"Not simulated. Executed — by personas, under governance, with evidence."
Every workflow on this platform can be walked end to end by a governed persona — a GP, a pharmacist, a laboratory technologist — driving the real user interface of the real service, through the real policy enforcement point, leaving signed evidence behind. This page explains the three pieces that make that possible: the persona model, the SuperPersona workforce, and the SignalBox execution engine.
A persona here is a first-class identity with a scoped set of capabilities — what it may read, what it may write, what requires a human signature. Role checks alone cannot tell two personas in the same role class apart; the capability model can.
226 personas across 37 capability domains, reconciled against the real route guards of the platform's services — the catalogue is generated from the code that enforces it, not maintained by hand.
Fully specified persona configurations — capability scopes, standard operating procedures and allowed transitions. A paramedic persona, for example, may administer protocol-bounded medicines but can never prescribe, and drug administration requires human approval.
147 persona archetypes documented for national-scale deployment — clinical, administrative, citizen-facing and safeguarding — each with delegation patterns and the regulator scrutiny it attracts.
Nine of the fully specified blueprints. The boundary lines below are not copy — they are the capability scopes the platform's route guards enforce at runtime.
Pre-hospital lead clinician
CANDrive the ambulance journey end to end — scene assessment, electronic patient report form (ePRF) narrative, JRCALC ambulance-guideline pathways, hospital pre-alert.
NEVERPrescribes. Every drug administration, refusal and handover carries the human paramedic's signature.
Ward-round medicines safety
CANReview regimens against the live drug chart, record pharmacy interventions, drive antimicrobial stewardship.
NEVERExecutes the dispense event — that belongs to the responsible pharmacist's path, by design.
Statutory death scrutiny
CANReview draft death certificates (MCCDs), query the certifying clinician, assemble coroner-referral triggers.
NEVERApproves or refers alone — those state transitions are human-only in the workflow engine.
Mental Health Act assessment
CANPrepare assessments, run nearest-relative consultation, coordinate conveyance.
NEVERMakes the section application — a liberty-impacting act, reserved to the human professional.
Mental Health Act recommendation
CANAssemble evidence-linked recommendation drafts from the patient summary.
NEVERSigns. Recommendation signing is always human-only, regardless of configuration.
Emergency intake & triage
CANRun structured pathways triage, create incidents, hand off cleanly to dispatch.
NEVERDispatches. Resource assignment belongs to a separate persona — separation of duties, enforced.
Laboratory sign-out
CANDraft reports with AI second-read, check completeness, prepare multidisciplinary team (MDT) contributions.
NEVERAuthorises a result. Sign-out is a clinical act, and it is human-only.
Mental Health Act oversight
CANDraft renewal reports, community treatment order (CTO) evidence and section 17 leave paperwork.
NEVERTakes a liberty-impacting decision — renewal, recall — those are human-only by statute and by code.
Citizen navigator
CANAnswer general questions, collect symptoms, route red-flag presentations to a licensed clinician.
NEVERDiagnoses, prescribes or orders investigations. Its write scope on the clinical chart is empty.
SuperPersonas are registered agent workers — 52 of them, spanning clinical practice, clinical trials, engineering, operations, data and testing. Every one of the 52 binds to a real platform persona — none floating — 36 of them require human validation by construction, and every one escalates to a named human role, not a generic queue. A SuperPersona can advise, and it can act. When it acts, it does so by governed role assumption into a bound human persona, through three gates that each refuse independently.
Each SuperPersona is defined in the platform's agent registry with its skills, tools, guardrails, tests, KPIs and outcome metrics — plus talent grades, autonomy grants, and promotion and retirement workflows. The workforce is managed like a workforce.
Binding — the SuperPersona must be bound to a mintable human persona. Capability — the specific domain and action must sit inside the assumed persona's scope. Tier — a graduated-autonomy decision determines whether it may act at all.
Every action cell carries a tier: T0 human-reserved (the agent can only draft), T1 synchronous human-in-the-loop, T2 act-then-review, T3 autonomous. Fourteen statutory actions — Mental Health Act applications, death registration, controlled-drug destruction and others — are human-reserved in code, regardless of policy configuration.
13 clinical SuperPersonas (clinician, nurse, midwife, pharmacist, radiologist and more), 13 for clinical trials, 8 engineering, 9 operations, 3 data and informatics — and 6 dedicated to testing and assurance, one per V-model level plus quality and release management. Half the workforce never touches identifiable patient data at all.
Each entry below is read from the agent registry, escalation target included. None of them escalates to a queue — every one names the human role that answers.
Clinical reasoning and care-planning support.
ESCALATES TO: HUMAN CLINICIAN REVIEW
Nursing coordination and bedside escalation support.
ESCALATES TO: REGISTERED NURSE OR RESPONSIBLE CLINICIAN
Maternity evidence, coordination and escalation support.
ESCALATES TO: NAMED ACCOUNTABLE MIDWIFE OR OBSTETRIC TEAM
Medicines reconciliation and medication-safety support.
ESCALATES TO: PHARMACIST OR PRESCRIBER VALIDATION
Imaging interpretation support.
ESCALATES TO: RADIOLOGIST VALIDATION REQUIRED
Emergency triage and escalation support.
ESCALATES TO: EMERGENCY TEAM BREAK-GLASS
Care coordination and pathway continuity support.
ESCALATES TO: RESPONSIBLE CLINICIAN OR SERVICE OWNER
The accountable human-in-the-loop — the platform's sole governed human identity.
ESCALATES TO: PRODUCT OWNER OR RELEASE MANAGER
SignalBox MCP is the platform's browser automation, testing and evidence-capture engine. It runs headed by default — a human can watch every step render live — and it is persona-aware: a scenario can switch persona mid-journey and assert what that persona is, and is not, allowed to do.
Journeys run in a visible browser so a human observer can watch each leg render — the cursor glides, the forms fill, the pages change. Headless is the exception, not the rule.
Scenarios switch persona mid-run and assert against the live role-based access model — is this persona who it claims to be, and is this capability actually allowed? UI checks and permission checks travel together.
Clinical captures are redacted before they persist, content-anchored to the GHARRA transparency ledger, and signed — with the signature covering the anchor. If anchoring fails, the capture is rejected, not stored.
Scenario runs emit integrity-verified evidence manifests that can be replayed deterministically. Hand-authored result files and placeholder screenshots fail verification — the platform's own build gates only accept the signed form.
These are not slideware journeys. Each scenario is an executable specification that boots the real services and walks the workflow — 202 of the 203 held green status at the August 2026 sweep. The patient-visit acceptance programme walks 31 care hops across 5 pathways; Symphonix executes 14 of them autonomously and assists on the other 17.
The flagship journey: a single patient visit walked from GP consultation and electronic prescription, through pharmacy dispense, laboratory bloods and specialist referral — with every completion loop closing back to the GP record. Its headed companion boots three real frontends so a human can watch every leg.
Urgent referral to first-seen, diagnostics to faster-diagnosis clock stop, first treatment — the statutory cancer waiting-time journey, executed across three green scenarios with the clock rules enforced.
The laboratory round trip — order, specimen, analyser, result, verification — walked through every state transition the LIS expects, with critical-value paging on the way back.
Testing here is owned by resident SuperPersonas — one per V-model level: unit, integration, system and end-to-end, and headed user acceptance, with a quality-assurance SuperPersona holding the aggregate gate. The gate is fail-closed: a full-pass claim is refused unless every lane is green, the false-positive/false-negative audit has run, and the evidence ledger is present. We publish the discipline rather than a permanent green badge — on any given day the honest answer is the gate's answer.
Pick a pathway that matters to you — prescribing, laboratory, cancer waiting times, claims — and we will walk it live: real services, a visible browser, and the evidence trail it leaves behind.
HIPAA compliant • GDPR enforced • HITRUST aligned • No patient data in this form