HAL drafts changes; for anything touching coverage rules or institutional memory, nothing is applied until you approve it.Before a change goes live, Orbit checks it against your rules: credentials, duty hours, days off, and people who must never be paired.Every change HAL makes is logged with who asked, what changed, and why.Any HAL change, or everything from one chat, can be undone in one click.All of this is shipped, not roadmap.
Each HAL action is recorded with who asked, what was asked, HAL's reasoning, and the exact before-and-after of everything it changed.Records are kept 180 days by default; each organization can set its own window or place a legal hold.
One click undoes a single HAL action, or everything HAL did in one chat, as a single all-or-nothing change.If you have since edited something HAL changed, Orbit asks before overwriting your edit.
Before HAL changes the schedule, Orbit checks five rules: credentials present and current, duty hours within the 80-hour limit, no more than six days in a row, one day off in seven, and people who must never be paired.A broken rule either stops the change or shows as a logged warning.
Each log entry records why HAL chose the action, what it was working from, and what alternatives it considered, shown in plain English.
Each HAL tool is set to one of three levels: suggest only, ask before applying, or apply automatically.Admins can make any tool stricter, never looser.Anything touching institutional memory or coverage rules asks first by default.
Over a rolling 90 days, Orbit tracks how often you accept what each HAL tool suggests.If you keep rejecting a tool, Settings shows it, and that record decides whether the tool may be given more room.
When HAL proposes a change, such as covering a callout, drafting next week, or applying time off, the rule check runs before you see it.If the cover person is over the 80-hour ACGME limit, lacks a required credential, or breaks a never-pair rule, the proposal is stopped or shown with a warning.
For tools that ask first, HAL drafts, you see exactly what will change, and you approve it.Any tool you haven't set uses the stricter default.
Each entry holds who asked, HAL's exact instructions, the level that applied, its reasoning, and the before-and-after for every record it changed, with nothing summarized.In Settings, a chair, coordinator, or chief resident can scroll back through every HAL draft, change, and undo in the program.
Undo reverses each change the action made, restoring what was there before.If someone has edited a placement since HAL changed it, undo pauses and asks.
Every accept, edit, or reject feeds each tool's 90-day agreement rate.A tool accepted 95% of the time for 90 days has a record to justify more room; one at 60% does not.
More than sixty automated test sets check HAL against thousands of realistic cases: empty schedules, edge cases, hostile requests, hidden instructions planted in text (prompt injection), keeping programs' data apart, and emergency routing.Each set has pass-rate thresholds plus hard limits that fail the whole run if broken even once.Each set must pass several runs in a row before it ships.Ask us for the current results.
Orbit holds scheduling information: who works when, where, and with what credentials.It does not hold patient identifiers, appointments, case histories, or clinical notes; those stay in your own systems.The data isn't there to leak.
Someone invited to one program can't read another program's schedule, audit log, members, institutional memory, or HAL chats.The database's access rules (Firebase Realtime Database) refuse the request on the server, before any app code runs.The isolation tests above check this on every release.
Orbit's commercial terms prohibit using what HAL receives to train any model.HAL is sent only what the request needs: schedule structure, the active week, the person in focus, and relevant institutional memory.
Several test sets plant hidden instructions in handoff fields, closure descriptions, institutional memory, and chat, trying to make HAL ignore its rules.Obeying one even once fails the run, and that count is at zero.