KrinosAI — Stakeholder Register
Template ID: TPL-01-02 | Stage: 01-Start-Project | Version: 0.3
Record: KAI-VORAL-STK-001 — retrospective draft for Visionary Oral. Not approved.
Purpose: List everyone who decides, contributes to or is affected by the project, with their authority and how they are kept informed.
Required inputs: Project brief; organization chart; customer contacts.
Document control
| Field |
Required entry |
| Document ID |
KAI-VORAL-STK-001 |
| Template used |
TPL-01-02 Stakeholder Register v0.3 |
| Product / project / software version or commit SHA |
VORAL (Visionary Oral) / PRJ-001 / a6b4429e3165 (branch app_dev of AI-Dental-Project/Visionary_Oral) |
| Record status and version |
Draft v0.1 |
| Author / technical reviewer / quality reviewer |
Claude Code (drafted with Claude Code for KrinosAI) / Tech Lead (name to be assigned) / Security & Privacy Officer (name to be assigned) |
| Created / updated / approved dates |
2026-10-27 / 2026-10-27 / Pending |
| Applicable SOP and revision |
SOP-LC-01 v0.3 |
| Related issue, commit, requirement and evidence links |
KAI-VORAL-BRF-001 (roles), KAI-VORAL-IRS-001 (reviewers, vendors), KAI-VORAL-CHR-001; contributors from git shortlog -sn at a6b4429 |
| Approver and decision record |
Pending |
Applicability and evidence baseline
Product / system boundary: As in KAI-VORAL-BRF-001: web app and API (dentalapp/), doctor/admin mobile app (mobile/), PDF Lambda (dentalapp/pdf-lambda/) at a6b4429e3165, plus the external services they call.
Related approved requirements, risks and change records: None approved. Related drafts: KAI-VORAL-BRF-001, KAI-VORAL-IRS-001, KAI-VORAL-DEC-001.
Retrospective record? Yes — follows the Retrospective Documentation Protocol (KrinosAI lifecycle pack, 05-References/). No organisation chart, governance policy or customer list was available; roles come from the brief and the risk screen, contributors from Git history (Observed), and named people are Not recorded unless evidence exists.
Acceptable evidence: an implementation reference (file:line at a commit SHA), a dated test record, a signed decision, a vendor agreement, or another independently verifiable artifact. Never invent approvals, clinical results, measurements or performance data.
1. Stakeholder identity and interest
| ID |
Name / role |
Organization |
Interest or concern |
| STK-001 |
Sponsor — Product Owner (name to be assigned) |
KrinosAI |
Business case, budget, go/no-go; approves the charter |
| STK-002 |
Product Owner — Sponsor (name to be assigned) |
KrinosAI |
Scope, intended use, outcomes, requirements |
| STK-003 |
Tech Lead / Engineering lead — Sponsor (name to be assigned) |
KrinosAI |
Architecture, feasibility, branch and release health, technical decisions |
| STK-004 |
Web and backend developers — Observed contributors to dentalapp/: AbhinavNair0077 (157 commits), Sohamkhot19 (85), niyati-krinosai (14), niy-ati (7), Soham Ramesh Khot (3). Representative: Tech Lead (name to be assigned) |
KrinosAI |
Web app, API routes, report, admin console |
| STK-005 |
Mobile developers — Observed contributors to mobile/: Sohamkhot19 (6), niyati-krinosai (6), niy-ati (4). Representative: Tech Lead (name to be assigned) |
KrinosAI |
Doctor/admin app, offline queue, on-device models, builds |
| STK-006 |
ML Lead — Tech Lead (name to be assigned) |
KrinosAI (Visionary_oral_ML repository) |
Detection models, ML service, model and dataset rights, phone-vs-server agreement |
| STK-007 |
Security & Privacy Officer — Sponsor (name to be assigned) |
KrinosAI |
Patient data, DPIA, vendor agreements, the committed credentials and backups (OPEN-007, OPEN-008) |
| STK-008 |
Qualified regulatory reviewer — Qualified regulatory reviewer (proposed (claude code, for confirmation): appoint by 2026-11-10) |
KrinosAI or external |
Medical-device determination, intended-use wording |
| STK-009 |
Clinical advisor (dentist) — proposed (claude code, for confirmation); confirm with the clinical advisor |
KrinosAI or external |
Clinical meaning of findings, risk bands and report wording; validation |
| STK-010 |
Doctors / dentists using the product (group). Representative: Product Owner (name to be assigned) |
Partner dental clinics |
Reliable scans and reports, offline working, patient management |
| STK-011 |
Patients (group; data subjects). Representative: Product Owner (name to be assigned) |
Patients of partner clinics |
Accurate, understandable report; privacy of photos and health data |
| STK-012 |
KrinosAI administrators (admin console users). Representative: Product Owner (name to be assigned) |
KrinosAI |
Inviting, approving and suspending doctors; offline limits; usage |
| STK-013 |
Third-party service providers: Clerk, MongoDB, Cloudflare (R2), AWS (S3, Lambda, KMS), OpenRouter / Google (Gemini), Groq, Hugging Face, Resend, Cashfree, Vercel, Render, Expo (EAS). Observed: scan-a6b4429.md §Environment variables and §External hosts |
External vendors |
Service terms, data processing agreements (OPEN-012), regions (OPEN-016) |
2. Decision rights and authority
No governance policy or delegation of authority was available (Not recorded). The rows below are a proposed allocation following the roles in SOP-LC-01, for the Sponsor to confirm (OPEN-021). Each stage gate has exactly one proposed approver.
| ID |
Can approve |
Can veto |
Must be consulted on |
| STK-001 |
Charter; 01 Start-Project gate; budget (proposed) |
Any gate on business grounds |
Major scope or intended-use change |
| STK-002 |
02 Requirements gate; scope changes; 06 Build-and-Document gate (proposed) |
Features outside the intended use |
Design, test plan, release notes |
| STK-003 |
03 Design, 04 Planning, 05 Development-Setup gates; ADRs (proposed) |
Changes that break architecture or branch policy |
Requirements feasibility, releases |
| STK-004 |
— |
— |
Web/API design and estimates |
| STK-005 |
— |
— |
Mobile design, builds and estimates |
| STK-006 |
Model releases (proposed) |
Shipping a model without evaluation evidence |
Any change to models, thresholds or report scoring |
| STK-007 |
DPIA; vendor onboarding (proposed) |
Any gate with an open privacy or security blocker |
Data flows, vendors, logging, retention |
| STK-008 |
07 Test-and-Validate and 08 Release-and-Deploy gates while device status is undetermined (proposed) |
Release if a regulatory hold point is open |
Intended use, claims, labelling |
| STK-009 |
— |
Report wording that implies diagnosis |
Findings, risk bands, score rules |
| STK-010 |
— |
— |
User acceptance (UAT) |
| STK-011 |
— |
— |
Consent and privacy notices (through the DPIA) |
| STK-012 |
— |
— |
Admin features |
| STK-013 |
— |
— |
Contract and DPA terms |
Proposed, for the Sponsor to confirm (OPEN-021).
| Deliverable |
Accountable |
Consulted |
Informed |
Web app and API (dentalapp/) |
STK-003 Tech Lead |
STK-004, STK-007 |
STK-002 |
Doctor/admin mobile app (mobile/) and its builds |
STK-003 Tech Lead |
STK-005, STK-007 |
STK-002, STK-012 |
| Detection models and ML service |
STK-006 ML Lead |
STK-009, STK-003 |
STK-002 |
| Report content, risk bands and scoring |
STK-002 Product Owner |
STK-009, STK-006 |
STK-010 |
| Lifecycle records (this documentation set) |
STK-002 Product Owner |
STK-003, STK-007, STK-008 |
STK-001 |
| Security remediation (OPEN-007, OPEN-008, OPEN-017) |
STK-007 Security & Privacy Officer |
STK-003 |
STK-001 |
| DPIA and vendor agreements |
STK-007 Security & Privacy Officer |
STK-002, STK-013 |
STK-001 |
| Regulatory determination |
STK-008 Qualified regulatory reviewer |
STK-002, STK-009 |
STK-001 |
4. Communication frequency and channel
No communication plan is recorded. Channels and frequencies below are proposed defaults for confirmation (OPEN-021).
| ID |
Channel |
Frequency |
Owner |
| STK-001 |
Written status summary + gate review meeting |
Fortnightly; at each gate |
STK-002 |
| STK-002 |
Team meeting; tracker |
Weekly |
STK-003 |
| STK-003 |
Team meeting; GitHub pull requests |
Weekly; per change |
STK-002 |
| STK-004 |
Team meeting; GitHub pull requests |
Weekly; per change |
STK-003 |
| STK-005 |
Team meeting; GitHub pull requests |
Weekly; per change |
STK-003 |
| STK-006 |
Team meeting; model change notes |
Weekly; per model change |
STK-003 |
| STK-007 |
Security/privacy review meeting; email for incidents |
Monthly; same day for incidents |
STK-003 |
| STK-008 |
Review meeting |
At each regulatory hold point |
STK-002 |
| STK-009 |
Review meeting |
Per report or model change |
STK-002 |
| STK-010 |
Release notes in the app; email |
Per release |
STK-002 |
| STK-011 |
Privacy notice; report text |
Per change to notice or report |
STK-007 |
| STK-012 |
Release notes; team chat |
Per release |
STK-002 |
| STK-013 |
Vendor account contacts; email |
On contract or DPA change |
STK-007 |
5. Conflict and escalation pathway
| Conflict |
Parties |
Resolver |
Escalation time |
| Speed of feature delivery vs privacy/regulatory hold points (product is in use while OPEN-006, OPEN-007, OPEN-008, OPEN-009 are open) |
STK-002, STK-003 vs STK-007, STK-008 |
STK-001 Sponsor — Sponsor (name to be assigned) |
Same day for security/privacy incidents; 5 working days otherwise (proposed) |
Three diverging code lines with no shared history: branches app, non-compliance, app_dev (Observed with git merge-base, 2026-10-25: no common ancestor between app and non-compliance) |
STK-004, STK-005 |
STK-003 Tech Lead — OPEN-023 |
Before the next release (proposed) |
| On-device results vs server results (DEC-005, DEC-011) |
STK-005 vs STK-006 |
STK-006 ML Lead |
Per model change |
| Report wording that may read as diagnosis vs product messaging |
STK-002 vs STK-008, STK-009 |
STK-008 Qualified regulatory reviewer |
Before release |
6. Change and review history
| Date |
Change |
By |
| 2026-10-27 |
Register created retrospectively from the brief, risk screen and Git history at a6b4429 |
Claude Code (drafted with Claude Code) |
Open issues and decisions
| ID |
Specific gap or decision |
Responsible owner |
Due date |
Blocks gate? |
Evidence required |
Status |
| OPEN-001 |
Named sponsor, product owner, tech lead, security/privacy officer, ML lead, group representatives and reviewers not recorded |
Product Owner |
2026-11-10 (proposed) |
Yes |
Names with roles |
Open |
| OPEN-006 |
Qualified regulatory reviewer not appointed; device status undetermined |
Qualified regulatory reviewer |
2026-11-30 (proposed) |
Yes |
Appointment and written determination |
Open |
| OPEN-007 |
Committed credential files (dentalapp/google-credentials.json, dentalapp/mongoDb_usernamePassword) — STK-007 interest |
Security & Privacy Officer |
2026-10-31 (proposed) |
Yes |
Rotation and purge confirmed |
Open |
| OPEN-008 |
Committed patient-data backups (dentalapp/backups/) — STK-007 interest |
Security & Privacy Officer |
2026-10-31 (proposed) |
Yes |
Purge and breach assessment |
Open |
| OPEN-009 |
No DPIA — STK-007, STK-011 |
Security & Privacy Officer |
2026-11-30 (proposed) |
Yes |
Completed DPIA |
Open |
| OPEN-011 |
Clinical advisor not appointed; no clinical validation |
Clinical advisor with ML Lead |
2026-12-15 (proposed) |
Yes |
Appointment; validation study |
Open |
| OPEN-012 |
No data processing agreements with the vendors in STK-013 |
Security & Privacy Officer |
2026-11-30 (proposed) |
Yes |
DPAs on file |
Open |
| OPEN-016 |
Vendor data regions (STK-013) not recorded |
Security & Privacy Officer |
2026-11-30 (proposed) |
Yes |
Regions and transfer assessment |
Open |
| OPEN-017 |
Hard-coded fallback signing secret (dentalapp/src/lib/admin/session.js:4) |
Backend Lead |
2026-11-10 (proposed) |
Yes |
Code fix; secret confirmed set |
Open |
| OPEN-021 |
No governance policy: decision rights, RACI and communication plan in this record are proposed, not confirmed |
Sponsor |
2026-11-10 (proposed) |
Yes |
Sponsor-confirmed decision rights and communication plan |
Open |
| OPEN-023 |
Branches app, non-compliance and app_dev have diverged with no common history; which branch is the release line is not recorded |
Tech Lead |
2026-11-30 (proposed) |
No |
Branch policy; consolidation plan |
Open |
Review and approval
| Review role |
Named individual |
Decision |
Date |
Signed / controlled record |
| Author |
Claude Code (drafted with Claude Code) |
Draft |
2026-10-27 |
This file at the commit that adds it |
| Technical reviewer |
Tech Lead (name to be assigned) |
Pending |
Pending |
Pending |
| Quality / regulatory reviewer (if applicable) |
Qualified regulatory reviewer (name to be assigned) |
Pending |
Pending |
Pending |
| Authorized approver |
Sponsor (name to be assigned) |
Pending |
Pending |
Pending |