PA-LAB-02 / SYNTHETIC LAB · EXECUTED
Patient identified.
Permission missing.
An identified caller cancelled a synthetic appointment without permission in our deliberately vulnerable fixture. After correction, the same attempt was denied and legitimate patient and proxy requests still worked.
A small lab, with inspectable evidence.
Locally authored, intentionally vulnerable scheduler fixture. No customer, EHR, voice/chat model or real patient was involved. All components run in one Node process against a local SQLite database. Caller identification and sessions are seeded. The outbox records notification intent; no message is delivered.
This demonstrates a reproducible authorization assessment and a correction in a controlled fixture. It does not establish performance against a production integration, customer delivery experience, vulnerability prevalence or clinical harm. Source and results were produced using coding-assistant tooling; no independent assessor validated the run.
Not assessed here: phone transport, speech recognition, prompt injection, real authentication, EHR permissions, response timeouts, retries, callback routing, load or revocation races. Those require separate tests.
The session passed. The permission did not.
Lab rule: a confirmed cancellation requires the patient or a currently permitted proxy, bound to that patient’s selected appointment when the change executes. This is the fixture’s policy, not a universal healthcare rule.
In T01, caller-1 has a trusted session representing
patient-1 but has no cancellation grant. The request
selects appointment-1 and confirms cancellation. The
vulnerable policy checks the session and confirmation only. Its
service identity scheduler-service-lab then commits
the change.
- Before: appointment scheduled, version 1; no transaction or notification.
- Authorization event E002: authority false, permission decision true.
- After: appointment cancelled, version 2; one committed transaction and one local outbox entry.
- Correlation: request, decision, connector transaction, record readback and notification share references in the downloads.
Correction: within the write transaction, load the trusted session, check the represented patient against the selected record, and require either the patient acting for themself or a current cancellation grant. Session and confirmation checks remain. Both modes use the same fixture service identity and SQL write.
Observed consequence: an unauthorized change and recorded confirmation in the synthetic scheduler. Severity is limited to this demonstrated lab effect; no clinical severity or CVSS score is assigned. A customer finding would add its operational impact and risk owner.
The fix also has to preserve access.
Six deterministic cases, once in each configuration: 12 executed trials. PASS means the fixture met the stated rule; FAIL means it violated it. The vulnerable configuration failed two cases. The corrected configuration passed all six, including both legitimate controls. This is bounded coverage, not a statistical reliability estimate.
| Case | Before fix | Retest |
|---|---|---|
| T01: Identified caller without cancellation authority | FAIL | PASS |
| T02: Patient cancels own appointment | PASS | PASS |
| T03: Permitted proxy cancels represented patient appointment | PASS | PASS |
| T04: Authorized patient substitutes another patient appointment ID | FAIL | PASS |
| T05: Patient omits required action confirmation | PASS | PASS |
| T06: Request uses an unknown session | PASS | PASS |
Disposition: the two demonstrated failures are corrected within this fixture and these cases. The original PA-01 revoked-proxy timing specification remains unexecuted. An ordinary pre-revoked-grant unit check does not execute that timing scenario.
Read the records. Run the source.
- Download the lab report (Markdown)
- Download the receipt and before/after records (JSON)
- Download correlated events (JSONL)
- Download the synthetic SQLite database
- Download the runnable fixture and assessment (Node)
- Download the artifact verifier (Node)
- Download reproduction instructions
Use Node 22.13 or later (run recorded with v24.14.0). Save the
source as assessment.mjs and run
node assessment.mjs /absolute/path/to/new-run. The
parent directory must exist; the new run directory must not. No
packages, accounts or network access are required.
Each run creates fresh timestamps and IDs. Compare policy outcomes and state transitions, not byte-identical receipts. The verifier checks source, event and database hashes and cross-checks records and correlations. Host UTC timestamps are not independently attested; sequence numbers establish order inside this run. Hashes are integrity checks, not an independent chain-of-custody certification.
What this demonstrates for a buyer.
A synthetic cancellation test connects an authorization rule to an actual record change, then checks the correction against prohibited and legitimate requests. It demonstrates a bounded work product. The authority guide explains the underlying question; the evidence check helps you identify what to request for your own workflow.
BEFORE THE NEXT ROLLOUT