Build the hospital clinics

The hospital layer turns the directory into General Hospital: specialty clinics, back-office functions, and the shared folders each can reach. It builds on top of seeded users and is fully idempotent.

Build it

make clinics

That runs two scripts in order:

1. scripts/seed-er-cast.sh seeds the ER (TV show) cast as clinical staff into OU=Clinical, each with a role (title) and a clinic (department).
2. scripts/setup-clinics.sh creates one security group per clinic, the nested meta-groups, the back-office group membership for the 80s admin staff, and the group-gated shares.

Inspect the result:

make show-clinics        # every group's members, the meta-groups, and the shares

What gets created

Per-department groups (19): one per clinic and ancillary service (Cardiology, Pediatrics, Radiology, …) plus the four admin functions (Administration, Billing, Medical-Records, IT).

Nested meta-groups, the load-bearing trick:

• Clinicians contains the 15 clinical and ancillary groups (not individual people). It gates patient data.
• GH-Staff contains Clinicians plus the four admin groups. It gates the all-staff share.

Three share shapes under /srv/shares on the DC:

Share	Gate	Behaviour
[cardiology] … (19)	valid users = @AD\<Group>, read-write	Team folder, members collaborate
[all-staff]	valid users = @AD\GH-Staff, read only = Yes, write list = @AD\Administration	Everyone reads, only Administration writes
[phi]	valid users = @AD\Clinicians, read-write	Patient records, clinicians only

Prove the boundary

make test-clinic-access

A clinician (john.carter) reaches cardiology and phi but not billing; an admin user (madonna) reaches billing but is denied phi, and can read but not write all-staff. The reason this works with nobody named on the phi share is group nesting.

Edit the clinics

Both scripts are driven by tables you can edit:

• The clinical roster (who works in which clinic) is the ER_CAST table in scripts/seed-er-cast.sh.
• The groups, their members, the nesting, and the shares are the CLINIC_ROWS, NESTED, and share tables in scripts/setup-clinics.sh.

Change a table, re-run make clinics, and the domain converges. The full group-and-share map is in the groups and shares reference.