Weeks-long cycles
Physical routing between desks meant a case could sit untouched simply because the paper was in someone's tray.
Public sector
Turning a weeks-long paper approval into an auditable workflow
A public-sector body ran a critical approval process on paper — routed by hand, tracked in inboxes, and impossible to audit. We digitised it into a workflow with role-based routing and a complete, tamper-evident audit trail.
Illustrative case study. This engagement is representative of the work we do and the way we do it — it is not a named client. Figures describe the class of outcome our engineering targets, not a specific measured result. Approved client case studies replace these before launch.
Project summary
Government workflow automation
A digitised approval workflow with role-based routing and full audit logging that replaced a weeks-long, paper-based process.
IndustryPublic sector
Project typeWorkflow automation & digitisation
TimelineDeliberate discovery, phased rollout
TeamCross-functional delivery team
DeploymentManaged, backed-up hosting
Client background
A critical process running on paper
The client is a public-sector body responsible for an approval process that citizens and internal teams depend on. The process was entirely paper-based: forms were printed, signed, carried between desks, and filed — with progress tracked informally through email and phone calls.
Nobody could say with confidence where a given case sat, how long it had waited, or who had touched it. Accountability requirements were rising, but the process produced no reliable audit trail, and the manual routing meant approvals routinely took weeks. The status quo was slow, opaque, and increasingly hard to defend.
The challenge
Slow, opaque, and impossible to audit
In the public sector, a process you cannot evidence is a liability — and this one could not be evidenced at all.
No audit trail
There was no reliable record of who approved what, when, or why, which made accountability and reporting a manual reconstruction.
No visibility of status
Answering 'where is this case' required chasing people, so both citizens and staff were left in the dark.
Fragile handling of sensitive data
Paper forms carrying personal information moved through the building with no access control and an obvious risk of loss.
Solution architecture
A workflow that routes itself and records everything
We modelled the approval process as an explicit, role-aware workflow, with an immutable audit log at its core.
01
Case portal
A secure web portal where cases are submitted, reviewed, and approved — replacing the printed form and the physical tray.
02
Role-based routing engine
The workflow routes each case to the right role automatically based on explicit rules, so nothing waits on someone remembering to pass it along.
03
Immutable audit log
Every action — submission, review, approval, comment — is recorded in an append-only log, so the full history of a case is always reconstructable.
04
Access-controlled data layer
Sensitive case data is held in an access-controlled store where permissions are explicit, reviewable, and enforced on every request.
How we delivered
Modelled carefully, rolled out without a big bang
In a governance-critical process, getting the workflow model right mattered more than shipping fast — so discovery was deliberate.
Discovery & process modelling
We mapped the real approval path, including the exceptions and delegations, and agreed an explicit workflow model with the teams who own the process.
Roles, permissions & audit design
We defined the roles, the routing rules, and the audit model up front, because these are the parts that make the system defensible.
Portal & workflow build
We built the case portal and routing engine against the agreed model, with the audit log wired into every state change from day one.
Parallel run & cutover
We ran the digital workflow alongside the paper process until it was trusted, then retired the paper trail with the audit history intact.
Technology stack
Conventional, auditable, and built to last
For a governance-critical system, every choice favoured transparency, security, and longevity over novelty.
Frontend
- Next.js
- React
- TypeScript
Why: An accessible, server-rendered portal that works on modest hardware and meets public-sector accessibility expectations.
Backend & workflow
- Node.js
- Explicit state machine
- Role-based routing
Why: The approval process is modelled as an explicit state machine, so its behaviour is transparent, testable, and easy to audit.
Data & audit
- PostgreSQL
- Append-only audit log
- Prisma
Why: An append-only log in a relational store gives a complete, tamper-evident history of every case.
Security & access
- Role-based access control
- Encryption in transit and at rest
- SSO
Why: Least-privilege access and encryption protect sensitive case data, with single sign-on fitting existing government identity.
Cloud & delivery
- Managed hosting
- Automated backups
- CI/CD
Why: Managed, backed-up hosting and automated pipelines keep a critical service reliable and recoverable.
Observability
- Structured logging
- Status dashboards
- Alerting
Why: Live status dashboards mean staff and oversight can see exactly where every case sits.
Business results
Fast, visible, and defensible
Automated routing collapsed the cycle time, and the audit log turned accountability from a reconstruction into a lookup.
Approvals in days, not weeks
Automatic role-based routing removes the dead time paper spent sitting in trays, compressing the cycle dramatically.
Every action on the record
An append-only audit log means who did what, when, and why is always answerable — accountability by design.
Status anyone can see
Staff and stakeholders see exactly where a case sits, replacing chase-up calls with a glance at a dashboard.
Sensitive data protected
Access is controlled and logged, so personal information is far safer than it ever was on paper.
Key metrics
The class of outcome we engineered for
These figures are illustrative of the results this kind of digitisation targets — not a specific measured client result.
21dApproval cycle, in days
100%Auditable actions
+1900Staff-hours saved a year
Lessons learned
What the engagement taught us
In governance work, the model and the audit trail are the product.
Model the process before you build
Getting the explicit workflow model and roles right up front was the difference between a defensible system and a digital version of the same confusion.
Audit is not a feature you add later
Wiring the append-only log into every state change from day one made the system trustworthy; retrofitting it would have been far harder.
Parallel running builds trust
Running alongside the paper process until the digital one was trusted made cutover a non-event rather than a risk.
In their words
From consultation to deployment they operated like a senior engineering partner, not a vendor. We went from a process nobody could account for to one where every action is on the record.
Services behind this work
The services behind this work
This engagement was delivered through these core capabilities, adapted to a governance-critical process.
Workflow Automation
Streamline approvals and hand-offs end to end, across every tool your teams use, with full visibility and control.
Explore serviceBusiness Automation
Automate core operations end to end to cut manual work, remove errors, and scale without adding headcount.
Explore serviceEnterprise ERP
Unify finance, operations, and supply chain in one custom platform that fits your business — not the other way around.
Explore serviceMore case studies
Freight & logistics
Logistics ERP consolidation
A unified custom ERP that replaced three disconnected systems, automating the order-to-invoice workflow and syncing inventory in real time.
Read the case studyB2B SaaS
AI-assisted customer support
An AI automation layer that triages and resolves repetitive tier-one support tickets, escalating the rest into a custom CRM with full context.
Read the case studyRunning a critical process you can't fully audit?
Book a consultation and we'll map how a digitised, auditable workflow would cut cycle time and de-risk accountability — with no obligation.