Fixed demonstration · Employee medical records
One record changes shape for six pairs of eyes.
Calder Foods is a food manufacturer with 640 employees. This record belongs to Maya Ellison, a machine operator hired in 2019.
The organization and the person are invented for this page. Every figure is fixed in the page code.
01
The same record through six pairs of eyes
| Field | State | What this role retrieves |
|---|---|---|
| Name | Retrieved | This field is available to this role. |
| Employee number | Retrieved | This field is available to this role. |
| Department | Retrieved | This field is available to this role. |
| Job title | Retrieved | This field is available to this role. |
| Work schedule | Retrieved | This field is available to this role. |
| Accommodation status | Retrieved | This field is available to the HR generalist. |
| Work restrictions | Retrieved in part | The functional restriction only, not the certification behind it. |
| Medical certification | Not retrieved | No value is returned to this role. |
| Diagnosis | Not retrieved | No value is returned to this role. |
| Treating physician | Not retrieved | No value is returned to this role. |
| Access history | Not retrieved | No value is returned to this role. |
This is not an interface promise. The separation is written as row level security policies in the database, so if the interface disappeared tomorrow morning, it would still hold.
02
Opening a document
The selected role is HR generalist.
03
The ledger
The employee reads this same list from their phone. Including the refusals, and including yours.
| Timestamp | Actor and role | Object | Action | Purpose recorded | Outcome |
|---|---|---|---|---|---|
| 03/11 09:42 | A. Reyes, occupational health | cert-2026-0311.pdf | opened | Restriction review following first certification | Granted |
| 03/12 14:07 | J. Lund, HR generalist | work_capacity | opened | Accommodation file opened, interactive process started | Granted |
| 03/14 08:19 | T. Bauer, direct supervisor | cert-2026-0311.pdf | refused | Forwarded link from a shared inbox | Refused |
04
The attempt is part of the record
Every row above is written before the decision is taken, not after it. That is why a refused attempt exists at all: the system records that someone tried, and then records that it said no. A log that only contains what was permitted proves nothing about what was attempted.
Map the record you have now
Do not attach any medical document to this email.