HERO Control
Modeling records that exist before the person they describe does.
Both of these looks like UI features and are actually state modeling problems. The referral system spans three user types with genuinely different permissions and flows, and referral state has to persist across interactions where the two parties see different things and act at different times. Profile claiming is stranger: unclaimed profiles exist as real records before their subject ever authenticates, then get claimed through identity verification — SSN validation for healthcare seekers. A mistake their hands one patient's record to another person.
I built both on an MVP architecture with explicit interface and implementation layers separating state, view visibility, and service-side verification, rather than letting visibility rules double as authorization. Hiding a record and refusing to serve it are different guarantees, and only one survives a crafted request.
In healthcare, identity resolution is a security boundary wearing a UX costume.