Demo Script

Step-by-step presenter guide for the Healthcare vertical. Switch verticals below to see the matching credentials and flows.

Credentials

Name	Role	Login email	Password
Jane Patient	owner	owner@atko.email	Demo123!
Chris Carer	delegate	delegate@atko.email No standing access — earned via delegation / approval flows.	Demo123!
Dr. Morgan	admin	approver@atko.email	Demo123!
Sam Nurse	member	member@atko.email	Demo123!
Unrelated User	none	outsider@atko.email	Demo123!

Flow 1

Auth0 FGA controls resource visibility — the owner sees their patient records, an outsider sees nothing.

Personas:owner@atko.emailoutsider@atko.email

Before you start

1
Browser A → Dashboard
→ Patient records load with an FGA-filtered badge. Open Inspector → FGA Authorization: listObjects returns all record IDs with can_view = ALLOWED and current_time auto-injected.
2
Browser B → Dashboard
→ Empty state — "No patient records you are authorised to view." FGA panel shows an empty listObjects result. No tuples exist for the outsider.

Flow 2

Account owner grants scoped time-bounded access to a carer, who accepts — then the owner revokes and access disappears immediately.

Personas:owner@atko.emaildelegate@atko.email

Before you start

1
Browser A → Delegations. Complete MFA step-up when prompted (SMS code appears in OTP Inbox, or check atko.email for the email OTP). Fill the grant form: To delegate@atko.email · Type Carer · Resource any patient record · Scopes appointments:read, records:read · Expiry 30 days → Submit.
→ New row appears under "Delegations you've granted" with status Pending.
2
Browser B → Delegations
→ Pending invitation card shows the resource, scopes, and expiry date.
3
Browser B → Click Accept
→ Card moves to "Access granted to you" with status Active. Inspector → Delegations panel shows the FGA delegate tuple with valid_until and scopes.
4
Browser B → Dashboard
→ Only the delegated patient record is shown — not Jane's full list. FGA-filtered badge present. This is scoped delegation.
5
Browser A → Delegations → click Revoke (MFA step-up if prompted)
→ Status changes to Revoked. FGA conditional tuple removed.
6
Browser B → Refresh Dashboard
→ Empty state. Access removed immediately — no tuple means can_view returns false.
7
Either browser → Audit Trail
→ delegation:create → delegation:accept → delegation:revoke, each with actor, subject, and correlation ID.

Flow 3

Chris Carer enters delegated mode, receiving an OBO token (sub=patient, act.sub=carer) visible in the inspector.

Personas:delegate@atko.email

Before you start

·Browser B (Chrome): Chris Carer — delegate@atko.email
·Prerequisite: Flow 2 complete — Chris Carer has an active delegation on Jane's record.

1
Browser B → Dashboard
→ Context switcher shows "Available delegated contexts" with Jane Patient's record.
2
Browser B → Click Act on behalf of Jane Patient
→ Amber/indigo banner appears: "Acting on behalf of… · delegation [id] · expires [time]". Dashboard heading reads "Viewing on behalf of…".
3
Browser B → Inspector → On-Behalf-Of Token
→ Decoded JWT: sub = Jane's Auth0 sub (represented party), act.sub = Chris's Auth0 sub (actor), scope = granted scopes, 15-minute expiry. Note confirms this is a custom RFC 8693 convention token — not a native Auth0 token exchange.
4
Browser B → Click Stop in the banner
→ Banner clears. Dashboard returns to "Acting as myself". OBO cookie cleared.

Flow 4

A nurse with no standing access requests it; the patient approves from their inbox — creating an active delegation on the spot.

Personas:member@atko.emailowner@atko.email

Before you start

·Browser A (Safari): Jane Patient — owner@atko.email / Demo123!
·Browser B (Chrome): Sam Nurse — member@atko.email / Demo123! (if running in order, log out of delegate@atko.email first)

1
Browser B → Requests. Fill the form: Resource any patient record · Reason "Need to view appointment schedule to coordinate care" · Scopes appointments:read → Submit.
→ My Requests shows the new entry with status Pending.
2
Browser A → Requests
→ Approver inbox shows the pending card: Sam's email, target record, scopes, and reason.
3
Browser A → Click Approve
→ "Approved — access granted to the requester."
4
Browser B → Dashboard
→ The requested patient record now appears with FGA-filtered badge. Inspector → Delegations shows the new active delegation created by the approval.
5
Either browser → Audit Trail
→ request:create → request:approve, with delegationId referencing the auto-created delegation.

Run npm run demo:reset between demo runs to clear delegations, requests, and audit events.