Traditional governance tracks individual objects — but what happens when the thing that fails isn't an object at all? It's a shared condition that several objects quietly depend on. A hosted model drifts, and six decisions get flagged. The seventh — the one that actually mattered — was never tracked.
What it does for you: Common-Exposure Governance treats shared conditions (model providers, data processors, legal bases) as first-class versioned entities in the ReBAC graph. When a condition drifts, the system separates the response into two tiers: Tier 1 (Confirmed) — subjects who explicitly declared dependency are immediately suspended. Tier 2 (Residual) — subjects with possible but unproven exposure are flagged for review, not suspended. This prevents catastrophic over-suspension while guaranteeing clinical safety.
This architecture was shaped by collaborative discourse with Stephen Gettel and Ravi Shankar NRK, whose insights on condition versioning, the confirmed/residual separation, and the distinction between shared exposure and shared failure directly informed AuthHub.
A governed condition node with immutable version history. Version only increments upon formal drift declaration — never on subject re-attestation.
Subjects with registered edges to the condition. Green = active, Red = suspended (confirmed dependency), Amber = flagged for review (residual exposure).
Decisions made during drift carry governance annotations. Confirmed set is hard-blocked (no clinical decisions admitted). Residual set decisions are annotated as unproven_exposure. Escaped decisions carry escaped_boundary.
How AuthHub separates explicit ReBAC relation tuples from implicit runtime infrastructure dependencies.
| Entity / Subject | Relation in ReBAC Schema | Object Target | Tier Classification | Drift Action |
|---|---|---|---|---|
practitioner:dr-smith |
explicit_dependency |
condition:model_provider:deepseek-v2.3 |
Tier 1 (Confirmed) | Immediate Redis suspension + Caldicott review requirement |
practitioner:dr-jones |
explicit_dependency |
condition:model_provider:deepseek-v2.3 |
Tier 1 (Confirmed) | Immediate Redis suspension + Re-attestation at v2 required |
ai_agent:cds-clinical |
inference_dependency |
condition:model_provider:deepseek-v2.3 |
Tier 1 (Confirmed) | Agent token invalidated; CDS inference endpoint blocked |
practitioner:dr-patel |
unproven_exposure |
department:oncology |
Tier 2 (Residual) | Access allowed + audit tag unproven_exposure (review pending) |
ai_agent:cds-radiology |
unproven_exposure |
modality:ct_scan |
Tier 2 (Residual) | Flagged for infrastructure verification; dismissed if isolated model |
Stephen Gettel and Ravi Shankar NRK highlighted that enterprise authorization engines typically suffer from catastrophic over-suspension or silent vulnerability because they confound two separate states:
When a vendor drifts, every downstream resource is either assumed dead (halting the entire hospital's operations) or assumed alive (allowing drifted AI hallucinations into patient charts without notice).
AuthHub separates deterministic ReBAC edges (Tier 1) from probabilistic blast zones (Tier 2). Critical clinical agents are safely paused while auxiliary departments operate uninterrupted under tagged surveillance.
| Regulation / Standard | Mandate Clause | Traditional Problem | AuthHub Common-Exposure Solution |
|---|---|---|---|
| GDPR Article 22 | Meaningful human review of automated decisions and model drift | Silently running outdated model versions without traceable consent | Cryptographic audit tag unproven_exposure and immutable DAG lineage |
| NHS DSPT Standard 6 | IT Systems Security & Third-Party Supplier Risk Control | Supplier API breaking changes go unnoticed until clinical incident | Condition Registry tracks external vendor API versions with instant revocation |
| NHS DSPT Standard 9 | Incident Response & Boundary Protection | Over-suspension shuts down entire wards during minor provider hiccups | Tier 2 residual flagging isolates impact to confirmed dependencies only |
| EU AI Act Art. 14 | Human oversight of high-risk medical AI systems | No mechanism to surgically pause a rogue foundation model across agents | One-click drift declaration halts all dependent CDS agents in <450ms |
| ISO 27001 A.12.1.2 | Change management across third-party software dependencies | Manual spreadsheets tracking which models are embedded in which microservices | ReBAC relation tuples link software components directly to condition nodes |
Ask DeepSeek to explain two-tier blast radius separation, analyze model drift blast radiuses, or generate DSPT/GDPR compliance evidence.