Requirements Wishlist for Production-readiness

[reinkrul]

This discussion is intended to collect requirements for the Knooppunt to be considered "production-ready": a state in which EHR vendors can and are willing to integrate and deploy it in their production environment. It applies to the following scope:

• Policy Decision Point (PDP)

It concerns non-functional requirements, for example (but not limited to):

Security & compliance
Authentication/authorization for the PDP evaluation API, compliance with NEN 7510 / ISO 27001, GDPR data handling (what patient data is logged/stored and for how long).

Audit logging
Tamper-evident logs of every authorization decision (who requested what for which patient, allow/deny, timestamp). Required for NEN 7510 and traceability in healthcare contexts.

Observability
Structured logging, metrics (Prometheus/OpenTelemetry), health check endpoints, readiness/liveness probes.

High availability & reliability
Stateless/stateful behavior, horizontal scaling, behavior during dependency failures (PIP down, MITZ unreachable), uptime expectations.

Performance
Maximum acceptable latency per authorization decision (the PDP sits in the critical path of every FHIR request), throughput requirements under peak load.

Deployment & operations
Supported deployment models (Kubernetes, bare metal, managed cloud), resource requirements (CPU/memory), configuration management, secrets injection, upgrade procedures with zero downtime.

Versioning & backwards compatibility
API and configuration stability guarantees, migration paths between versions.

Multi-tenancy
Whether a single Knooppunt/PDP instance can serve multiple care organizations (URA isolation), data separation guarantees (running Knooppunt PDP as SaaS), having 1 PDP PIP for all care organizations, v.s. a PIP per care organization.

Documentation & testability
Integration guides, reference PEP implementations, conformance test suite vendors can run against their PIP/PEP implementation before going to production.