The access model
Delegation without
handing over the keys.
The practical reason a practice shares passwords is that the software never gave it another option. FeelOrganized starts from the other end: the administrator is a first class user with their own identity, and everything they can do is something a clinician deliberately granted.
Principles
Six rules the product is held to.
One human, one identity
Every administrator signs in as themselves. There is no shared account, no team login, and no seat that two people take turns using. If an action happened, a named person took it.
Access is granted, never assumed
A clinician grants specific permissions on a specific practice. A role is a convenient bundle of grants, not a source of authority on its own. Nothing is inherited quietly.
Least privilege is the default
Grants start narrow. Viewing the schedule does not imply editing it. Sending mail on behalf of a practice does not imply reading the inbox. The catalog below is deliberately fine grained.
Attribution cannot be turned off
Every write records the actor, the clinician it was done for, the grant that permitted it, and the scope that was exercised. There is no configuration that removes it.
Revocation is immediate and total
Withdrawing a grant ends the access at once. There are no passwords to rotate afterwards, because there were never any passwords to share.
Time bounded by choice
A grant can carry an end date. Cover for a leave, a short engagement, or a trial period stops on its own instead of relying on somebody to remember.
The catalog
What a clinician can actually grant.
This is the permission vocabulary. A grant is one or more of these, attached to one practice, held by one named administrator. The integrations behind them are still being built, and the vocabulary is what they will be built against.
Practice management
Scheduling and front desk work, without handing over the login that also opens the chart.
- View the scheduleRead only
See appointment times, locations, and availability.
practice.schedule.read - Book and move appointmentsWrite access
Create, reschedule, and cancel appointments.
practice.schedule.write - View client contact detailsSensitive
Name and contact information only. Clinical records are never in scope.
practice.client.contact.read - Manage intakeWrite access
Send intake forms, chase completion, mark intake done.
practice.intake.manage
Billing
Enough to keep claims and balances moving, and nothing that moves money on its own.
- View balances and claimsRead only
Read the current ledger, claim status, and aging.
billing.ledger.read - Submit and resubmit claimsWrite access
File claims and work rejections on the clinician's behalf.
billing.claim.submit - View capitated spenddownRead only
Track contracted spend against the cap in the current period.
billing.spenddown.read - View payoutsRead only
Read deposits and remittances. No ability to initiate one.
billing.payout.read
Workspace
The most over shared credential in a small practice, reduced to the parts an admin actually needs.
- Manage the calendarWrite access
Read and edit the clinician's working calendar.
workspace.calendar.manage - Send on behalf ofSensitive
Send from the practice address with the sending admin recorded on every message.
workspace.mail.send_as - Access a named folderWrite access
One folder, granted by name. Not the whole drive.
workspace.drive.folder - Manage the practice lineWrite access
Answer, route, and return calls on the practice number.
workspace.voice.manage
Marketing
Drafting is delegated. Publishing stays behind the clinician's approval.
- Draft postsWrite access
Write and queue social content for review.
social.post.draft - Publish approved postsWrite access
Schedule and publish only what the clinician has already approved.
social.post.publish - Connect social accountsSensitive
Attach and detach the practice's social profiles.
social.account.connect
People and payroll
The employment record, separated from the clinical record it usually sits next to.
- Manage timesheetsWrite access
Record, correct, and approve hours for the practice.
people.timesheet.manage - View employment recordsSensitive
Roles, start dates, and status for staff at the practice.
people.record.read - File people actionsSensitive
Record promotions, remediations, and terminations with their paperwork.
people.action.file
Feel Family
One integration among several. FeelOrganized manages the stack a practice already runs on.
- Provision Feel accountsWrite access
Create FeelCharts, FeelGuide, FeelSuper, and FeelConnected accounts on the clinician's behalf.
feel.account.provision - Maintain the directory listingWrite access
Keep the clinician's public profile and openings current.
feel.directory.manage
Attribution
What the record keeps.
An audit log is only worth having if it answers the question people actually ask, which is who did this. Because the administrator has their own identity and acts under a named grant, the answer is in the row rather than in somebody's memory.
Every write carries the fields on the right. They are recorded at the time of the action, they are not editable, and they are visible to the clinician whose practice was touched.
See the audit screenoccurred_atWhen the action happened, to the second.
actorThe human who acted, by their own identity.
on_behalf_ofThe clinician or practice the action was taken for.
grant_idThe specific grant that permitted the action.
scopeThe named permission that was exercised.
actionWhat was done, in the system's own vocabulary.
targetThe record that was touched.
source_ipWhere the request came from.
The line
Things FeelOrganized will not do.
Written down because the pressure to break each of these will be real, and it will always arrive dressed as a shortcut for a busy week.
- Ask a clinician for their password to another system.
- Store, encrypt and hold, or pass along a credential that belongs to someone else.
- Offer a shared login for a team, however convenient it would be.
- Let an administrator act without an active grant that names the permission.
- Write an action to the record without the human who took it.