Identity & Access
A vendor-neutral Identity Broker — plus a clinical Authorization Decision Service.
Neriant is not permanently dependent on Cognito, Keycloak, Okta, Entra or NHS CIS2. Identity providers are pluggable. The clinical access brain — RBAC, ABAC, PBAC, consent, treating relationship, break-glass — is owned by the platform.
Architecture
Authentication is brokered. Authorization is clinical.
Claim normalization · federation · token exchange · tenant context · session context
RBAC · ABAC · PBAC · consent · care-relationship · break-glass · audit evidence
Identity Broker
One normalized identity model. Pluggable everything underneath.
The broker translates whatever the upstream IdP issues into a stable internal structure every clinical module understands.
| Normalized attribute | Purpose |
|---|---|
| User ID | Stable internal identity for clinician, patient, admin, service account or integration. |
| Tenant ID | Separates SaaS tenants, hospital groups, regional HIE participants and sovereign deployments. |
| Organisation ID | Links the user to a trust, hospital, clinic, lab, payer, government agency or care network. |
| Role & job function | Doctor, nurse, pharmacist, administrator, researcher, patient, auditor, or integration service. |
| Professional registration | GMC, NMC, state medical board, nursing council, pharmacy regulator, country-specific registries. |
| Care setting & department | Ward, clinic, specialty, ED, theatre, pharmacy, lab, imaging. |
| Authentication assurance | MFA, smartcard, passkey, NHS CIS2, SAML, OIDC, biometric — recorded with the session. |
| Session risk | Drives step-up authentication and additional checks for sensitive actions. |
Authorization Decision Service
In healthcare, role-based access alone isn't enough.
Access depends on clinical context, consent, duty of care, regulatory rules, professional responsibility and patient safety. The ADS is where those decisions live.
Pluggable identity providers