Tenant provisioning
A practice moves through explicit states, and it cannot transact until it reaches the right one.
#States
| State | Can transact | Meaning |
|---|---|---|
provisioned | no | Exists. No access to anything. |
activated | yes | Checklist complete, BAA signed, first users invited. |
suspended | no | Stopped. Agents halt at once, not at renewal. |
offboarding | no | Export available, purge scheduled. |
offboarded | no | Purged, and the canary has verified it. |
Provisioning grants no data access
A platform admin can create a practice and cannot read anything in it. The admin plane and the clinical plane are disjoint, and the catalog audit fails the build if a role ever holds atoms from both.
#The activation checklist
Blocking items must be true before a practice can transact: the BAA is executed, the responsible parties are named, at least one licensed human who can release a determination has been registered, and the practice's autonomy ceiling has been set deliberately rather than defaulted.
#Suspension
Suspension takes effect on the next call, not on the next reconnect. A suspension that waits for a session to expire is not a suspension.