A crew is told this address is tier 1.
They are never told why.

1. 1

   Four lists that don't talk

   Your electricity supplier, your gas supplier, the network operator and your health plan may each know you depend on powered medical equipment. None of them tells the others. The same household appears three times under three spellings, and nobody holds the union.

2. 2

   VIGIL merges them into one record

   It matches the same household across every source — including the awkward cases, like a married name in one register and a maiden name in another. When two records are genuinely ambiguous it keeps them separate and flags them, because wrongly merging two households makes one of them disappear.

3. 3

   It works out how urgent each household is

   From the medical facts, it computes a priority: tier 1 means hours matter, tier 4 means no elevated need. That calculation happens inside the region where the medical data was collected, and never leaves it.

4. 4

   Only the priority travels

   The tier is copied to every region, so a crew anywhere can read it instantly — even if the region holding the medical detail has gone dark with the rest of the grid. The reason stays put. A crew is told an address is tier 1; they are never told why.

5. 5

   And afterwards, it can prove what it knew

   Every dispatch, every access, every refusal is recorded. After an outage you can reconstruct exactly what the register knew at 2pm that day — not what we know now — which is the only fair question to ask of the people who had to act on it.

One household. The wall between the two panels is a database boundary, not a permission flag.

The same request, two tokens

# as the dispatcher — refused in every jurisdiction, always
curl -H "Authorization: Bearer $DISPATCHER"   https://main.drsi2hrw3uwzy.amplifyapp.com/api/v1/households/$ID/reason
# 403  "role dispatcher may never read.care_need"

# as the Atlanta caseworker, for an Atlanta household — granted
curl -H "Authorization: Bearer $ATLANTA"   https://main.drsi2hrw3uwzy.amplifyapp.com/api/v1/households/$ID/reason
# 200  { "needs": [ { "kind": "oxygen_concentrator", "tolerance_hours": 8 } ] }

There is no API-specific permission code. Every route calls the same can() the web app and the CLI call — one implementation of who may read a diagnosis, so the three surfaces cannot drift apart. Refusals carry the reason, and both outcomes are written to the disclosure log before the response is sent.