Who saw what, and were they allowed to?
Access rules and audit trails are requirements, not features. They break in the same places as everything else: new endpoints, admin tools and background jobs. Invarly checks them on your data, continuously, and keeps a record of every check.
Why access rules break quietly
Regulated products have rules written by lawyers and enforced by code: who may read a record, what must be logged, when data may be shared. The rules are reviewed once; the code changes every week.
A missing check doesn’t fail. The read succeeds, the page loads, and the gap is found in an audit or after a complaint.
Five places it breaks
Reads outside the care team
A new search endpoint returns records without checking assignment.
Reads without an audit row
A background export or admin tool reads records without writing to the audit log.
Sharing before consent
A record is shared with a third party before consent is stored, because the two writes race.
Access after deletion
A deleted record is still readable through a cached index.
Expired access never revoked
Temporary access granted for a case stays active after it ends.
A walkthrough
A team ships an admin search endpoint to help support staff find records faster. It checks that the user is staff, not that they are assigned.
- all 4 reads came from the new admin search endpoint
- traced to 5f2c0d9 “admin search endpoint”
api/admin/search.go:23 - users affected 1 staff account · 4 records
The rule turns a finding from next year’s audit into an alert this morning, with the evidence attached.
The starter rule pack
The rules most teams in this space start with. Each one is a query against your own tables, adjusted to your schema during setup.
| rule | protects | runs |
|---|---|---|
| read-within-care-team | Unauthorised access | 5 min |
| every-read-audited | Audit gaps | 15 min |
| share-after-consent | Consent violations | 5 min |
| no-read-after-delete | Retention | 1 hour |
| expired-grants-revoked | Stale access | 1 hour |
| rls-on-every-table | Data exposure | on each deploy |
How it fits your stack
Everything sensitive stays inside your network. The agent sends only rule results: identifiers and the columns you choose, which can be hashed or omitted.
Every check is stored with its result and time, which gives auditors a continuous record instead of a point-in-time sample.
Common questions
Does any patient or personal data leave our network?
Not unless you include it in a rule’s result. Most teams send only record and user identifiers.
Is Invarly certified?
Not yet. Invarly is in early access. We’ll share our compliance roadmap with design partners.
Can we export check history for an audit?
Yes. Every run and result is kept and can be exported.