The Second Clinic

The story

Meridian acquired Northshore Health in the spring — a bigger clinic across the river, with its own front desk, its own habits, and its own copy of every IT problem Meridian had just finished solving.

The integration plan had a line item that looked innocent: merge user accounts. Then Dr. Elena Vasquez asked a question that unravelled it. She was Lakeside’s cardiologist, but she’d be covering Northshore two days a week. “When I’m at Northshore,” she said, “I should see Northshore’s patients. And when I’m not — I shouldn’t. Right?”

Right. Obviously right. Except Ana’s authorization model was a role column, and a role column has no at. Physician-at-Lakeside and physician-at-Northshore were, to her schema, the same fact. The old plan — give Elena both clinics’ data and trust her to look at the right half — was the kind of decision you make quickly and explain to an auditor slowly.

The rewrite she feared never happened. In Sentinel, Meridian’s realm grew a second organization. Clinics, it turned out, were a config file: Ana declared northshore next to lakeside in the YAML that already defined the realm’s roles and clients, checked it into git, and let the boot-time apply create it idempotently — the acquisition had a pull request. Elena got a membership in both orgs; her physician role stayed exactly one role.

The part that felt like magic was the part Sentinel considers boring: Elena’s session carries an org context. Logged into Lakeside, her token’s org claim scopes every permission check to Lakeside; the clinic picker in the corner calls the org-switch endpoint and hands her a fresh token for Northshore — no re-login, membership checked against the live store at switch time, not against whatever her token remembered. The acceptance test on the demo world says it in one line: Org_switch_changes_effective_permissions.

Northshore went live on a Thursday. Elena covered her first shift there the following Tuesday and reported one bug: the clinic picker was “too small”.

Why this is hard the traditional way

Single-tenant authorization models fail quietly when the second tenant arrives. A role column, a permissions table keyed by user id, middleware that asks “is this user a physician?” — none of it has a slot for where. Teams bolt the org id on afterward: a clinic_id column here, a WHERE clause there, an if-statement in the admin screen — and every query that forgets the new column is a cross-clinic leak that tests written against one clinic can’t catch.

The deeper trap is identity duplication. The expedient answer — give Elena two accounts, one per clinic — forks a human into two audit trails, two passwords, two MFA enrollments, and a lifetime of “which login is this?” It also guarantees that when Elena leaves, someone will remember to disable one of her.

How Sentinel changes the ending

Sentinel’s model has the at built in. Users belong to a realm; organizations partition it; membership is a first-class edge; and authorization is evaluated against a per-(user, org) snapshot — the same Elena, a different effective permission set per clinic, derived structurally rather than by convention. Grants themselves carry scope in the permission grammar (service:scope:action), so “read patients in your org” and “read audit globally” are different words, not different if-statements.

The org context rides in the token, which means every downstream check — API routes, the SPA’s can() calls, list visibility — agrees about where Elena is standing. And because clinics are declarative config, the next acquisition is a code review, not a project: structure in YAML, people at runtime, secrets referenced by environment variable and never committed.

What it costs you to ignore this

• The second tenant is when data leaks start. Every org-blind query is a cross-clinic disclosure waiting for production data to find it.
• Duplicate accounts double your deprovisioning failures. The account nobody remembered is the account the auditor finds, still active, in eighteen months.
• Bolted-on tenancy never finishes. The clinic_id retrofit touches every table, every cache key, every background job — and the miss rate compounds with team growth.
• “Trust them to look at the right half” is a sentence you will one day read aloud, under oath, to someone unamused.