GrowthOS

Every table carries the clinic id, every query filters on it, and row-level security in Postgres enforces the same rule independently. Application code alone is not treated as sufficient — if a page ever forgot its filter, the database still returns nothing. That redundancy is the whole tenancy model.

The notes agent has no tool that sends anything. It can only build a proposal. Follow-ups, recalls and review requests become real records when a human presses Confirm, and patient messaging stays a link a person taps. This is a capability boundary rather than a prompt instruction, which is the only kind that holds.

Diagnoses, prescriptions and dosages stay verbatim inside the note. The agent never lifts them into structured fields and never adds an interpretation. Unknown fields are left empty rather than guessed. Software that reorganises a doctor's clinical wording is a liability, not a feature.

Transcripts arrive fenced and are treated as data, never as instructions. Text inside one that tells the agent to ignore its rules is noted and not obeyed — the same discipline you would apply to anything a stranger can type into your system.

A non-admin who guesses an admin URL is told the page does not exist, so the panel's existence is never advertised. It is gated in middleware and re-verified independently inside every admin page and action, because a server action is its own endpoint and the route guard does not cover it. Every admin mutation writes an audit row.

Dermatology or physiotherapy would be rows in a catalogue table, resolved through one shared fallback function — never an `if vertical === …` branch in feature code. The mechanism is built and live; the flag stays off in production until a paying non-dental clinic exists.