The EMR Cowork substrate brings the coworker paradigm to the hospital floor. P0 ships cowork_agents identity and threads an agent_id through the LLM audit log, so every AI action is attributable.
P1 adds cowork_proposals and an agent_proposal acknowledgement: coworkers draft proposals that a human accepts, edits, or rejects in the Inbox, dispatched through a cowork-proposal-decide edge function.
The substrate enforces three data planes — Clinical, Operational, and Growth — at the database-grant level, with Growth walled off behind PDPA consent. It is recommender-first by design: no autonomous clinical writes, off by default, with a kill switch.