# Access Red Team — buyer review summary

6 September 2026 · Owner-confirmed facts · Draft readiness status

Access Red Team is the brand, led by Cole Lyons. The proposed service is a bounded
Patient Access Workflow Assessment: one agreed workflow and named dependencies,
with evidence, remediation recommendations and one defined retest round. Scope,
fee, dates, evidence access and retest terms are established in a written proposal.

## What the lab demonstrates

PA-LAB-02 documents an executed, deliberately vulnerable local Node/SQLite scheduler.
Two authorization failures were observed; all six selected cases passed after
correction, including legitimate patient and proxy controls. Runnable source,
correlated events, persisted synthetic records and reproduction instructions are included.

It does not establish effectiveness against a particular EHR, hospital, deployed
voice/chat agent or customer environment. Authentication and identification are
seeded. Notification records remain local; no message is delivered. Coding-assistant
tooling produced the fixture and evidence; no independent assessor validated it.

## What remains unresolved

| Item | Current status |
| --- | --- |
| Contracting party | Legal entity, DBA or decision to contract personally has not been confirmed. |
| Insurance | Professional liability, technology E&O and cyber coverage have not been verified. |
| Customer assessment evidence | Storage, access controls, retention, deletion and backups have not been selected or confirmed. |
| External AI processors | None confirmed as approved for customer evidence. |
| Response commitments | Cole is available for contact 24/7; guaranteed acknowledgment/technical-response times and staffed backup are not established. Phone and live chat are not configured. |

Website inquiries use Cloudflare Workers, D1, Turnstile and Cloudflare email services,
with minimal alerts to the founder's existing Gmail inbox. These choices apply to
website inquiries, not approval to process customer assessment evidence. Synthetic
test patients do not rule out PHI in surrounding logs, screenshots or production records.

Before customer testing or evidence transfer, the parties must resolve applicable
vendor requirements, evidence controls and processors, scope and target authorization,
stop/recovery conditions and contact commitments. Pending items remain unresolved;
this summary is not an operating-control attestation or procurement approval.

Detailed engagement and control worksheets are internal planning documents. They
are excluded from this public summary and the portable buyer review bundle.

## The question for this review

**What would prevent you from commissioning a bounded pilot?**

Which workflow would you choose first, who would approve the purchase, and what
specific evidence or vendor requirement would need to be satisfied? No patient
data, credentials or confidential system details are needed for this conversation.