A regulated publishing platform, built in 45 minutes
The compliance surface moved off the application and into infrastructure you can point an auditor at, so the app stayed tiny and the controls stayed provable.
- Access control → Postgres row-level security (the database says no, not an if-statement)
- Immutable 6-year audit trail → statement-level triggers the engine physically enforces
- Author → clinical → compliance approval → a Temporal workflow that can't be sidestepped
- Identity & PHI-handling agents → Ory principals, every action audited with provenance