Country Policies

Regulation differs per country and must be configuration, not hard-coded logic. All country-specific behavior is mediated by a central registry — there are no inline country checks scattered through the codebase.

What is actually implemented (ADR-021, ADR-029)

apps/api/internal/platform/country is a country activation registry, not the single policy interface earlier drafts of this page invented. An operator activates a named activity in a named country, and the registry re-checks the artefacts behind that decision on every evaluation, with no cached conclusion — so withdrawing an artefact de-activates the country on the very next request.

Four activities exist today:

Activity	Its activation artefact
telehealth	a published, in-effect telehealth_country_policy
triage	an active triage_protocol (author cannot be activator — enforced by CHECK constraints and a trigger)
prescribing	a published prescribing_policy. No path in this repository issues a prescription; the activity exists so an operator cannot mark it activated with nothing behind it
certification	a recorded, in-force country_accreditation for every scope the activity covers (ADR-029)

Each activity's pack also carries GDPR requirements — a legal text and a processing purpose per country — checked at evaluation time by Store.Unmet.

Emergency guidance is deliberately not an activity and must not become one. Making it one would create a mechanism by which an incomplete country pack — a missing privacy notice, an expired legal text — refuses to tell somebody where the nearest emergency practice is. No Require() may be wrapped around an emergency route.

What the registry gates, and what it does not

ADR-029's certification activity is the clearest illustration. It does not gate issuing a Buddora certificate — "this named person completed this named course" is a true statement about work somebody did, and refusing it in an unactivated country would delete a truthful record rather than prevent a false claim. What it gates is the accreditation claim: an emitted Open Badges credential carries an accreditation alignment only where the activity is activated, and carries none anywhere else.

Every country is unaccredited on a fresh deployment. No migration inserts an activation row, and that is the correct default rather than a gap to be filled by a seed script.

Still to come

Other country-gated concerns named in the specification — online medication sale, insurance distribution, identity verification, tax, data residency, adoption/breeder/transport rules — are not activities in the registry yet. They join it as the domains that need them land, which is the same pattern telehealth, triage and certification followed.