Sentinel combines functional permissions with disease-level and record-level access controls. A user must have permission to perform an operation and access to the disease and record involved.
Disease access can be configured for roles and individual users. Restrictions account for the disease hierarchy. Temporary disease-access assignments can provide access for a defined period, supporting time-limited participation in an investigation or response.
Functional permissions govern activities such as viewing, creating, editing, deleting, configuring and exporting. Disease access does not independently grant all of these activities.
Case-linked information, including laboratory results, exposures, notes, attachments, tasks and surveys, follows the relevant investigation-access scope. Reports and exports also require access to their underlying records.
Audit history supports tracing investigation and configuration changes, including the user, time and recorded changes.
Users can optionally enrol a TOTP-compatible authenticator application. The repository documents security controls and an internal OWASP ASVS Level 1 self-assessment; this is not an independent certification.