Sentinel rules link :
https://info.railsentinel.co.uk/help-support/sponsors/sentinel-scheme-rules/ There is a link on this page for the pdf.
The RSSB statement is not public but if you have an RSSB account; its easily found.
Any genuine medical prescription would be exempted during the medical. However, this isn't a medical where the medication has been authorised by an employer. I also suspect that...
...The person involved will have tested positive for THC and therefore may not have been taking a regulated product as you correctly state. Even the NHS warns of taking generic over the counter medication and products from health stores.
We have lost a few Drivers to D&A policy and I pretty much guarantee that THC is not allowed. As far as I'm aware. CBD doesn't flag in a drugs test. CBN will flag. (CBD is Cannabidiol) (CBN is Cannabinol) and are slightly different.
When dealing with cases like these it is very important to see all the fine details of what was found and what levels there were. If there was a significant amount of THC then it would highlight recreational use.
Without the details, its impossible to say.