AI is allowed to use the clinic. It is not allowed to become the clinic database.
The safest useful AI is not one that “knows everything.” It is one that can do exactly the work it has been authorized to do, through the same application rules as everyone else.
Menaela treats the LLM as an orchestrator above a controlled application layer: it can interpret intent and choose tools, but identity, permissions, business rules and persistence stay outside the model.
The important question is not whether an AI model can make mistakes. It can. The architecture is designed so a model mistake does not automatically become an unrestricted data or business-rule mistake.
Separate clinic databases
Each clinic has its own PostgreSQL operational database. Shared application infrastructure does not mean a shared tenant data store.
Tenant-bound AI tools
The AI receives immutable clinic context and cannot choose another clinic when it invokes application operations.
No direct AI database access
Main Menaela works through semantic application tools instead of generating unrestricted SQL or mutating tenant PostgreSQL directly.
Permission-aware operations
The execution layer carries user, clinic and role context and applies the permissions registered for that operation.
Structured validation
Tool arguments and application results are validated against explicit contracts before a model-originated request can become an application action.
Auditability
Agent-originated mutations can be traced with actor context, tool identity, target object and safe result metadata.
Patient-facing isolation
External autonomous conversations receive a deliberately limited catalog. A patient conversation does not inherit the staff assistant’s powers.
Clinical authority remains human
AI-generated medical notes remain drafts until a clinician reviews and signs them; signed history is protected from silent regeneration.
The model proposes; the application disposes.
The LLM decides which registered capability may satisfy the request. The application still decides whether the operation is valid, permitted and consistent with clinic rules.
Identity is not a prompt.
Clinic, user and patient boundaries are carried by server-side context. They are not left to “please only access this patient” instructions inside the model prompt.
Autonomy is scoped by surface.
A staff assistant, patient WhatsApp flow and documentation agent do not need the same powers. Each execution profile can expose a different capability set.
Failure should be visible.
If a tool fails, data is incomplete or context is ambiguous, the system should surface that state instead of allowing the model to improvise a successful-looking answer.
- It does not mean every AI output is clinically correct.
- It does not mean every deployment has identical integration or hosting requirements.
- It does not replace clinic access policies, staff responsibility or local compliance work.
- It does not turn patient-facing automation into an unrestricted medical agent.
A generic “AI layer” on top of a clinic is easy to demo and hard to trust. Menaela is built around the opposite assumption: the model should be powerful at understanding intent, while the application remains boringly deterministic about who may do what to which record.
This page focuses on architecture, access and control boundaries. For concrete failure cases — hallucinated clinic facts, stale booking slots, medical questions, ambiguous requests and tool failures — see AI Safety →
Want the technical detail?
We can walk your team through tenancy, tool execution, patient-facing isolation, documentation authority and audit behavior.
Talk to us