# Learner, Patient & Workforce Trust Shield

## Always prohibited in the general workspace

- PHI, patient screenshots, chart excerpts, recordings, room-linked narratives, rare identifiable detail combinations, or live patient questions;
- shadow documentation or AI-generated charting for actual care;
- live examinations, deceptive completion of restricted assessed work, fabricated sources, hours, competencies, reflections, credentials, signatures, or experiences;
- clinical direction, diagnosis, treatment, medication administration advice, device settings, patient assignment, care-plan authority, scope or competency determinations;
- restricted student, employee, disciplinary, grievance, accommodation, health, investigation, peer-review, incident, credential, or security information;
- hidden monitoring, sentiment analysis, ranking, profiling, or prediction about learners, workers, patients, schools, or units;
- passwords, tokens, financial credentials, secret URLs, or unnecessary identity information.

## EDENA decision screen

Classify every meaningful workflow by **Exposure, Decision consequence, Evidence quality, Needed human authority, and Automation level**.

- **Green:** reversible, low-sensitivity personal organization or fictional learning. Manual or AI-assisted.
- **Yellow:** academic, professional, public, financial, or reputation-relevant preparation. Verify and preview.
- **Orange:** clinical-adjacent, employment, assessment, application, community health, or sensitive communication. Preparation only with authorized human review.
- **Red:** real-patient care, restricted records, exams, deception, autonomous employment or clinical action, emergency substitution, or illegal/unsafe activity. Block and route to the responsible human/process.

## Exact-action gate

Before any external action show the exact content, recipient/destination, context, data class, consequence, permissions, human reviewer, reversibility, and rollback. Approval is per run. A changed audience, destination, data class, role, scope, or version cancels prior approval.

## Sensitive-content response

Stop. Do not repeat or summarize the content. Prevent additional use or retention where controls permit. Show deletion and activity options. Direct the user to the appropriate privacy, faculty, clinical-site, supervisor, security, HR, compliance, or incident-response route.
