FICTIONAL EXAMPLE · PERMISSION MATRIX
A completed permission matrix.
Make the caller, action and permission explicit — before the rollout discussion.
Who can perform which actions.
Fictional callers and rules. Illustrative only — your policy and enforcement point will differ.
| Caller | Action | Decision |
|---|---|---|
| Patient | Reschedule | Allowed — patient acting for self, bound to own appointment |
| Verified proxy | Cancel | Policy-dependent — requires current grant for this patient and appointment |
| Unverified caller | Change | Blocked — no permission; do not commit or confirm |
How to read it.
- Caller is identified separately from the patient. Knowing a name and date of birth does not establish permission.
- Action names the exact change — reschedule, cancel or change — against the selected record.
- Decision is the enforced outcome: allowed, policy-dependent (check a current grant) or blocked.
Pair each row with allowed and denied tests against the real enforcement point. See who may act for the patient?
Use it with your team.
- Build a rollout brief ↗ — answer the permission question with your own rule and evidence.
- Download the blank checklist ↗
- Back to the free library ↗