¶ Dental App — Live Walkthrough: Run Report
¶ Summary
| Field | Value |
|---|---|
| Scene | agents/hermes/demo_scenes/dental_walkthrough |
| Run ID | dental_walkthrough_20260804T130114Z |
| Started (UTC) | 2026-08-04T13:01:14Z |
| Result | PASS |
| Roles demonstrated | Reception → Dentist → Practice Manager → Admin |
| Steps | 60 / 60 executed, 0 failures |
| Screenshots | 15 |
| RBAC check | Reception → Financial = 403 blocked (as designed) |
¶ What this demo showed
A live, narrated walkthrough of the VeriPath dental booking module on the
Test Client Dental practice instance (test-client-dental realm), proving
that role-based access control (RBAC) isolates what each staff role can see:
- Reception — practice calendar, appointments, recalls; blocked from
Financial (403, requiresDENTAL_ADMIN/DENTAL_PRACTICE_MANAGER). - Dentist — FP17 NHS claims (incl. claim detail), clinical charting,
periodontal exams, radiographs. - Practice Manager — Financial dashboard, seat licensing, staff rotas.
- Admin — appointment zones, provider schedule blocks, provider management.
The scene is read-only (no data submitted). All test credentials were
test123 (test-client-dental realm, dummy accounts only — no patient PII).
¶ Step log
| # | Role | Action | Result | Screenshot |
|---|---|---|---|---|
| 1 | — | NOTE: Front of house — receptionist manages calendar, appointments, recalls | OK | — |
| 2 | RECEPTION | USER switch (isolated session) | OK | — |
| 3 | RECEPTION | NAVIGATE → app root (Keycloak redirect) | OK | — |
| 4 | RECEPTION | KEYCLOAK_LOGIN | OK | — |
| 5 | RECEPTION | VERIFY_VIEW → /dental/practices/ |
OK | — |
| 6 | RECEPTION | VERIFY_TEXT → "Test Client Dental Practice" | OK | — |
| 7 | RECEPTION | SCREENSHOT | OK |  |
| 8 | RECEPTION | NAVIGATE → /dental/appointments/ |
OK | — |
| 9 | RECEPTION | VERIFY_VIEW → /dental/appointments/ |
OK | — |
| 10 | RECEPTION | SCREENSHOT | OK |  |
| 11 | RECEPTION | NAVIGATE → /dental/recalls/ |
OK | — |
| 12 | RECEPTION | VERIFY_TEXT → "Recall Management" | OK | — |
| 13 | RECEPTION | SCREENSHOT | OK |  |
| 14 | RECEPTION | NAVIGATE → /dental/financial/ |
OK | — |
| 15 | RECEPTION | EXPECT_403 (RBAC block) | PASS — status 403, "Required roles: DENTAL_ADMIN, DENTAL_PRACTICE_MANAGER" | — |
| 16 | RECEPTION | SCREENSHOT (403 evidence) | OK |  |
| 17 | — | NOTE: Clinical — dentist reviews FP17, charting, perio, radiographs | OK | — |
| 18 | DENTIST | USER switch (previous session signed out first) | OK | — |
| 19 | DENTIST | NAVIGATE → app root | OK | — |
| 20 | DENTIST | KEYCLOAK_LOGIN | OK | — |
| 21 | DENTIST | VERIFY_VIEW → /dental/practices/ |
OK | — |
| 22 | DENTIST | NAVIGATE → /dental/fp17/ |
OK | — |
| 23 | DENTIST | VERIFY_TEXT → "FP17" | OK | — |
| 24 | DENTIST | SCREENSHOT | OK |  |
| 25 | DENTIST | CLICK → first claim row (Claim #72) | OK | — |
| 26 | DENTIST | SCREENSHOT (claim detail) | OK |  |
| 27 | DENTIST | NAVIGATE → /dental/charts/ |
OK | — |
| 28 | DENTIST | VERIFY_TEXT → "Chart" | OK | — |
| 29 | DENTIST | CLICK → first chart row (Tooth 27) | OK | — |
| 30 | DENTIST | SCREENSHOT | OK |  |
| 31 | DENTIST | NAVIGATE → /dental/perio/ |
OK | — |
| 32 | DENTIST | CLICK → first perio exam row | OK | — |
| 33 | DENTIST | SCREENSHOT | OK |  |
| 34 | DENTIST | NAVIGATE → /dental/radiographs/ |
OK | — |
| 35 | DENTIST | SCREENSHOT | OK |  |
| 36 | — | NOTE: Practice Manager — financials, seats, staff rotas | OK | — |
| 37 | MANAGER | USER switch (previous session signed out first) | OK | — |
| 38 | MANAGER | NAVIGATE → app root | OK | — |
| 39 | MANAGER | KEYCLOAK_LOGIN | OK | — |
| 40 | MANAGER | VERIFY_VIEW → /dental/practices/ |
OK | — |
| 41 | MANAGER | NAVIGATE → /dental/financial/ |
OK | — |
| 42 | MANAGER | VERIFY_VIEW → /dental/financial/ |
OK | — |
| 43 | MANAGER | SCREENSHOT | OK |  |
| 44 | MANAGER | NAVIGATE → /dental/seats/ |
OK | — |
| 45 | MANAGER | SCREENSHOT | OK |  |
| 46 | MANAGER | NAVIGATE → /dental/staff/ |
OK | — |
| 47 | MANAGER | SCREENSHOT | OK |  |
| 48 | — | NOTE: Admin — settings, zones, schedules, providers | OK | — |
| 49 | ADMIN | USER switch (previous session signed out first) | OK | — |
| 50 | ADMIN | NAVIGATE → app root | OK | — |
| 51 | ADMIN | KEYCLOAK_LOGIN | OK | — |
| 52 | ADMIN | VERIFY_VIEW → /dental/practices/ |
OK | — |
| 53 | ADMIN | NAVIGATE → /dental/settings/zones/ |
OK | — |
| 54 | ADMIN | VERIFY_TEXT → "Zone" | OK | — |
| 55 | ADMIN | SCREENSHOT | OK |  |
| 56 | ADMIN | NAVIGATE → /dental/settings/schedules/ |
OK | — |
| 57 | ADMIN | SCREENSHOT | OK |  |
| 58 | ADMIN | NAVIGATE → /dental/providers/ |
OK | — |
| 59 | ADMIN | SCREENSHOT | OK |  |
| 60 | — | NOTE: Walkthrough complete — all four roles + RBAC block | OK | — |
¶ Key screenshots
¶ Reception — RBAC block (the headline check)
The receptionist reaches /dental/financial/ and is denied:
¶ The same view, one role up
The Practice Manager opens the Financial Dashboard without issue — exactly the
access the receptionist was denied:
¶ Clinical work (Dentist)
¶ Administration (Admin)
¶ Live Q&A
This run was interactive (control channel live). No viewer questions were
received during the run — the chat stayed quiet apart from the operator's
single pause at 13:02:02Z, which was honoured (run held, then auto-resumed
after the 300s wait per protocol). Full narration transcript is available in
the run's outbox.json (20 narration entries).
¶ Development notes
None — no --note requests were submitted by the audience during this run.
(No notes.md was produced; the OpenCode feedback log was untouched.)
¶ Environment notes (for reproducibility)
- Sessions are shared across browser
task_ids on this host, so each role
switch signs the previous session out first via{URL}/oidc/logout/before
logging in the next role. This is the documented behaviour of the demo
environment and kept Keycloak cookies clean — no cross-role bleed occurred. - During the operator pause, Keycloak idle session expiry bounced back to the
login screen once; the receptionist leg re-authenticated and completed
normally. No verification failures resulted. - All test data shown (patients "James Carter", "Elena Popova", "Ahmed Khan",
"Maria Lopez", "Tom Bennett"; staff "Nguyen, Amy", "Holloway, Sarah",
"Haddad, Omar") is synthetic dummy data — no real patient PII (DSPT
Category 3 compliant). No secrets or internal addresses are disclosed.