Architecture · HealthClaw

The guardrail boundary, as built today

The guardrail boundary, as built today The boundary as HealthClaw 2.0 defines it, drawn with what exists on 2026-09-05. Every agent surface reaches the record through one kernel, which today resolves the tenant and checks the step-up grant at the sites that have adopted it; its audit call and redacted exit exist but no handler calls them yet. Route handlers still do the audit, redaction and upstream work themselves: the ratchets count 12 step-up call sites and 5 raw tenant reads outside the kernel (one of them the hook meant to read it), and 89 audit calls on the post-commit primitive the kernel is meant to replace. Reads leave through redaction: upstream display text is dropped and labels rebuilt from codes, names cut to initials, dates to the year, identifiers truncated (removed once #615 lands). An agent can propose an action; only a person can approve one, and the endpoint that executes needs a single-use credential only the internal approval mint issues; none of the agent's tools call it. Direct clinical FHIR writes do not pass that gate: they are still gated by a client-supplied header (#214, open), drawn dashed. The Telegram bot reaches the engine through the MCP server and is not drawn separately. AGENT SURFACES HEALTHCLAW ENGINE · r6/ RECORDS AND THE WORLD GRANT EVERY READ READ/WRITE #214 GATE FHIR APPROVE EXECUTE AGENT MCP server agent-orchestrator · token-locked also the Telegram bot's path AGENT CareAgents web · text · stores no PHI HUMAN The patient a page none of the agent's tools call KERNEL Access kernel r6/access.py · require_grant tenant · step-up · exit: 2.0 TODAY Route handlers r6/routes.py + blueprints audit · redaction · upstream EXIT Redaction labels by code, never by display GATE Human gate /confirm · single-use credential STORE Record store SQLite / Postgres R6Resource · AuditEvent · ProposedAction UPSTREAM Upstream FHIR Aidbox · Medplum · HAPI · generic WORLD Provider Bland · Twilio · the call that leaves LEGEND Guardrail (focal) Engine step Store Agent / upstream / provider Person API call Human approval Engine call Known gap (#214)

The boundary as HealthClaw 2.0 defines it, drawn with what exists on 2026-09-05. Every agent surface reaches the record through one kernel, which today resolves the tenant and checks the step-up grant at the sites that have adopted it; its audit call and redacted exit exist but no handler calls them yet. Route handlers still do the audit, redaction and upstream work themselves: the ratchets count 12 step-up call sites and 5 raw tenant reads outside the kernel (one of them the hook meant to read it), and 89 audit calls on the post-commit primitive the kernel is meant to replace. Reads leave through redaction: upstream display text is dropped and labels rebuilt from codes, names cut to initials, dates to the year, identifiers truncated (removed once #615 lands). An agent can propose an action; only a person can approve one, and the endpoint that executes needs a single-use credential only the internal approval mint issues; none of the agent's tools call it. Direct clinical FHIR writes do not pass that gate: they are still gated by a client-supplied header (#214, open), drawn dashed. The Telegram bot reaches the engine through the MCP server and is not drawn separately.