool | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| ASTP/ONC eCFR | 45 CFR Part 171 — Information Blocking | https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-171 | eCFR current through 2026-07-14 | Current electronic text; defined-actor requirements | Actor-specific EHI access, exchange and use context; legal applicability and exceptions stay human-owned | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| HHS OCR eCFR | 45 CFR 92.210 — Patient Care Decision Support Tools | https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-92/subpart-C/section-92.210 | eCFR current through 2026-07-14 | Current electronic text; covered-entity applicability requires legal review | Section 1557 decision-support-tool inventory and discrimination-risk context for covered entities; verify current litigation and applicability | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| HHS OIG | General Compliance Program Guidance | https://oig.hhs.gov/compliance/general-compliance-program-guidance/ | Issued 2023-11-06 | Current voluntary, nonbinding general guidance | Voluntary compliance-program reference; not legal advice or certification | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| HHS | Healthcare and Public Health Cybersecurity Performance Goals | https://hhscyber.hhs.gov/cybersecurity-performance-goals.html | Unknown — human verification required | Seed source — verify current document, version and status | Voluntary healthcare cybersecurity practices and prioritization context | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| NIST | AI Risk Management Framework | https://www.nist.gov/itl/ai-risk-management-framework | AI RMF 1.0 released 2023-01-26 | Voluntary; revision work underway as of review | Voluntary AI governance reference; track versions and companion profiles | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| NIST | AI RMF Generative AI Profile | https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence | NIST AI 600-1 published 2024-07-26 | Current voluntary Generative AI Profile as of review | Generative-AI risk reference; not a certification | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| NIST | Cybersecurity Framework 2.0 | https://www.nist.gov/cyberframework | CSF 2.0 released 2024-02-26 | Current voluntary framework as of review | Voluntary cybersecurity risk-management reference | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| AHRQ | TeamSTEPPS 3.0 | https://www.ahrq.gov/teamstepps-program/index.html | Unknown — human verification required | Seed source — verify current document, version and status | Human teamwork and communication reference; AI never closes the loop | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| AHRQ | CAHPS Program | https://www.ahrq.gov/cahps/index.html | Unknown — human verification required | Seed source — verify current document, version and status | Patient-experience survey resources; use exact instruments and authorized methods | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| IRS | Charitable Hospitals — General Requirements for Tax Exemption under Section 501(c)(3) | https://www.irs.gov/charities-non-profits/charitable-hospitals-general-requirements-for-tax-exemption-under-section-501c3 | Page updated 2026-07-02 | Current IRS informational page as of review | Tax-exempt hospital context; qualified tax/legal owners determine current applicability and compliance | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| HHS OCR eCFR | 45 CFR Part 84 — Nondiscrimination on the Basis of Disability | https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-84 | eCFR current through 2026-07-14 | Current electronic text; covered-recipient applicability requires legal review | Current Section 504 regulatory text for covered recipients; qualified civil-rights/legal owners determine applicability and dates | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| FEMA | Continuity Resource Toolkit | https://www.fema.gov/emergency-managers/national-preparedness/continuity/toolkit | Unknown — human verification required | Seed source — verify current document, version and status | Continuity planning resource; local approved plans and command structures govern | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| OSHA | Healthcare Workplace Violence | https://www.osha.gov/healthcare/workplace-violence | Unknown — human verification required | Seed source — verify current document, version and status | Worker-safety resource; current law, state requirements and local policy require human review | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| FDA | Clinical Decision Support Software Final Guidance | https://www.fda.gov/regulatory-information/search-fda-guidance-documents/clinical-decision-support-software | Final guidance issued 2026-01 | Current final guidance as of 2026-01-29 page review | January 2026 regulatory-boundary guidance; exact function classification requires qualified review | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |
| W3C | Web Content Accessibility Guidelines 2.2 | https://www.w3.org/TR/WCAG22/ | W3C Recommendation 2.2; original 2023-10-05, republished with errata 2024-12-12 | Current technical recommendation; legal adoption varies | Digital accessibility design and test reference | Exact entity, provider/facility type, actor, function and jurisdiction — human verification required | Not universal; exclusions and exceptions — human verification required | State/local law, contract, accreditation and policy override — Unknown until verified | 2026-07-15 | Named qualified functional owner required before use; expiry set at verification |

These are seed `source_claim_record` entries, not validated applicability decisions. `Unknown — human verification required` is an intentional blocking value. Before a record supports a claim, a named qualified owner must verify the exact operative document/section, publication/effective/revision date, version, status, actor/entity/provider type, jurisdiction, exclusions, exceptions, contradictions, local precedence and expiry. A hub page's date never substitutes for an individual rule, standard, measure or document date. Do not copy or redistribute licensed or confidential content.

STEWARD is an independent organizational concept. It is not endorsed, certified, accredited or approved by HHS, CMS, the Office of the Federal Register/eCFR, HRSA, ASTP/ONC, HHS OIG, IRS, FDA, NIST, AHRQ, FEMA, OSHA or W3C. Their publications are references, not product validation. Current law, regulation, contracts, accreditation requirements, payer rules, local policy, governing bodies and authorized professionals determine applicability and action.

STEWARD is a working product name and implies no affiliation with any healthcare provider, vendor or other organization. Before public commercialization, obtain appropriate trademark, entity-name, domain and confusion review.

## My STEWARD foundation shell

Create one accessible home with the Core Four:

1. **Orient Mandate & Priorities**
2. **See Operations & Risk**
3. **Align People, Resources & Change**
4. **Decide, Escalate & Close**

Leave the optional fifth launcher empty. Show no more than seven attention items. Permanent controls: Context & Active Hat; Decision Rights; Privacy & Data; Sources & Freshness; People & Dignity; Finance & Contract Boundary; Quality, Risk & Compliance Routes; Human Decision Queue; Agent Registry & Kill; History; Pause All; Safe Reset; Correct; Export; Delete; Rollback; Remove Power; Remove Overlay; Full Uninstall.

## Human administrator standard

The administrator remains responsible for their analysis, communication, recommendations and leadership. Boards, owners, executives, medical staff, clinicians, HR, labor, finance, revenue cycle, compliance, privacy, security, legal, procurement, quality, accreditation, research, emergency management and community authorities retain their respective decisions. The OS prepares, explains, organizes, compares, rehearses and checks. It never grants authority, releases a decision, creates an official record or substitutes for the accountable human and official system.
