content/engineering/reference/security.html

<article aria-hidden="true" class="doc" id="doc-reference-security">
<div class="strip"><span class="path">reference/security.md</span></div>
<h1>15. Security Architecture</h1>
<p style="font-size:15px;color:var(--slate);margin-bottom:28px;max-width:700px;line-height:1.6;">
The security architecture the MVP build implements, covering network topology, data protection, threat model, access controls, and the assurance roadmap. Written to support hospital IT security reviews and investor diligence; anything marked planned is a commitment with a gate, not a completed certification.
</p>

<!-- ── SECURITY ARCHITECTURE SVG ─────────────────────────────────────────── -->
<div style="width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch;">
<svg viewBox="0 0 960 640" xmlns="http://www.w3.org/2000/svg"
     style="width:100%;min-width:640px;max-width:960px;display:block;margin:0 auto;font-family:'Inter',sans-serif;">
  <defs>
    <marker id="sec-arr" markerWidth="8" markerHeight="8" refX="7" refY="3.5" orient="auto">
      <path d="M0,0 L0,7 L8,3.5 Z" fill="#0ea5e9"/>
    </marker>
    <marker id="sec-arr-red" markerWidth="8" markerHeight="8" refX="7" refY="3.5" orient="auto">
      <path d="M0,0 L0,7 L8,3.5 Z" fill="#f87171"/>
    </marker>
    <marker id="sec-arr-green" markerWidth="8" markerHeight="8" refX="7" refY="3.5" orient="auto">
      <path d="M0,0 L0,7 L8,3.5 Z" fill="#10b981"/>
    </marker>
    <filter id="sec-shadow">
      <feDropShadow dx="0" dy="2" stdDeviation="3" flood-color="rgba(0,0,0,0.3)"/>
    </filter>
    <linearGradient id="sec-bg" x1="0" y1="0" x2="0" y2="1">
      <stop offset="0%" stop-color="#0b1628"/><stop offset="100%" stop-color="#0d2340"/>
    </linearGradient>
  </defs>
  <rect width="960" height="640" rx="16" fill="url(#sec-bg)"/>

  <!-- Title -->
  <text x="480" y="34" text-anchor="middle" font-size="11" font-weight="700" letter-spacing="0.14em" fill="#22d3ee">TRAVI AI AGENT · SECURITY</text>
  <text x="480" y="56" text-anchor="middle" font-size="17" font-weight="800" fill="#f0f6ff">Network &amp; Security Architecture</text>

  <!-- ── INTERNET ZONE ── -->
  <rect x="20" y="76" width="130" height="200" rx="10" fill="rgba(239,68,68,0.06)" stroke="rgba(239,68,68,0.3)" stroke-width="1.5" stroke-dasharray="5,4"/>
  <text x="85" y="96" text-anchor="middle" font-size="9.5" font-weight="700" letter-spacing="0.1em" fill="#f87171">INTERNET</text>
  <rect x="32" y="106" width="106" height="40" rx="7" fill="rgba(15,23,42,0.8)" stroke="#334155" stroke-width="1"/>
  <text x="85" y="121" text-anchor="middle" font-size="18"></text>
  <text x="85" y="139" text-anchor="middle" font-size="10" fill="#94a3b8">Hospital EHR</text>
  <rect x="32" y="156" width="106" height="40" rx="7" fill="rgba(15,23,42,0.8)" stroke="#334155" stroke-width="1"/>
  <text x="85" y="171" text-anchor="middle" font-size="18"></text>
  <text x="85" y="189" text-anchor="middle" font-size="10" fill="#94a3b8">Patient PWA + SMS</text>
  <rect x="32" y="206" width="106" height="40" rx="7" fill="rgba(15,23,42,0.8)" stroke="#334155" stroke-width="1"/>
  <text x="85" y="221" text-anchor="middle" font-size="18">🖥️</text>
  <text x="85" y="239" text-anchor="middle" font-size="10" fill="#94a3b8">Clinician UI</text>

  <!-- ── WAF + CDN ── -->
  <rect x="175" y="100" width="110" height="152" rx="10" fill="rgba(239,68,68,0.08)" stroke="#ef4444" stroke-width="1.5" filter="url(#sec-shadow)"/>
  <text x="230" y="120" text-anchor="middle" font-size="9.5" font-weight="700" letter-spacing="0.08em" fill="#f87171">PERIMETER</text>
  <text x="230" y="148" text-anchor="middle" font-size="22">🛡️</text>
  <text x="230" y="168" text-anchor="middle" font-size="11" font-weight="700" fill="#f0f6ff">WAF</text>
  <text x="230" y="182" text-anchor="middle" font-size="9.5" fill="#64748b">AWS Shield + CloudFront</text>
  <line x1="230" y1="190" x2="230" y2="200" stroke="rgba(255,255,255,0.1)" stroke-width="1"/>
  <text x="230" y="218" text-anchor="middle" font-size="18"></text>
  <text x="230" y="236" text-anchor="middle" font-size="10" fill="#94a3b8">CDN / DDoS</text>
  <text x="230" y="248" text-anchor="middle" font-size="9.5" fill="#64748b">TLS 1.3 enforced</text>

  <!-- Arrows: Internet → WAF -->
  <line x1="150" y1="126" x2="170" y2="150" stroke="#ef4444" stroke-width="1.5" marker-end="url(#sec-arr-red)"/>
  <line x1="150" y1="176" x2="170" y2="170" stroke="#ef4444" stroke-width="1.5" marker-end="url(#sec-arr-red)"/>
  <line x1="150" y1="226" x2="170" y2="190" stroke="#ef4444" stroke-width="1.5" marker-end="url(#sec-arr-red)"/>

  <!-- ── AWS VPC ── -->
  <rect x="310" y="76" width="630" height="480" rx="12" fill="rgba(14,165,233,0.04)" stroke="rgba(14,165,233,0.2)" stroke-width="1.5" stroke-dasharray="6,4"/>
  <text x="625" y="96" text-anchor="middle" font-size="10" font-weight="700" letter-spacing="0.1em" fill="#38bdf8">AWS VPC: us-east-1</text>

  <!-- Public Subnet -->
  <rect x="322" y="106" width="180" height="180" rx="10" fill="rgba(14,165,233,0.06)" stroke="rgba(14,165,233,0.2)" stroke-width="1" stroke-dasharray="4,3"/>
  <text x="412" y="124" text-anchor="middle" font-size="9" font-weight="700" letter-spacing="0.1em" fill="rgba(56,189,248,0.7)">PUBLIC SUBNET</text>
  <!-- API Gateway -->
  <rect x="334" y="132" width="156" height="50" rx="8" fill="rgba(15,23,42,0.9)" stroke="#0ea5e9" stroke-width="1.5" filter="url(#sec-shadow)"/>
  <text x="412" y="152" text-anchor="middle" font-size="18">🚪</text>
  <text x="412" y="170" text-anchor="middle" font-size="11" font-weight="700" fill="#f0f6ff">API Gateway</text>
  <text x="412" y="182" text-anchor="middle" font-size="9.5" fill="#64748b">Rate limit · JWT auth</text>
  <!-- Load Balancer -->
  <rect x="334" y="196" width="156" height="50" rx="8" fill="rgba(15,23,42,0.9)" stroke="#0ea5e9" stroke-width="1" filter="url(#sec-shadow)"/>
  <text x="412" y="216" text-anchor="middle" font-size="18">⚖️</text>
  <text x="412" y="234" text-anchor="middle" font-size="11" font-weight="700" fill="#f0f6ff">ALB</text>
  <text x="412" y="246" text-anchor="middle" font-size="9.5" fill="#64748b">Application Load Balancer</text>

  <!-- Private Subnet -->
  <rect x="522" y="106" width="400" height="180" rx="10" fill="rgba(16,185,129,0.04)" stroke="rgba(16,185,129,0.2)" stroke-width="1" stroke-dasharray="4,3"/>
  <text x="722" y="124" text-anchor="middle" font-size="9" font-weight="700" letter-spacing="0.1em" fill="rgba(52,211,153,0.7)">PRIVATE SUBNET: no public IPs</text>
  <!-- App Servers -->
  <rect x="534" y="132" width="120" height="50" rx="8" fill="rgba(15,23,42,0.9)" stroke="#14b8a6" stroke-width="1.5" filter="url(#sec-shadow)"/>
  <text x="594" y="152" text-anchor="middle" font-size="18"></text>
  <text x="594" y="170" text-anchor="middle" font-size="11" font-weight="700" fill="#f0f6ff">App Servers</text>
  <text x="594" y="182" text-anchor="middle" font-size="9.5" fill="#64748b">ECS Fargate</text>
  <!-- AI Workers -->
  <rect x="670" y="132" width="120" height="50" rx="8" fill="rgba(15,23,42,0.9)" stroke="#14b8a6" stroke-width="1.5" filter="url(#sec-shadow)"/>
  <text x="730" y="152" text-anchor="middle" font-size="18">🧠</text>
  <text x="730" y="170" text-anchor="middle" font-size="11" font-weight="700" fill="#f0f6ff">AI Workers</text>
  <text x="730" y="182" text-anchor="middle" font-size="9.5" fill="#64748b">Celery on ECS · async</text>
  <!-- Audit Service -->
  <rect x="806" y="132" width="106" height="50" rx="8" fill="rgba(15,23,42,0.9)" stroke="#14b8a6" stroke-width="1" filter="url(#sec-shadow)"/>
  <text x="859" y="152" text-anchor="middle" font-size="18">📜</text>
  <text x="859" y="170" text-anchor="middle" font-size="11" font-weight="700" fill="#f0f6ff">Audit Svc</text>
  <text x="859" y="182" text-anchor="middle" font-size="9.5" fill="#64748b">CloudTrail</text>

  <!-- Data Subnet -->
  <rect x="322" y="306" width="600" height="230" rx="10" fill="rgba(139,92,246,0.04)" stroke="rgba(139,92,246,0.2)" stroke-width="1" stroke-dasharray="4,3"/>
  <text x="622" y="324" text-anchor="middle" font-size="9" font-weight="700" letter-spacing="0.1em" fill="rgba(167,139,250,0.7)">DATA SUBNET: encrypted at rest (AES-256)</text>
  <!-- PHI Vault -->
  <rect x="334" y="334" width="130" height="60" rx="8" fill="rgba(15,23,42,0.9)" stroke="#ef4444" stroke-width="1.5" filter="url(#sec-shadow)"/>
  <text x="399" y="355" text-anchor="middle" font-size="18"></text>
  <text x="399" y="374" text-anchor="middle" font-size="11" font-weight="700" fill="#f0f6ff">PHI Vault</text>
  <text x="399" y="386" text-anchor="middle" font-size="9.5" fill="#64748b">RDS · field-level enc.</text>
  <!-- Outcome DB -->
  <rect x="480" y="334" width="130" height="60" rx="8" fill="rgba(15,23,42,0.9)" stroke="#a78bfa" stroke-width="1.5" filter="url(#sec-shadow)"/>
  <text x="545" y="355" text-anchor="middle" font-size="18">🗄️</text>
  <text x="545" y="374" text-anchor="middle" font-size="11" font-weight="700" fill="#f0f6ff">Outcome DB</text>
  <text x="545" y="386" text-anchor="middle" font-size="9.5" fill="#64748b">PostgreSQL · de-id</text>
  <!-- Secrets Manager -->
  <rect x="626" y="334" width="130" height="60" rx="8" fill="rgba(15,23,42,0.9)" stroke="#a78bfa" stroke-width="1" filter="url(#sec-shadow)"/>
  <text x="691" y="355" text-anchor="middle" font-size="18">🗝️</text>
  <text x="691" y="374" text-anchor="middle" font-size="11" font-weight="700" fill="#f0f6ff">Secrets Mgr</text>
  <text x="691" y="386" text-anchor="middle" font-size="9.5" fill="#64748b">AWS KMS · rotation</text>
  <!-- S3 Audit Logs -->
  <rect x="772" y="334" width="130" height="60" rx="8" fill="rgba(15,23,42,0.9)" stroke="#a78bfa" stroke-width="1" filter="url(#sec-shadow)"/>
  <text x="837" y="355" text-anchor="middle" font-size="18">🪣</text>
  <text x="837" y="374" text-anchor="middle" font-size="11" font-weight="700" fill="#f0f6ff">S3 Audit Logs</text>
  <text x="837" y="386" text-anchor="middle" font-size="9.5" fill="#64748b">Immutable · Glacier</text>
  <!-- Backup -->
  <rect x="334" y="410" width="568" height="50" rx="8" fill="rgba(15,23,42,0.7)" stroke="rgba(255,255,255,0.08)" stroke-width="1"/>
  <text x="618" y="430" text-anchor="middle" font-size="10" fill="#64748b">  Automated daily backups · Cross-region replication (us-west-2) · RTO &lt; 4 h · RPO 15 min (PITR)</text>
  <text x="618" y="450" text-anchor="middle" font-size="10" fill="#64748b">  All data encrypted in transit (TLS 1.3) and at rest (AES-256) · KMS key rotation every 90 days</text>

  <!-- Arrows inside VPC -->
  <line x1="490" y1="182" x2="490" y2="196" stroke="#0ea5e9" stroke-width="1.5" marker-end="url(#sec-arr)"/>
  <line x1="490" y1="246" x2="594" y2="246" stroke="#0ea5e9" stroke-width="1" stroke-dasharray="3,3"/>
  <line x1="594" y1="246" x2="594" y2="132" stroke="#0ea5e9" stroke-width="1" stroke-dasharray="3,3" marker-end="url(#sec-arr)"/>
  <line x1="594" y1="182" x2="670" y2="182" stroke="#14b8a6" stroke-width="1" stroke-dasharray="3,3" marker-end="url(#sec-arr)"/>
  <line x1="594" y1="182" x2="594" y2="334" stroke="#a78bfa" stroke-width="1" stroke-dasharray="3,3" marker-end="url(#sec-arr)"/>
  <line x1="730" y1="182" x2="730" y2="334" stroke="#a78bfa" stroke-width="1" stroke-dasharray="3,3" marker-end="url(#sec-arr)"/>

  <!-- WAF → API Gateway -->
  <line x1="285" y1="157" x2="330" y2="157" stroke="#0ea5e9" stroke-width="2" marker-end="url(#sec-arr)"/>

  <!-- Compliance badges row -->
  <rect x="322" y="472" width="600" height="72" rx="10" fill="rgba(255,255,255,0.02)" stroke="rgba(255,255,255,0.06)" stroke-width="1"/>
  <text x="622" y="490" text-anchor="middle" font-size="9.5" font-weight="700" letter-spacing="0.1em" fill="rgba(148,163,184,0.6)">COMPLIANCE &amp; CERTIFICATIONS</text>
  <!-- Badges -->
  <rect x="334" y="498" width="88" height="36" rx="6" fill="rgba(239,68,68,0.1)" stroke="#ef4444" stroke-width="0.5"/>
  <text x="378" y="514" text-anchor="middle" font-size="10" font-weight="700" fill="#f87171">HIPAA</text>
  <text x="378" y="528" text-anchor="middle" font-size="9" fill="#94a3b8">BAA-first design</text>
  <rect x="432" y="498" width="88" height="36" rx="6" fill="rgba(14,165,233,0.1)" stroke="#0ea5e9" stroke-width="0.5"/>
  <text x="476" y="514" text-anchor="middle" font-size="10" font-weight="700" fill="#38bdf8">SOC 2 T1</text>
  <text x="476" y="528" text-anchor="middle" font-size="9" fill="#94a3b8">Planned, month 7–9</text>
  <rect x="530" y="498" width="88" height="36" rx="6" fill="rgba(16,185,129,0.1)" stroke="#10b981" stroke-width="0.5"/>
  <text x="574" y="514" text-anchor="middle" font-size="10" font-weight="700" fill="#34d399">FHIR R4</text>
  <text x="574" y="528" text-anchor="middle" font-size="9" fill="#94a3b8">Native R4 reads</text>
  <rect x="628" y="498" width="88" height="36" rx="6" fill="rgba(139,92,246,0.1)" stroke="#a78bfa" stroke-width="0.5"/>
  <text x="672" y="514" text-anchor="middle" font-size="10" font-weight="700" fill="#c4b5fd">SMART</text>
  <text x="672" y="528" text-anchor="middle" font-size="9" fill="#94a3b8">on FHIR</text>
  <rect x="726" y="498" width="88" height="36" rx="6" fill="rgba(245,158,11,0.1)" stroke="#f59e0b" stroke-width="0.5"/>
  <text x="770" y="514" text-anchor="middle" font-size="10" font-weight="700" fill="#fbbf24">Pen Test</text>
  <text x="770" y="528" text-anchor="middle" font-size="9" fill="#94a3b8">Pre-pilot gate</text>
  <rect x="824" y="498" width="88" height="36" rx="6" fill="rgba(255,255,255,0.04)" stroke="rgba(255,255,255,0.1)" stroke-width="0.5"/>
  <text x="868" y="514" text-anchor="middle" font-size="10" font-weight="700" fill="#94a3b8">GDPR</text>
  <text x="868" y="528" text-anchor="middle" font-size="9" fill="#64748b">Out of scope (US MVP)</text>

  <!-- Legend -->
  <rect x="20" y="580" width="920" height="46" rx="8" fill="rgba(255,255,255,0.02)" stroke="rgba(255,255,255,0.05)" stroke-width="1"/>
  <rect x="36" y="596" width="12" height="12" rx="2" fill="rgba(239,68,68,0.3)" stroke="#ef4444" stroke-width="0.5"/>
  <text x="54" y="607" font-size="9.5" fill="#94a3b8">Untrusted / internet zone</text>
  <rect x="180" y="596" width="12" height="12" rx="2" fill="rgba(14,165,233,0.2)" stroke="#0ea5e9" stroke-width="0.5"/>
  <text x="198" y="607" font-size="9.5" fill="#94a3b8">Public subnet</text>
  <rect x="300" y="596" width="12" height="12" rx="2" fill="rgba(16,185,129,0.2)" stroke="#10b981" stroke-width="0.5"/>
  <text x="318" y="607" font-size="9.5" fill="#94a3b8">Private subnet (no public IP)</text>
  <rect x="490" y="596" width="12" height="12" rx="2" fill="rgba(139,92,246,0.2)" stroke="#a78bfa" stroke-width="0.5"/>
  <text x="508" y="607" font-size="9.5" fill="#94a3b8">Data subnet (encrypted at rest)</text>
  <line x1="700" y1="602" x2="724" y2="602" stroke="#ef4444" stroke-width="1.5" marker-end="url(#sec-arr-red)"/>
  <text x="730" y="607" font-size="9.5" fill="#94a3b8">Untrusted traffic</text>
  <line x1="820" y1="602" x2="844" y2="602" stroke="#0ea5e9" stroke-width="1.5" marker-end="url(#sec-arr)"/>
  <text x="850" y="607" font-size="9.5" fill="#94a3b8">Internal traffic</text>
</svg>
</div>

<!-- ── THREAT MODEL ─────────────────────────────────────────────────────────── -->
<h2 id="threat-model" style="margin-top:36px;">15.1 Platform Threat Overview (likelihood &amp; control status)</h2>
<p style="font-size:12.5px;color:var(--slate);margin:0 0 6px;">Status reads DESIGNED-IN where the control is specified in the MVP build (phases 01–14) and enforced by its definition of done; nothing on this page claims a completed external audit.</p>
<div style="overflow-x:auto;-webkit-overflow-scrolling:touch;margin:16px 0 28px;">
<table style="width:100%;border-collapse:collapse;min-width:600px;">
<thead>
<tr style="background:var(--surface);border-bottom:2px solid var(--border);">
<th style="padding:10px 14px;text-align:left;font-size:11px;letter-spacing:.08em;text-transform:uppercase;color:var(--slate);">Threat</th>
<th style="padding:10px 14px;text-align:left;font-size:11px;letter-spacing:.08em;text-transform:uppercase;color:var(--slate);">Likelihood</th>
<th style="padding:10px 14px;text-align:left;font-size:11px;letter-spacing:.08em;text-transform:uppercase;color:var(--slate);">Control</th>
<th style="padding:10px 14px;text-align:left;font-size:11px;letter-spacing:.08em;text-transform:uppercase;color:var(--slate);">Status</th>
</tr>
</thead>
<tbody>
<tr style="border-bottom:1px solid var(--border);">
<td style="padding:10px 14px;font-size:13px;font-weight:600;color:var(--ink);">PHI data breach</td>
<td style="padding:10px 14px;"><span style="background:rgba(239,68,68,0.12);color:#f87171;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">HIGH</span></td>
<td style="padding:10px 14px;font-size:13px;color:var(--slate);">AES-256 field-level encryption, PHI vault isolation, no PHI in logs, BAA with all vendors</td>
<td style="padding:10px 14px;"><span style="background:rgba(16,185,129,0.12);color:#34d399;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">DESIGNED-IN</span></td>
</tr>
<tr style="border-bottom:1px solid var(--border);background:rgba(255,255,255,0.015);">
<td style="padding:10px 14px;font-size:13px;font-weight:600;color:var(--ink);">API injection / SSRF</td>
<td style="padding:10px 14px;"><span style="background:rgba(245,158,11,0.12);color:#fbbf24;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">MEDIUM</span></td>
<td style="padding:10px 14px;font-size:13px;color:var(--slate);">WAF with OWASP ruleset, input validation at API Gateway, parameterized queries, SSRF blocklist</td>
<td style="padding:10px 14px;"><span style="background:rgba(16,185,129,0.12);color:#34d399;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">DESIGNED-IN</span></td>
</tr>
<tr style="border-bottom:1px solid var(--border);">
<td style="padding:10px 14px;font-size:13px;font-weight:600;color:var(--ink);">LLM prompt injection</td>
<td style="padding:10px 14px;"><span style="background:rgba(245,158,11,0.12);color:#fbbf24;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">MEDIUM</span></td>
<td style="padding:10px 14px;font-size:13px;color:var(--slate);">Structured output schema enforcement, 7-gate post-processing validation, human review flag for anomalous outputs</td>
<td style="padding:10px 14px;"><span style="background:rgba(16,185,129,0.12);color:#34d399;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">DESIGNED-IN</span></td>
</tr>
<tr style="border-bottom:1px solid var(--border);background:rgba(255,255,255,0.015);">
<td style="padding:10px 14px;font-size:13px;font-weight:600;color:var(--ink);">Credential compromise</td>
<td style="padding:10px 14px;"><span style="background:rgba(245,158,11,0.12);color:#fbbf24;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">MEDIUM</span></td>
<td style="padding:10px 14px;font-size:13px;color:var(--slate);">AWS Secrets Manager with auto-rotation, no hardcoded secrets, MFA enforced for all admin access, least-privilege IAM</td>
<td style="padding:10px 14px;"><span style="background:rgba(16,185,129,0.12);color:#34d399;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">DESIGNED-IN</span></td>
</tr>
<tr style="border-bottom:1px solid var(--border);">
<td style="padding:10px 14px;font-size:13px;font-weight:600;color:var(--ink);">DDoS / availability</td>
<td style="padding:10px 14px;"><span style="background:rgba(14,165,233,0.12);color:#38bdf8;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">LOW</span></td>
<td style="padding:10px 14px;font-size:13px;color:var(--slate);">AWS Shield Standard + Advanced, CloudFront CDN, auto-scaling ECS Fargate, rate limiting at API Gateway</td>
<td style="padding:10px 14px;"><span style="background:rgba(16,185,129,0.12);color:#34d399;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">DESIGNED-IN</span></td>
</tr>
<tr style="border-bottom:1px solid var(--border);background:rgba(255,255,255,0.015);">
<td style="padding:10px 14px;font-size:13px;font-weight:600;color:var(--ink);">Insider threat</td>
<td style="padding:10px 14px;"><span style="background:rgba(14,165,233,0.12);color:#38bdf8;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">LOW</span></td>
<td style="padding:10px 14px;font-size:13px;color:var(--slate);">Role-based access control, immutable audit log, no single person can access PHI vault + audit logs simultaneously, background checks</td>
<td style="padding:10px 14px;"><span style="background:rgba(16,185,129,0.12);color:#34d399;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">DESIGNED-IN</span></td>
</tr>
<tr>
<td style="padding:10px 14px;font-size:13px;font-weight:600;color:var(--ink);">Third-party vendor breach</td>
<td style="padding:10px 14px;"><span style="background:rgba(245,158,11,0.12);color:#fbbf24;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">MEDIUM</span></td>
<td style="padding:10px 14px;font-size:13px;color:var(--slate);">BAA with every PHI-touching vendor (AWS including Bedrock with zero-retention inference, Twilio), annual vendor security review, data minimization, non-BAA vendors receive no PHI</td>
<td style="padding:10px 14px;"><span style="background:rgba(245,158,11,0.12);color:#fbbf24;font-size:11px;font-weight:700;padding:2px 8px;border-radius:4px;">PLANNED</span></td>
</tr>
</tbody>
</table>
</div>

<!-- ── ACCESS CONTROL ──────────────────────────────────────────────────────── -->

<h2 id="doc-reference-security--h1">15.2 Review Threats → Controls (all 13)</h2>
<div class="tbl-wrap"><table class="col-table compact" style="table-layout:fixed;"><colgroup><col class="col-auto" style="width:200px"/><col class="col-lg" style="width:auto"/></colgroup>
<thead>
<tr>
<th>Threat</th>
<th>Primary Controls (sections)</th>
</tr>
</thead>
<tbody>
<tr>
<td data-label="Threat">1 Activation-link interception</td>
<td data-label="Primary Controls (sections)">Single-use 72 h token, zero-PHI pre-verify, DOB+possession, lockout, WAF rate limit (§9.1).</td>
</tr>
<tr>
<td data-label="Threat">2 Clinician link forwarding</td>
<td data-label="Primary Controls (sections)">Device-bound grants, OTP on new device, geo/device anomaly re-challenge, short expiry (§9.3).</td>
</tr>
<tr>
<td data-label="Threat">3 Cross-tenant access</td>
<td data-label="Primary Controls (sections)">tenant_id on every row + session filter + composite indexes; authz object checks; pen-test case.</td>
</tr>
<tr>
<td data-label="Threat">4 Excessive employee access</td>
<td data-label="Primary Controls (sections)">Break-glass only, time-boxed, dual-notified, fully audited; quarterly access reviews (§9.4).</td>
</tr>
<tr>
<td data-label="Threat">5 Prompt injection in documents</td>
<td data-label="Primary Controls (sections)">Data/instruction separation, offset entailment, GS-12 gate, sandboxed drafting (§11.5).</td>
</tr>
<tr>
<td data-label="Threat">6 Agent overreach</td>
<td data-label="Primary Controls (sections)">Policy envelopes, tool allowlists, evidence-not-state pattern, kill switches (§12).</td>
</tr>
<tr>
<td data-label="Threat">7 Model data leakage</td>
<td data-label="Primary Controls (sections)">Bedrock BAA + zero retention, no PHI in third-party telemetry, registry-pinned models (§9.6, 11.6).</td>
</tr>
<tr>
<td data-label="Threat">8 SMS disclosure</td>
<td data-label="Primary Controls (sections)">No-PHI payload rule + CI template lint; lock-screen-safe copy (§13.2).</td>
</tr>
<tr>
<td data-label="Threat">9 Tampered source documents</td>
<td data-label="Primary Controls (sections)">Fingerprints, signed VPN/mTLS channel, finality checks, provenance immutability (§10).</td>
</tr>
<tr>
<td data-label="Threat">10 Audit-log alteration</td>
<td data-label="Primary Controls (sections)">INSERT-only DB role, monthly partitions, S3 Object-Lock compliance archive (§6.4, ADR-018).</td>
</tr>
<tr>
<td data-label="Threat">11 Ransomware / data loss</td>
<td data-label="Primary Controls (sections)">PITR, cross-AZ, versioned KMS buckets, quarterly restore drills, IaC rebuild (§5.4).</td>
</tr>
<tr>
<td data-label="Threat">12 Vendor compromise</td>
<td data-label="Primary Controls (sections)">BAA inventory (AWS, Twilio, Sentry-scrubbed), least-scope API keys, 90-day rotation, vendor review in Phase 0.</td>
</tr>
<tr>
<td data-label="Threat">13 Enumeration via recovery</td>
<td data-label="Primary Controls (sections)">Uniform failure responses, silent lockouts, ops alerting (§9.1).</td>
</tr>
</tbody>
</table></div>

<h2 id="access-control" style="margin-top:8px;">15.3 Access Control Model</h2>
<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:12px;margin:16px 0 28px;">
<div style="background:var(--surface);border:1px solid var(--border);border-left:3px solid #0ea5e9;border-radius:8px;padding:12px 14px;">
<div style="font-size:10px;font-weight:700;color:#38bdf8;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px;">Patient</div>
<p style="font-size:12.5px;color:var(--slate);line-height:1.5;margin:0;">SMS link opens the Today PWA: no app store, no password, DOB verification, single-use 72 h token. No PHI in the SMS payload itself; consent captured in the verified session.</p>
</div>
<div style="background:var(--surface);border:1px solid var(--border);border-left:3px solid #14b8a6;border-radius:8px;padding:12px 14px;">
<div style="font-size:10px;font-weight:700;color:#2dd4bf;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px;">Care Coordinator</div>
<p style="font-size:12.5px;color:var(--slate);line-height:1.5;margin:0;">Clinical review console with MFA. Cohort-scoped read access and review-queue actions only; no direct database access. Hospital IdP SSO (SAML 2.0) on the enterprise roadmap.</p>
</div>
<div style="background:var(--surface);border:1px solid var(--border);border-left:3px solid #f59e0b;border-radius:8px;padding:12px 14px;">
<div style="font-size:10px;font-weight:700;color:#fbbf24;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px;">Physician</div>
<p style="font-size:12.5px;color:var(--slate);line-height:1.5;margin:0;">Receives the 60-second brief via secure link: no account, device-bound grant, step-up verification before any confirmation. Every open and action is audit-logged. No EHR write-back in the MVP (read-mostly by design).</p>
</div>
<div style="background:var(--surface);border:1px solid var(--border);border-left:3px solid #a78bfa;border-radius:8px;padding:12px 14px;">
<div style="font-size:10px;font-weight:700;color:#c4b5fd;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px;">Hospital Admin</div>
<p style="font-size:12.5px;color:var(--slate);line-height:1.5;margin:0;">Read-only analytics API access. Can query aggregate outcomes and HRRP metrics. No access to individual patient records. Scoped JWT tokens.</p>
</div>
<div style="background:var(--surface);border:1px solid var(--border);border-left:3px solid #ef4444;border-radius:8px;padding:12px 14px;">
<div style="font-size:10px;font-weight:700;color:#f87171;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px;">Travi Engineering</div>
<p style="font-size:12.5px;color:var(--slate);line-height:1.5;margin:0;">Zero standing access to production PHI. Break-glass access requires dual approval + is logged immutably. Prod access reviewed quarterly.</p>
</div>
<div style="background:var(--surface);border:1px solid var(--border);border-left:3px solid #10b981;border-radius:8px;padding:12px 14px;">
<div style="font-size:10px;font-weight:700;color:#34d399;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px;">Compliance Officer</div>
<p style="font-size:12.5px;color:var(--slate);line-height:1.5;margin:0;">Read-only access to audit logs and access reports. Can trigger access reviews. Cannot modify data. Separate audit-only IAM role.</p>
</div>
</div>

<div style="background:color-mix(in srgb,#10b981 8%,var(--surface));border:1px solid color-mix(in srgb,#10b981 30%,var(--border));border-radius:10px;padding:16px 20px;">
<div style="font-size:11px;font-weight:700;color:#34d399;letter-spacing:.08em;text-transform:uppercase;margin-bottom:8px;">Penetration Testing &amp; Vulnerability Management (roadmap)</div>
<p style="font-size:13px;color:var(--slate);line-height:1.6;margin:0;">Third-party penetration test on the activation, clinician-grant, and tenant-isolation paths is a pre-pilot gate: no pilot go-live with unresolved critical or high findings, then annual retests. Continuous dependency and container scanning (AWS Inspector, Snyk) runs from the first CI pipeline in Phase 01. CVE patching SLA targets: critical within 24 h, high within 7 days.</p>
</div>

<p style="margin-top:20px;font-size:13px;color:var(--slate);">
  <strong>See also:</strong>
  <a href="#doc-engineering-dataflow" style="color:var(--accent);text-decoration:none;" onclick="showDoc('doc-engineering-dataflow')">FHIR R4 Data Flow</a>, for how PHI moves through the pipeline, and
  <a href="#doc-product-cycle" style="color:var(--accent);text-decoration:none;" onclick="showDoc('doc-product-cycle')">Product Cycle Diagram</a>, for the end-to-end episode execution flow.
</p>
<h2 id="doc-reference-security--h2">15.4 Cryptography &amp; Audit</h2>
<ul>
<li>Transit TLS 1.2+ everywhere incl. VPC-internal ALB→task; at rest AES-256 via KMS CMKs (RDS, S3, Redis, EBS); JWTs ES256 with 90-day key rotation and kid-based rollover.</li>
<li>Audit event fields: actor_type/id, on_behalf_of, action, object_type/id, purpose, context (diff hash), ip, user_agent, trace_id, occurred_at. Every PHI read API emits one; every state transition emits one; export jobs emit per-object events (SEC-003, DQS-001).</li>
<li>Logging: structlog processors strip configured PHI fields; Sentry <code>before_send</code> scrubber; log retention 13 months (non-PHI).</li>
</ul>
<h2 id="doc-reference-security--h3">15.5 Compliance Roadmap</h2>
<p>Phase 0: BAAs executed (AWS, Twilio), security risk assessment, vendor review, policies (access, incident, retention). Phase 2–3: SOC 2 Type I evidence collection (Vanta or equivalent), pen test on activation/grant/tenant paths. Pilot go-live gate: zero unresolved critical/high findings; incident-response and clinical-routing procedures rehearsed (matches the PRD definition of done).</p>
<div class="pn"><a class="pn-prev" href="#"></a><a class="pn-next" href="#"></a></div>
</article>