ClearpathStillwater Counseling — practice operations
Learning project, synthetic data only. Clearpath applies HIPAA-inspired design principles. It is not HIPAA-compliant software and must never hold real client data.
There is no authentication here — pick a person and the app runs as them. Authorization is real: every screen below is decided by the same permission matrix a signed-in user would meet.
The roles marked 2FA seam are the ones a real deployment would put behind a second factor — they reach clinical records, the practice manager through break-glass. The policy that decides that is written and tested in permissions.ts; the check it would gate is not built, because a login that always succeeds looks like a feature.