Sample Message Origin¶
A sample message added through the MCP server records where it came from: the MCP server, the user who sent it, the AI client it came through, and when. QIE uses that record to tell these samples apart from samples added in the console.
Why the origin matters¶
Sample messages can hold real patient data, which is why QIE encrypts them when it stores them. While Return message content is off, the MCP server returns no content that can hold patient data, and a sample added in the console is such content (see Message Content and the MCP).
A sample added through the MCP server is different. Its body is what the user's AI client sent, so the user has already shared it with that client. The origin record is how QIE knows which samples those are.
What the origin records¶
| Field | Holds |
|---|---|
| Origin | MCP for a sample added through the MCP server. A sample added in the console has no origin. |
| Submitted By | The QIE user signed in to the AI client. |
| Submitted Through Client | The client ID the AI client registered with. |
| Submitted At | When QIE stored the sample. |
How the origin stays accurate¶
- Only QIE sets the origin, in the same save that adds the sample through
push_sample. Nothing a console user or an AI client sends can set or change it. - Once set, the origin never changes.
- Changing a sample's body clears its origin, because the body is no longer what the AI client sent. From then on the sample is treated as one added in the console.
- Changing a sample's description, format or other settings in the console keeps its origin.
- Copying a channel keeps the origin of each of its samples.
- An export package records each sample's origin, but importing a package drops it, so every imported sample arrives as one added in the console. A package is a file that can be edited, so the origin it records is not trusted.
Which samples the MCP returns¶
| Sample | While Return message content is off | While it is on |
|---|---|---|
| Added through the MCP server | Returned to any user who can view the channel | Returned |
| Added in the console, or its body changed there | Refused | Returned |
list_samples lists every sample of a channel without its body, and says for each one whether get_sample returns it now. Every body get_sample returns is recorded in the MCP audit log as a CONTENT_READ entry that names the channel, the sample and its origin.
Because any user who can view the channel can read back a sample added through the MCP server, push_sample asks for a sample with no patient data while the switch is off. Its description says so to the model, and the same advice applies to the people who use it.
Where the origin shows¶
- In the channel's revision history, in the part for each sample: Origin, Submitted By, Submitted Through Client and Submitted At.
- In a channel read through the MCP server, as each sample's
origin,originUserId,originClientIdandoriginAtMillis. A channel save cannot change them, as it cannot change any sample.