openevidence-enterprise-rbac

# OpenEvidence Enterprise RBAC ## Overview OpenEvidence delivers AI-powered clinical decision support using peer-reviewed medical literature. Enterprise RBAC controls access to clinical queries, PHI-adjacent data, and research datasets. Clinicians query evidence with full access. Researchers access de-identified datasets and can create study cohorts. Admins manage institutional access, SSO configuration, and compliance settings. HIPAA requires strict audit logging of every clinical query, PHI access event, and data export. Institutional access agreements define which evidence libraries each organization can query. ## Role Hierarchy | Role | Permissions | Scope | |------|------------|-------| | Institutional Admin | Manage users, SSO config, compliance settings, usage analytics | Organization-wide | | Clinician | Query clinical evidence, view full citations, bookmark findings | Institutional library | | Researcher | Access de-identified datasets, create study cohorts, export data | Approved studies | | Medical Student | Query evidence with supervised access, no PHI datasets | Educational library | | Auditor | Read-only access to query logs and compliance reports | Organization-wide | ## Permission Check ```typescript async function checkClinicalAccess(userId: string, resource: string, accessLevel: string): Promise<boolean> { const response = await fetch(`${OE_API}/v1/institutions/${INSTITUTION_ID}/permissions`, { headers: { Authorization: `Bearer ${OE_API_TOKEN}`, ...