{/* Header */}

{/* HERO — technical-brief abstract */}

DEVELOPER BRIEF / 2026.04 For web development handoff

Cybersecurity training built for the people who actually run a hospital.

Nurses get short lessons they can finish between shifts. Managers get the numbers the auditors want. IT gets a platform that doesn't bake AI into anything that has to be defensible later. That's the whole thing.

Blunt implementation rule

"The first release must be stable, secure, measurable, and medically relevant. If the team chases clever features too early, the platform will become slower to build and harder to validate."

{/* Right — audience & stance table (from brief) */}

{/* § 01 — v1 IN SCOPE */}

§ 01 — IN SCOPE

Six modules. One workflow.

It has to change habits on the ward. Not just produce a completion certificate.

Every module depends on the one before it. Content, permissions, simulations, and dashboards all key off the user's role and ward. Get those right once and the rest becomes much easier.

{scopeItems.map((s, i) => { const Icon = s.icon; const col = i % 3; const row = Math.floor(i / 3); return (

{s.area}

{s.must}

Why

{s.why}

); })}

{/* § 02 — v1 OUT OF SCOPE */}

§ 02 — OUT OF SCOPE

What this release is not.

What we're not doing in this release.

Some of this lands in phase 2 or 3. Doing it all now would drag the release out for months and make it hard to tell what actually works.

{outOfScope.map(item => (

{item}

))}

The rule we keep reminding ourselves of

Don't chase clever features early. The first release has to be stable, secure, measurable, and clinically useful. The rest can wait.

{/* § 03 — ARCHITECTURE */}

§ 03 — ARCHITECTURE

Service boundaries.

The important stuff runs on plain backend code. The AI slot exists, but nothing's plugged into it yet.

The frontend never calls a model. Login, permissions, scoring, audit records, compliance exports. All of it runs on normal backend code. That way the evidence we hand an auditor doesn't suddenly change because someone swapped a prompt.

{/* Architecture SVG — 3 rows, AI boundary offset to the right so no arrow ever crosses a box. Core Backend fans out: solid arrows down to v1 services, dashed arrow right-down to the AI boundary. */}

{/* Legend */}

Shipping in v1 Slot for phase 2, empty for now

What never becomes AI

Login, permissions, scoring, audit records, compliance exports. All of it is plain backend code. The browser doesn't talk to a model at any point.

What AI does when it shows up

Drafts content. Suggests remediation text. Writes a summary for a manager. A human signs it off before anyone sees it. Never the last word on anything that matters.

{/* § 04 — DESIGN ANCHORS */}

§ 04 — DESIGN ANCHORS

Standards we check against.

Real standards, not badges for the homepage.

The five below are what we actually check against while building. OWASP ASVS for app security. WCAG 2.2 for keyboard and screen reader users. NIST 800-61 for how incidents get triaged. HIPAA for anything touching staff or ePHI. NIST CSF 2.0 sits on top as the overall scaffold.

{anchors.map(a => (

{a.name} {a.code}

{a.lines.map((line, j) => (

— {line}

))}

A hard line on AI

A model does not decide who logs in, what you can access, what score you got, how serious an incident is, what counts as compliance evidence, or what goes in the audit log. That work stays with humans and deterministic code.

What data we use

Development, demos, and training content use synthetic data. Real patient data goes nowhere near any of this without the proper internal approval.

{/* § 05 — PILOT ACCEPTANCE CRITERIA */}

§ 05 — PILOT CRITERIA

What has to be true before it ships wider.

One group first. Find the broken bits there, before everyone else sees them.

The checklist below has to pass before the pilot goes beyond the first ward. Numbers get captured from day one so we can look at behavior change, not guess at it.

{/* Acceptance criteria list */}

Must pass before wider rollout

{pilotCriteria.map((c, i, a) => (

{String(i + 1).padStart(2, '0')} {c}

))}

{/* Metrics that will be measured */}

Numbers we track

{pilotMetrics.map(([l, s], i) => { const col = i % 3; const row = Math.floor(i / 3); return (

{l}

{s}

Measured at kick-off. Checked again 90 days in.

); })}

{/* CTA strip */}

Demo build. Fake data. Runs from a laptop.

{/* Footer — minimal */}