commvita
Connected care platform
Governance & Delegation

Policy to Process — how a written policy becomes an enforced, audited workflow

A demo reference for the commvita Policy-to-Process (P2P) engine — how the Scheme of Reservation & Delegation and Standing Financial Instructions become live authority data, how a source policy is generalised into a bindable process, how every step is enforced as hard · soft · advisory with structured escalation onto one immutable, hash-chained audit, and how the same policy set is safely composed for a second jurisdiction.

Live vs demonstrated: Live — real, API-backed platform logic (wired end-to-end today) Demonstrated — representative control surface with seeded data / illustrative UI mock-up

The five layers

A policy is not a PDF that sits in a folder — in P2P it is decomposed into layers that each do one job. Authority says who can do what up to what limit; the Policy Bank holds the generalised process; the Process Engine enforces it; escalation and the WORM audit carry what actually happened; and composition safely ports the set to another jurisdiction.

Authority Matrix Policy Bank Process Engine Escalation & WORM audit Jurisdiction Composition
Non-SaMD — a governance control surface. P2P governs operational / authority workflow and presents recorded evidence for decision-support. Clinical steps stay soft / advisory with mandatory break-glass; hard-blocking a clinical action is deliberately out of scope.

1 Authority Matrix — who can do what, up to what limit

The Scheme of Reservation & Delegation (SoRD) and Standing Financial Instructions (SFI) are held as versioned, effective-dated rows: role × decision × delegated limit × instrument. This is the single source of authority every process step is checked against — not prose buried in a policy document.

RoleDecisionAuthority limitInstrument
Budget HolderNon-pay procurement (quotes)£0 – £25kSFI
Budget HolderNon-pay procurement (single tender)requires waiverSFI
Service ManagerNon-pay procurement£25k – £50kSFI
DirectorNon-pay procurement£50k – £250kSFI
Chief ExecutiveNon-pay procurement£250k – £1mSoRD
Board / CommitteeNon-pay procurement> £1mSoRD

Served live from GET /p2p/authority (model P2PAuthorityRow). Because rows are effective-dated, a threshold change is a new version — the old limit is never overwritten.

2 Policy Bank — a source policy, generalised into a bindable process

Source policies are ingested and generalised into de-identified process definitions with bindable slots (the local thresholds, roles and routes) plus provenance. Each policy is clickable and drills through to its definition and its underlying process & escalation workflow.

PB-01 · Non-pay procurement

Finance · 4 slots · bound

Procurement value tested against the SFI thresholds above. The fully-encoded, API-backed process (below).

WorkflowLive steps via /p2p/process-steps?ref=PB-01

PB-02 · Safeguarding adults (S42)

Safeguarding · 3 slots · bound

Care Act 2014 s42 concern → threshold test → MASH → enquiry decision, involving the person and advocate.

WorkflowPractitioner → Safeguarding Lead → MASH → Safeguarding Adults Board

PB-03/04/05 · Waiver · Study leave · PSIRF

Finance · Workforce · Governance

Single-tender waiver, study-leave funding and a proportionate PSIRF incident response — each with its own steps & ladder.

WorkflowRepresentative per-policy workflows (Demonstrated)

Served live from GET /p2p/policy-bank (models P2PPolicyDef, P2PProcessStep). Clicking a policy opens its definition (domain, bindable slots, provenance, status) with the process & escalation workflow underneath — no dead rows. Licensing is checked per source before any generalised definition is redistributed.

3 Process Engine — the enforcement gradient (hard · soft · advisory)

A step is not simply "done / not done". Each carries an enforcement mode, and steps are promoted advisory → soft → hard as they are proven safe to enforce. This is the worked example for PB-01 · non-pay procurement vs SFI thresholds, end to end.

1

Raise requisition + specification

Requester · guided; free to proceed

ADVISORY — guide
2

Confirm budget code + funds available

Budget Holder · warn if no funds; override with reason

SOFT — warn + override
3

Check value vs SFI threshold

System · blocks if above the delegated limit — must escalate

HARD — blocks
4

Obtain quotes (or single-tender waiver)

Budget Holder · blocks award without the required quotes/waiver

HARD — blocks
5

Approval at correct SoRD level

Approver · routed to the role with authority for the value

HARD — blocks
6

Raise purchase order

Finance · PO number recorded to audit

SOFT — warn + override
7

Receipt + three-way match

Finance · reconcile PO / GRN / invoice

ADVISORY — guide
The rule that keeps it safe. A HARD step that fails does not silently stop — it triggers structured escalation (next section). And on any clinical pathway, hard-blocking is replaced by soft/advisory + break-glass so a clinician is never locked out of care.

4 Escalation & the immutable audit — what actually happened

When a hard step fails, authority is not overridden — it is escalated up the ladder until a role with the authority to decide assumes it. Every decision, override and escalation is appended to a SHA-256 hash-chained WORM audit (prev_hash → row_hash), re-verified server-side on every read — there is no update or delete endpoint.

Requester Budget Holder Service Manager Director Chief Executive Board / Committee

Worked example — REQ-4471. A £38,200 laptop order exceeds the Budget Holder's £25k limit: the system blocks, escalates, and authority is assumed one rung up.

#ActorActionMode
1j.reeves (Requester)Requisition REQ-4471 raised · £38,200 · IT laptopsadvisory
2s.patel (Budget Holder)Budget confirmed (code CC-2231)soft
3systemSFI check: £38,200 exceeds Budget Holder £25k — BLOCKED, escalatedhard
4a.morris (Service Manager)Assumed authority (£25k–£50k band) · 3 quotes attachedhard
5a.morris (Service Manager)Approved · PO-88123 raisedhard

Served live from GET /p2p/audit (model P2PAuditEvent). The response carries a chain_valid flag; if a single row is altered the chain fails and a tamper-evidence banner fires. This is the evidence stream for BAF / risk register / CQC.

5 Gated approvals & SLA escalation — the runtime

A hard step becomes a gate — an approval task assigned to a role or a named individual, with an SLA that auto-escalates on timeout. This is the runtime of the two sections above: a BPM approval engine (user task + candidate assignee + timer-boundary escalation) on the authority spine.

Author gates Raise instance Approve / reject SLA auto-escalate WORM audit
1

Author the gated process

Add ordered gates to a policy — each with an authoriser (role or named individual), an SLA, an escalation target and an optional e-signature. POST /p2p/gates

AUTHOR
2

Raise & route

Raising a policy creates one approval task per gate; only the active gate's SLA clock runs. Decide with approve / reject / request-info. /p2p/instances · /p2p/tasks/{id}/decide

ROUTE
3

SLA auto-escalation

An overdue gate re-routes to its escalation target, notifies the assignee, and writes the timeout to the immutable audit — evaluated lazily on read and via a swept /p2p/tasks/sweep. Idempotent (escalates once).

ESCALATE
4

Optional signature gate

A high-assurance gate requires a completed commvita Sign ceremony (external_ref p2p-task:{id}, 428 otherwise) — eIDAS-grade evidence bound to the decision.

SIGN
5

commvita writes the overview & policy summary

One click composes a plain-English process overview and policy summary — deterministic by default (works with no key / in CI), enhanced by the central AI provider when configured. POST /p2p/policy/{ref}/summarise

AI
Non-SaMD. The engine governs operational / authority approvals (procurement, waivers, study leave, PSIRF). On any clinical pathway, hard-blocking is replaced by soft/advisory + break-glass — a clinician is never locked out of care.

Models P2PGate · P2PProcessInstance · P2PApprovalTask · P2PPolicyDoc. Surfaced in the Gated Approvals tab (a live board with green / amber / overdue SLA badges) and the policy drill-through dialog (gate builder + commvita overview).

6 Jurisdiction Composition — porting the set safely

The same generalised process can be deployed to a second jurisdiction by binding its slots to local values. Conflict / gap detection blocks unbound deployment, and binding is a governance act, not a config toggle — it requires a recorded local mapping note and a completed commvita Sign ceremony (else the API returns 428), written straight to the WORM audit.

Requirement (example: a Gulf cluster)Bound?Local mapping
SFI thresholds bound to local delegated limits✓ boundcluster values mapped
SoRD roles mapped to local job titles✓ boundCEO → Cluster Director General
Procurement route (regulations) selected✓ boundlocal procurement law bound
Safeguarding referral authority mappedGAPno local S42-equivalent bound
Accountable local sign-off recordedGAPsign-off required before deploy

Served live from GET /p2p/compositions and the signature-backed POST /p2p/compositions/{id}/bind (model P2PComposition, linked to commvita Sign via p2p-comp:{id}). While any requirement is unbound, deployment is blocked — a jurisdiction is never quietly shipped with a governance gap.

Where each layer lives

LayerTabAPIModel / logicStandardStatus
Authority — who/what/limitAuthority Matrix/p2p/authorityP2PAuthorityRow — versioned, effective-datedNHS SoRD · SFILive
Policy Bank — generalised processPolicy Bank/p2p/policy-bank · /p2p/process-stepsP2PPolicyDef · P2PProcessStep · clickable drill-throughProcurement Act 2023 · Care Act s42 · PSIRFLive (PB-02–05 workflows Demonstrated)
Process Engine — enforcement gradientProcess Engine/p2p/process-steps?ref=PB-01hard / soft / advisory per step; break-glass on clinicalSoRD · SFI · Non-SaMDDemonstrated (PB-01 steps API-served)
Escalation + WORM auditEscalation & AuditGET/POST /p2p/auditP2PAuditEvent — SHA-256 prev_hash→row_hash, append-only, re-verified on readBAF · CQC SAF · GDPR Art.5(1)(f)Live (example events seeded)
Gated approvals — runtime engineGated Approvals/p2p/gates · /p2p/tasks/{id}/decide · .../sweepP2PGate · P2PApprovalTask · SLA auto-escalation · commvita Sign · AI summaryNHS SoRD · SFI · CQC SAF · eIDAS AdESLive
Jurisdiction CompositionJurisdiction Composition/p2p/compositions · .../bindP2PComposition · commvita Sign p2p-comp:{id} · 428 gateJurisdiction Profile PRD §4.6 · eIDAS AdESLive (example bindings seeded)
NHS Scheme of Reservation & Delegation · Standing Financial Instructions Procurement Act 2023 · Care Act 2014 (S42) · PSIRF · CQC Single Assessment Framework SHA-256 WORM audit · commvita Sign (eIDAS AdES) Non-SaMD governance control surface © 2026 Commvita Digital Health Solutions Ltd. All rights reserved.