Digital health and clinical AI increasingly depend on access to diverse, multimodal, and representative data distributed across organizations and care settings. Models developed or validated within a single institution may not perform consistently across different populations or operational contexts, whereas broader cross-organizational collaboration can improve robustness and generalization by reducing dependence on narrowly defined local datasets [1-3].

Despite substantial investment in digital health and AI, many initiatives that show promising results in pilot settings do not progress to sustainable operational services [4,5]. Explanations commonly emphasize model performance, data quality, clinical validation, and local implementation barriers, but operationalization may also require the collaboration itself to change. Adding an organization can entail further contracting, governance review, technical integration, and assurance, and large-scale health-data programs have identified organizational and technical integration as important sources of delay [6].

Pilots can usually operate within a predefined collaborative arrangement in which participating organizations, datasets, analytical objectives, and responsibilities are established before execution and remain relatively stable. Operational services must accommodate changes in participation, available data, and analytical capabilities as needs and circumstances evolve. Scaling concerns not only the execution of distributed computation but also the ability of a governed collaboration to evolve without reconstructing its governance and technical arrangements for each new activity. Recent system-level evidence from the National Health Service AI Lab similarly identifies the pilot-to-scale gap, with fragmented governance and lack of system orchestration among the mutually reinforcing mechanisms constraining the scaling of health care AI [7]. In this study, scalability refers to the capacity of the governed collaboration to accommodate changes in participants, resources, and operations without altering its governance conditions. Computational throughput and deployment scale are outside this definition.

Existing health-data infrastructures address important parts of this problem at different boundaries. Centralized platforms provide common custody and access mechanisms, trusted research environments (TREs) provide controlled analytical access to governed datasets, federated learning (FL) frameworks coordinate computation across organizational boundaries, keeping raw data local, and dataspace or policy frameworks establish requirements for participation and data sovereignty. Their functions remain necessary, yet the decision that a participant may enter a particular federated activity under a defined authority, purpose, and set of capabilities can remain distributed across contracts, accreditation, identity systems, application configuration, and operational controls.

Open Health addresses the transition from fixed collaboration to evolving service through federated computing (FC), which represents collaboration as a governed structure within which autonomous organizations retain sovereignty over local data and systems for participating under shared governed rules [8,9]. FC complements health-data platforms, identity systems, FL frameworks, and organization-local security controls by providing the governance structure through which participation becomes legitimate within an existing federation.

Session-bound admission is one mechanism for establishing such participation [10]. Admission is evaluated for a specific governed activity, purpose, and bounded set of capabilities. Different participation relations can coexist within the same federation. An organization may, for example, submit locally computed model updates to federated training, without exposing its underlying local data, under a bounded contribution relation while retaining a status distinct from existing federation members. Contribution and model consumption are governed through separate capabilities, where a capability denotes an explicitly granted permission to perform a specified federation operation. Collaboration growth can proceed through purpose-specific and asymmetric participation relations, preserving the governance conditions of the federation.

The Open Health demonstrator examines this proposition in a multisite FL setting using Pathology Modified National Institute of Standards and Technology (PathMNIST) [11,12]. PathMNIST provides a biomedical benchmark derived from colorectal histopathology, but the federation-level partitioning used in this study is experimentally constructed and is not intended to reproduce the full clinical, organizational, or technical heterogeneity of operational health institutions.

An initial federation comprising hospitals A and B is extended through the governed participation of hospital C as a sponsored contributor. Hospital C may contribute to federated training but may not consume the resulting model only by virtue of that contribution. The implementation enables examination of whether federation participation can expand and preserve explicit authority, capability boundaries, session binding, and auditable decision evidence. This study, therefore, addresses the following research question: Can an open federated health data collaboration support governed evolution through new forms of participation and preserve bounded capabilities and auditable decision evidence?

The paper makes 3 contributions: First, it reframes the transition from pilot to service as a problem of governed federation evolution beyond computational or data scale. Second, it presents an Open Health implementation of FC in which session-bound admission, capability separation, and auditable decision evidence are integrated with a conventional FL runtime. Third, it evaluates governed federation evolution through controlled organizational and computational participation scenarios, together with the analytical consequence and admission overhead of the implemented mechanisms.

The remainder of the paper is organized as follows: the Methods section reviews existing approaches to collaborative health-data infrastructure and their governance boundaries, introduces the FC and federation-admission principles used by Open Health, and describes the system implementation, experimental scenarios, and evaluation criteria. The Results section reports the admission, analytical, AI-agent conformance, and admission-overhead results. The Discussion section discusses the principal findings, their relationship to existing health-data infrastructure, the role of decision evidence and governed AI-agent participation, and the limitations and directions for future work.

Scaling a collaboration requires changes not only in the number or type of participants but also in the resources available to the federation, and the operations participants may perform. The 3 dimensions are related but governed through different relations. New participants establish participation relations, new datasets or models extend the federation’s resource base, and new analytical capabilities extend the set of permitted operations. Distinguishing them avoids collapsing heterogeneous entities and activities into a single category of objects to be admitted (Table 2).

Open Health treats scaling as governed evolution across participants, resources, and operations. Rights remain specific to the relation in which they are established, providing the conceptual basis for the asymmetric participation relations examined in the experimental implementation.

Open Health applies FC to the problem of evolving cross-organizational health-data collaboration and treats the federation as a governed relational structure. Participating organizations retain sovereignty over their local data, infrastructure, identities, and internal access mechanisms; the federation embodies the shared conditions agreed among the participating organizations under which cross-organizational participation becomes legitimate. The resulting boundary is complementary to organization-local IAM, RBAC, or ABAC, TREs, FL frameworks, and other operational controls because those mechanisms continue to govern activity within their respective administrative or computational domains.

The constitutive governance conditions originate in the agreements established among the participating organizations rather than in the capabilities of the technical implementation. A governed federation context is established before operational execution. The context identifies the authorities participating in the collaboration, the applicable constitutional and policy state, the purpose of the activity, and the conditions under which participation may occur. Open Health represents the bounded context through a federation envelope, allowing later capability and admission decisions to be interpreted relative to the governance state under which they were made. Authentication establishes identity, and prior organizational eligibility establishes eligibility to participate. Federation admission separately establishes entitlement to a specified activity.

A federated service is an operational function exposed within a governed federation and retained under the control of the organization that provides it. The service and its underlying resources remain within that organizational domain. The federation governs the relations under which participants may invoke it, including authority, purpose, capability, scope, and federation context. FL model inference, data transformation, and other analytical functions may be exposed as federated services and remain operational functions outside the federation’s constitutive governance.

FC as Code (FCaC) [9] provides the machine-processable representation through which these governance relations are expressed and evaluated. In Open Health, the governed federation context, participant authority, capabilities, purpose, scope, and related constraints are represented as executable artifacts that can be tested at the admission boundary. We separate governance establishment and capability expression from operational execution: FC models the relations governing participation, FCaC renders those relations machine-processable, admission evaluates them for a requested activity, and the corresponding federated service performs the admitted operation. Keeping these concerns distinct allows the participation structure to evolve independently of the analytical runtime and organization-local security mechanisms. Federation governance remains represented in its own constitutive artifacts, and operational configuration changes leave the conditions of participation unchanged.

FC provides a structure in which collaboration can evolve through changes in relations among participants, resources, and operations. A new organization does not need to acquire the rights of an existing member; a newly contributed resource need not become available to every participant, and permission to perform one operation need not imply permission to perform another. The relevant governance question is not whether an entity has been globally admitted to the federation, but whether a particular participation relation is legitimate within the governed context.

The demonstrator is evaluated along complementary governance and analytical dimensions. Governance behavior is assessed through positive and negative admission tests covering valid session admission, capability mismatch, holder-binding mismatch, sponsorship-based contribution, denial of model consumption to a contribution-only participant, and preservation of federation-context binding. Decision evidence is examined for the ability to associate ALLOW and DENY outcomes with the participant, requested operation and purpose, governed context, reason, and relevant model run when applicable.

Admission overhead is evaluated through a request-level microbenchmark of the admission gateway. Three decision paths are exercised: a valid ECT and holder proof with a permitted capability (ALLOW), a valid ECT and holder proof with a capability or scope mismatch (DENY-Cap), and a valid ECT presented with a mismatched holder proof (DENY-Holder). Each iteration uses a fixed valid federation context and capability credential for generating a fresh request-bound DPoP proof [41]. Per-request timings are recorded inside the admission gateway using a monotonic high-resolution clock. Measurements are retained in memory during the benchmark and written to a JavaScript Object Notation Lines (JSONL) log after the run, excluding filesystem I/O from the measured request path. The benchmark uses 1000 requests per decision path under no concurrent load, and latency is summarized as the median with the 25th and 75th percentiles.

This study involved no human participants or identifiable personal data. All experiments used PathMNIST, a publicly available, anonymized dataset [11,12], and hospitals A, B, and C were simulated participants. Under University College London guidance, research using anonymized public-domain datasets is minimal risk and does not require ethical approval [42], and Health Research Authority guidance generally excludes research using previously collected, nonidentifiable information from research ethics committee review [43]. Ethics review and informed consent were therefore not sought.

The Open Health implementation produced explicit admission decisions for permitted and rejected requests at the federation boundary. In this study, evidence denotes the signed, machine-generated decision artifact emitted by the admission mechanism for each evaluated request. It is distinct from the capability credential presented by the requester, from application logs, and from the analytical artifacts produced by the FL runtime. The approach follows earlier session-admission work in treating the decision outcome, its reason, and the bindings required to reconstruct the evaluated request as first-class experimental outputs [10].

Each Open Health decision record identifies the admission event and timestamp, records the ALLOW or DENY outcome and reason, and associates the requester and holder-binding result with the relevant organizational and sponsorship information. The record also captures the requested action, purpose, and tissue scope, the governing federation envelope, the policy hash, and the related model run when applicable. Request and credential identifiers bind the decision to the specific presentation that was evaluated. An independent evidence signature protects the integrity of the resulting artifact.

The resulting evidence is independently verifiable and not merely observable. A verifier possessing the federation’s public trust anchor can check the signature and inspect the recorded outcome, reason, request bindings, and governance state independently of mutable dashboard state and historical Flower-runtime configuration. Evidence establishes the governance decision and the conditions under which it was made. Clinical correctness of the subsequent analytical result is evaluated separately (Table 4).

Positive and negative tests were used to determine whether the admission boundary preserved the capability relations specified by the federation. Table 5 summarizes the principal cases. Ordinary member participation, hospital C’s sponsored contribution, attempted model consumption outside hospital C’s capability, scope violations, holder-binding failure, and federation-envelope mismatch are evaluated independently. Each case produces its own decision record. Each DENY is recorded as an explicit governance event.

The A+B configuration established the initial federation with 2 existing members participating in federated training under the same governed context. Mode 1A then introduced hospital C through sponsorship, preserving the status and capabilities of hospitals A and B and leaving the Flower training and aggregation procedures unchanged. Hospital C was admitted for the submit_update operation associated with the federated-training purpose, and the corresponding admission evidence remained associated with the governed context and executed model run.

The complementary negative test preserved the asymmetric relation established for hospital C. A request to query or otherwise consume the resulting model was denied because model consumption was absent from the sponsored contributor’s capability set. Successful contribution combined with unsuccessful model consumption provides the primary governance result for mode 1A. Federation growth occurred by adding a bounded participation relation instead of promoting hospital C to an equivalent member or transferring the capabilities of its sponsor.

PathMNIST model performance was measured to verify that hospital C’s admitted contribution produced an observable analytical consequence and not a purely administrative change. The analytical comparison uses an A+B control trained under conditions matched to the A+B+C run. An earlier A+B baseline used during development is not treated as the comparative reference because its training duration differs from that of the governed-expansion experiment (Table 6).

Admission of hospital C increased cancer-related macro recall from 50.2% to 67.4% (+17.2 percentage points), while noncancer macro recall remained similar at 85.5% and 86.3%, respectively. Within the cancer-related classes, recall increased from 19.5% to 39.9% for cancer-associated stroma and from 80.9% to 94.9% for colorectal adenocarcinoma epithelium. Global macro recall increased from 76.7% to 81.6%, and overall accuracy from 82.0% to 86.4%.

These analytical results establish that hospital C’s admitted contribution had an observable effect on the workload. Governance correctness is established separately through preservation of the admitted capability relations and their signed admission records. Model-performance improvement is therefore not treated as evidence that admission was correctly governed.

Mode 1B introduces an AI agent as a computational participant with its own identity and holder-bound capabilities. A requesting participant may lack authority to consume an unrestricted source result. Direct consumption of the restricted source must remain denied to a requester lacking the corresponding source-consumption capability.

The requester is not authorized to consume the unrestricted cancer-related source result. The agent may nevertheless perform bounded inference and invoke the governed rebind operation, which converts the restricted result into a policy-authorized derivative consisting of a blurred tissue image and a qualitative indication of prediction accuracy. The requester may consume this derivative only under a separate derivative-consumption capability. The agent performs the transformation under its own admitted authority, and federation policy determines the permitted transformation. The Mode 1B scenario follows the conformance requirements summarized in Table 7, which define the required decisions across source consumption, bounded inference, policy-authorized rebind, derivative consumption, and access to privileged governance paths.

Admission adds cryptographic verification, capability matching, evidence signing, and evidence persistence to the request path. Table 8 reports the completed request-level benchmark for the current Open Health implementation.

Median full admission latency was 1.210 (IQR 1.141‐1.333) ms for successful admission, 1.195 (IQR 1.136‐1.273) ms for capability-scope denial, and 0.884 (IQR 0.837‐0.921) ms for holder-binding denial. ECT verification, DPoP verification, and capability matching individually remained submillisecond. Capability matching is reported as not applicable for the holder-binding denial because the request fails closed during DPoP verification and evaluation terminates before the capability-matching stage. The shorter full latency for this path is consistent with that early termination. For ALLOW, decision-evidence signing and persistence had median latencies of 0.065 (IQR 0.063-0.069) ms and 0.164 (IQR 0.159-0.172) ms, respectively, with comparable values for the denial paths.

The full admission measurement includes cryptographic verification, capability evaluation, decision-evidence signing and persistence, and the surrounding admission-gateway processing. The benchmark is intended as a deployability check rather than a throughput study and reports single-request latency under no concurrent load. The relevant systems question is whether explicit admission and signed decision evidence introduce material overhead relative to the federated activity they govern; throughput and tail latency under concurrent requests remain outside the current evaluation.

The Open Health demonstrator supports the central proposition of the study by representing federation growth as a governed change in participation relations, with technical onboarding remaining subject to explicit governance conditions. Positive and negative admission decisions remain tied to the federation envelope and are retained as signed evidence. Mode 1B extends the same structure to computational participation by separating the agent’s execution capability from the rights of the human participant requesting the result.

Model accuracy is a secondary outcome in the current evaluation. Under matched training conditions, cancer-related macro recall increased from 50.2% to 67.4% after hospital C’s admitted contribution, while noncancer macro recall remained similar at 85.5% and 86.3%. This establishes an observable analytical consequence of the governed contribution but neither establishes nor measures governance correctness. The primary result is preservation of the capability relations asserted before execution, including contribution-specific capabilities, holder-bound admission, federation-context binding, and independent governance of source and derivative consumption.

Many collaborative infrastructures are designed around an initially established set of organizations, resources, and analytical operations. Their technical mechanisms may scale effectively once those assumptions are fixed, yet movement from pilot to operational service can require the collaboration itself to change. Open Health addresses that transition by treating participation, resources, and operations as separable dimensions whose relations can evolve under an existing governance context.

The concept of a federated service follows from the same separation. An operational function can be exposed within the federation while remaining under the control of its provider, with the federation governing the authority, purpose, capability, scope, and context under which it may be invoked. Flower-based training and inference provide the concrete services used in the demonstrator. The governance structure is runtime-independent and can in principle accommodate other analytical or data-processing services as operational functions outside the federation’s constitutive layer.

Open Health is not intended to replace TREs, identity federation, IAM, RBAC, or ABAC, dataspace governance, or FL frameworks. Each addresses a different boundary. Organization-local controls remain responsible for identities, infrastructure, users, and resources within an administrative domain, while analytical runtimes remain responsible for executing admitted computation. The additional FC boundary establishes whether a participant may enter a particular federated activity under the current shared governance conditions.

The distinction becomes important when collaborations evolve asymmetrically. Conventional onboarding may be sufficient when every new organization is intended to receive the same role and operational privileges as existing members. Hospital C represents a different case because the desired relation is deliberately narrower. Sponsorship enables accountable, differentiated participation while preserving delegation and membership as separate governance relations.

Mode 1B illustrates that an AI agent fits within the existing constitutive categories of the federation. The agent acts as a computational principal with its own identity, holder binding, and bounded capabilities. Its planning strategy or runtime determines how an admitted operation is executed. Runtime isolation constrains execution paths; federation authority is established through governed admission. Rebind extends this structure with an additional governed relation.

The agent may transform a restricted result into a policy-authorized derivative; the recipient’s rights to that derivative are evaluated independently from rights to the source. The blurred representation used in the demonstrator is not treated as a differential-privacy mechanism or as an agent-defined judgment that an output is safe. Its significance lies in the governed transformation and the independent capability relation attached to subsequent consumption. The construction provides an operational connection to the earlier value-identity model, in which transformations of data and their governance bindings are considered jointly [8].

The same layering limits the claim that can be made about agent safety. Admission establishes legitimate participation at a federation boundary, whereas sandboxing, tool restrictions, network isolation, monitoring, and approval mechanisms constrain behavior within the execution environment. Neither layer can substitute for the other. The Open Health result concerns conformance between federation admission and runtime execution; agent predictability lies outside the scope of the study.

The demonstrator is a proof of concept implemented outside a production health-data infrastructure. PathMNIST provides a biomedical benchmark for reproducibly exercising governance relations and class-specific analytical effects. Clinical effectiveness and performance across heterogeneous operational health systems remain subjects for subsequent evaluation. The current proof of concept includes 3 participating hospitals and focuses on technical federation governance. Institutional processes required to establish real cross-organizational agreements remain outside its scope. The implementation will be ported to Amazon Web Services as part of the University College London Centre for Digital Innovation Impact Accelerator Program beginning in September 2026. The resulting cloud deployment will provide an environment for evaluating operational deployment and scaling and for verifying preservation of the governance invariants examined in this study.

The admission benchmark characterizes single-request latency in the current implementation and deployment environment under no concurrent load and does not establish throughput, tail-latency, or scale-out performance. Key rotation, revocation, recovery, long-duration policy evolution, and operational incident handling require further evaluation. History-dependent controls such as cumulative disclosure limits belong to a procedural layer beyond the per-request admission mechanism evaluated here.

Mode 1B is restricted to a deliberately bounded agent interaction, with arbitrary autonomous behavior, unrestricted tool use, and unsupervised clinical decision-making outside its scope. Further work should examine multiagent and multisponsor participation, where computational participants operate under distinct accountable sponsorship relations and interact through bounded federation capabilities, with authority remaining specific to each participant. Deployments across different analytical frameworks and health-data environments would also test whether the governance boundary remains portable when the underlying execution substrate changes.

Open Health reframes the transition from federated pilot to operational service as a problem of governed federation evolution. The demonstrator separates the establishment of a federation context, expression of bounded capabilities, admission of specific participation, execution by a conventional analytical runtime, and production of signed decision evidence. Federation growth can occur through differentiated participation relations that preserve membership boundaries and bounded capability relations.

The hospital C scenario demonstrates contribution under a dedicated capability, with model consumption governed separately. The AI-agent scenario extends the same semantics to a computational participant producing a policy-authorized derivative under its own admitted capability, while recipient access remains independently governed. Together, the scenarios show how participants and operations can evolve while preserving explicit authority and capability boundaries.

The principal contribution is not a new FL algorithm or a claim of improved clinical model performance. It is a machine-evaluable admission boundary through which an existing collaboration can change while retaining auditable evidence of the conditions under which participation was allowed or denied. Such a boundary provides one route from fixed federated health-data demonstrations to services that can evolve while preserving organizational sovereignty.