Oversight that works: approval, permissions, logs and the right questions

Emma George, last time you scared me. This time give me the controls. If a supplier walks onto my ward with an agent tomorrow, what do I do?

George Start with one control, because it does most of the work. A person approves before the agent changes anything outside its own workings. Sending, booking, ordering, discharging, altering a record, changing a rota.

Emma And reading and drafting?

George Can run free. That's the dividing line. Preparing is cheap and reversible. Changing waits for a named human. The joint guidance asks for human approval of high-impact actions and ongoing oversight, not a check done once at set-up.

Emma Surely that's easy. I click approve.

George That's the trap. Picture one button that approves fourteen discharges, with no way to see what each one will do. That isn't a control, it's consent without understanding.

Emma So what does a proper one look like?

George It shows the specific action in plain words, with what you need to judge it. It gives you time. It lets you refuse without penalty, and it logs refusals as readily as approvals.

Emma Why does the refusals part matter?

George Because if nobody ever refuses anything, either the agent is perfect or nobody is looking. Only one of those is likely. A zero refusal rate is a warning, not a success.

Emma Fair. What else?

George Least privilege. Give it only the access the task needs, for as long as it needs it. Start read-only. Add the power to change something only where there's a reason, for the narrowest set of records. The guidance warns against broad access, especially to sensitive data, and against permissions set once and never reviewed.

Emma Can't it just use my login? That's what the demo did.

George It shouldn't. It acts under its own identity. Then the log shows what the agent did, you can withdraw its access without touching a person, and nobody's blamed for something software did in their name.

Emma Okay. Something goes wrong. What do I need?

George The ability to answer why did it do that within the hour. So a record of what it was asked, what it read, what it decided at each step, and what it changed, kept long enough and readable by the people who'll need it.

Emma How do I check that before we buy?

George Ask for the log during the demo. For the example they've just run. If the supplier can't show you one, you've learned something important.

Emma And if I need to stop it?

George You need a stop control that works at once, and a manual fallback that people can still do. A team that's forgotten the task has no fallback.

Emma I've heard of DCB0160, a hazard log, impact assessments. Do I need all that for a rota tool?

George Proportionately, yes. DCB0129 is for manufacturers and DCB0160 for organisations deploying, with a Clinical Safety Officer, a hazard log and a safety case. A data protection impact assessment where personal data's processed in a high-risk way. And if it's intended for a medical purpose it may be a medical device. You may not own those, but you should know who does.

Emma And when it nearly goes wrong?

George Report it as a near miss through your patient safety route. In England that's the national Learn from Patient Safety Events service. A near miss is the cheapest evidence you'll ever get that a control needs strengthening.

Emma Give me the seven questions I can take into the meeting.

George What can it read and what can it change. Who approves each action and what do they see. What's logged, for how long, can I read it. How do I stop it and what do we do then. Who's the Clinical Safety Officer and where's the hazard log. What happens to the data. And who is accountable when it's wrong.

Emma And the answer to that last one?

George It's never the agent. The Code still applies. Clause 19 asks you to reduce mistakes and allow for human factors and system failures. Decisions about people stay with people. If your account is the agent did it, nobody will accept it, and they shouldn't.