VIGIL

Identity, authority and settlement for clinical operations. The records stay in the EHR, on purpose.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Hospital group operations. Scheduling and logistics agents with declared authority ceilings.
• Locum and staffing agency. Escrowed shifts, presence-signed approvals above threshold.
• Medical logistics. Cold-chain attestations without ever touching a patient record.
• Claims clearing. An authority snapshot on every automated claim file.

The problem

Hospitals want autonomous scheduling, logistics and claims agents, and cannot deploy them, because nobody can say precisely what such an agent is allowed to do, who is liable when it acts, and how to switch one off in seconds. The blocker is not intelligence. It is authority.

The system

VIGIL is the operations layer of a hospital group: scheduling agents that fill theatre slots, logistics agents that keep consumables ahead of demand, claims agents that assemble reimbursement files. Every one of them holds a scoped identity, a bounded budget, and an authority ceiling a human declared. Escalations above the ceiling reach a named clinician whose presence signs, and a compromised agent is revocable in under half a second.

When a scheduling agent misbehaves, the response is not a meeting. Its ceiling is re-derived on the very request, so an action above it never reaches money without a presence-signed mandate, and one coordinated action ends the identity itself in under half a second. Every request it ever made sits on the ledger with an authority snapshot, which is what the incident review reads instead of reconstructing.

The load-bearing sentence is the one about what VIGIL does not carry: no clinical records, no diagnoses, no patient data of any kind. The protocol moves identity, authority and money. The EHR stays the EHR, and that boundary is the design, not a limitation of it.

The cast and their ceilings

The flow, step by step

1. The rostering system shows a theatre gap. The protocol reads; it never writes.
2. The scheduling agent moves to book a locum. Its ceiling is re-derived on this very request.
3. The shift is above the ceiling, so a named clinician’s presence-signed mandate stands behind it.
4. The shift escrows. The agency watches the money exist before anyone travels.
5. The shift is worked; settlement crosses frames exactly once.
6. Every event lands with an authority snapshot. No patient record exists on this path, by design.

Each need, mapped to a live primitive

The attack this chamber refuses: The stolen scheduler

The attack. An attacker takes the scheduling agent’s credentials at 02:00 and tries to escrow a week of phantom locum shifts, each priced just under what a human would glance at.

Why it fails. The ceiling is not a cached property of the agent; it is re-derived on the very request, and above it nothing proceeds without a presence-signed mandate from a named clinician. The phantom shifts never reach escrow, and coordinated suspension ends the stolen identity in under half a second: mTLS revoked, account suspended, cross-frame receipt blocklisted, one action.

What actually happens. No money moved and no shift ever existed. The ledger keeps every denied attempt with an authority snapshot, which is exactly the evidence the incident review wants.

Deep architecture

VIGIL deployed: the hospital group runs identity, authority and settlement on its own frame; staffing agencies and vendors act from theirs; and the clinical estate sits underneath on the read-side of a boundary that is the design, not a limitation of it. No patient record appears anywhere in this drawing, which is the point of the drawing. The trace replays one locum shift, roster gap to settlement.

The deployment, traced

1. The rostering system shows Thursday’s theatre gaps. The protocol reads; it does not touch.
2. The scheduling agent moves to fill a locum shift. Its ceiling is checked on this very request.
3. The shift is above the ceiling, so a named clinician’s mandate stands behind it, presence-signed.
4. The shift escrows. The agency watches the money exist before anyone travels.
5. Every action lands with an authority snapshot: who could do what, at that moment, provably.
6. The shift settles across frames with an idempotency key.
7. The agency’s frame credits exactly once.
8. The agency assigns locum-347. The reputation travelled with the DID, not with a PDF CV.
9. Their ledger writes the same shift. Two organisations, one record.
10. Meanwhile logistics keeps consumables ahead of demand, inside a budget a human declared.
11. And the EHR? It was read, never written. No patient record exists on this drawing, by design.

Adoption, phase by phase

Discover: Draw the ceilings before any agent exists.

• Runs. Nothing in the estate. The authority model on paper: which roles, which ceilings, which escalations reach a named clinician.
• Agents. None. Operations and clinical governance argue about the ceilings, which is the productive argument.
• Integrates. Nothing. The EHR and the rostering system are untouched.
• Deliberately not yet. No agent acts. Nothing settles.
• Proof that gates the next phase. One month of historical scheduling decisions re-told as ceiling checks, and governance agrees where every escalation would have landed.

Pilot: One ward’s scheduling, ceilings live.

• Runs. A group-run registry seat, single VM. Read-side connectors to the roster only.
• Agents. One scheduling agent under declared ceilings; a named clinician holds the mandate; revocation is drilled weekly.
• Integrates. The rostering system, read-side. The EHR is not connected, and that is asserted, not assumed.
• Deliberately not yet. No money moves to external parties. Locum settlement is simulated against escrow.
• Proof that gates the next phase. A month of pilot scheduling in which every action carries an authority snapshot and zero writes ever reached a clinical system.

Production: Shifts settle for real; the boundary holds.

• Runs. The group’s frame: registry, TEG, EventStore, identity fabric. About nine containers, no PHI in any of them.
• Agents. Scheduling, logistics and claims roles under IRONKEY ceilings; escalations presence-signed; agents revocable in under a second.
• Integrates. Roster and procurement read-side; staffing agencies federate bilaterally; claims files carry authority snapshots.
• Deliberately not yet. Only contracted agencies are peers. Open marketplace staffing is a policy decision, not a technical step.
• Proof that gates the next phase. An external review samples the ledger and finds an authority snapshot behind every action and no clinical data anywhere, because there is none to find.

Federation: Agencies and vendors as peers.

• Runs. Unchanged. Each agency connects its registry or seat.
• Agents. Locum reputations travel with DIDs; vendor settlement rides milestone contracts.
• Integrates. Each new agency is a signed card and a license, not a portal login.
• Deliberately not yet. Nothing structural. Growth is corridors and ceilings.
• Proof that gates the next phase. A locum staffed from a new agency works one shift with escrowed settlement and zero bilateral integration work.

Sizing

One escalated shift, gap to settlement

sequenceDiagram
  participant Ros as roster (read-side)
  participant Sch as scheduling-agent
  participant Gate as authority gate
  participant Doc as named clinician
  participant TEG as shift escrow
  participant XT as cross-registry pay
  participant Agy as agency (their frame)
  Ros-->>Sch: theatre gap, read only
  Sch->>Gate: fill shift (ceiling check)
  Gate->>Doc: above ceiling: mandate required
  Doc-->>Gate: presence-signed approval
  Gate-->>Sch: clamped approval
  Sch->>TEG: escrow the shift
  TEG->>XT: settle (idempotency key)
  XT->>Agy: agency credited, exactly once
  Note over Gate,TEG: every event carries an authority snapshot; no PHI exists on this path

Topology, as declared

flowchart LR
  Ros["rostering system<br/>read-side only"] -.->|"theatre gap"| S["scheduling-agent"]
  S -->|"book shift (ceiling re-derived)"| G{"authority gate"}
  Doc["named clinician"] -.->|"presence-signed mandate"| G
  G -->|"within mandate"| E["shift escrow"]
  E -->|"worked, settle exactly once"| X["cross-registry pay"]
  X --> L[("event ledger<br/>authority snapshots")]

Standing it up

• Infrastructure. A group-run registry, federated with vendors bilaterally.
• Agents. Scheduling, logistics and claims roles; the ceilings are the design work.
• Integration. The EHR and the rostering system, read-side only. That boundary is deliberate.

What this does not claim

• VIGIL stores and processes no clinical records and no patient data. That is the headline, not a footnote.
• No assertion of conformance with any health-data regulation; the protocol never sees the data such regulation governs.