A cancer patient's chart holds diagnoses, genomics, prognosis, and family history — read by surgeons, oncologists, radiologists, and agents. Every reader needs some of it. No reader needs all of it.
Care is multidisciplinary by design, so access is broad by default. Agents inherit that breadth. OpaqAI's field-level grants make selective sharing possible.
A prep agent assembles staging, pathology, and imaging reads. It never touches identifiers or notes outside the case.
Matching runs on biomarkers and prior therapy lines. Identifiers are blocked at the boundary by default.
Reporting needs specific coded fields on a schedule. A full chart export never leaves, because it was never grantable.
Three agents worked patient 641's case today. Each crossed the boundary only where its grant allowed. The blocked lines are not incidents—they are the standard, operating.
| TIME (UTC) | AGENT | FIELD | DECISION |
|---|---|---|---|
| 08:02:41 | tumor-board-prep | staging.tnm | PASSED |
| 08:02:41 | tumor-board-prep | pathology.report | PASSED |
| 08:02:42 | tumor-board-prep | notes.psychotherapy | BLOCKED |
| 10:17:05 | trial-matcher | biomarker.egfr | PASSED |
| 10:17:05 | trial-matcher | demographics.name | BLOCKED |
| 16:40:22 | registry | diagnosis.code | PASSED |
| 16:40:23 | registry | demographics.address | MASKED |
| Question an auditor asks | The answer |
|---|---|
| Which agents can read genomic data? | grep scope biomarker.* |
| Who saw patient 641 this month? | log export · 128 lines |
| Was anything over-shared? | 0 crossings outside grant |
| Can you prove it? | chain attested · sig:e93d…5c |
HIPAA's minimum-necessary standard asks organizations to limit access to what each use requires. With app-level access, that is a policy document.
With field-level grants, it is a mechanism—and the signed log is the evidence that it held, per request, per field.
Start with a single agent and a single workflow. Four weeks in, you have a log of every crossing and a grant model your compliance team wrote themselves.