Configure enterprise-grade role-based access control for OpenEvidence clinical AI integrations. Covers role definitions, SSO (SAML/OIDC), permission middleware, organization management, and secure session handling.
| Role | Permissions | Use Case |
|---|---|---|
| Physician | Full clinical query, DeepConsult | Active patient care |
| Nurse | Clinical query (no DeepConsult) | Nursing support |
| Pharmacist | Drug-focused queries | Medication management |
| Resident | Clinical query (supervised) | Training |
| Admin | Full access, user management | Platform administration |
| Auditor | Read-only audit logs | Compliance review |
| Integration | API access only | System integration |
Create ClinicalRole enum and ClinicalPermissions interface with boolean flags for clinicalQuery, deepConsult, drugInfo, guidelineAccess, exportResults, viewAuditLogs, manageUsers, manageSettings.
Integrate with IdP using passport-saml or passport-openidconnect. Map IdP groups to clinical roles with priority ordering (Admin > Physician > Pharmacist > Nurse > Resident).
Create requirePermission() Express middleware that checks hasPermission(user.role, permission) and logs denied access attempts to HIPAA audit trail.
Build OrganizationManager for multi-tenant setup with configurable settings per org (deepConsult limits, MFA requirements, audit retention).
Use Redis-backed sessions with 8-hour maxAge (typical clinical shift), rolling expiry, secure cookies, and re-authentication for sensitive operations.
| RBAC Issue | Detection | Resolution |
|---|---|---|
| SSO login fails | Auth callback error | Check IdP configuration and certificates |
| Wrong role assigned | User reports | Review IdP group-to-role mappings |
| Permission denied | 403 responses | Verify role has required permission |
| Session expired | User redirect | Implement session warning middleware |
app.post('/api/clinical/query', requirePermission('clinicalQuery'), queryHandler);
app.post('/api/clinical/deepconsult', requirePermission('deepConsult'), deepConsultHandler);
app.get('/api/admin/audit-logs', requirePermission('viewAuditLogs'), auditLogsHandler);
See detailed implementation for advanced patterns.