System of record
The council CRM stays authoritative, the platform is the experience layer.
Why. Avoids a split in the record.
Trade-off. Dependent on the CRM API quality.
Industry patterns · Local government
Council request and field service platform
Residents lodge requests on web or mobile, crews work offline in the field and the council system of record stays authoritative, with AI used only to triage and summarise.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
- WCAG 2.2 AA
- Australian Privacy Principles
- ACSC Essential Eight
- Records obligations
Architecture
- People and clients
- Network and edge
- Compute and containers
- Object and file storage
- Databases and data
- AI and ML
- SaaS and business systems
- Security and identity
- Monitoring, audit and analytics
- Request or data flow
- Asynchronous or optional
- Boundary: region, account, network or trust zone
Request and data flow
A resident reports an issue on the web or app. Location is captured and the form is accessible and short.
Requests pass the edge and WAF to the API, with rate limits and spam checks.
Photos upload straight to S3 with presigned URLs and are scanned.
The request is stored with geospatial data for routing and duplicate detection.
An AI step suggests a category, a summary and likely duplicates. A person confirms before dispatch.
The request is created in the council system of record through its API, which remains authoritative.
Crews receive jobs on a mobile app that works offline and syncs photos and completion notes when back in coverage.
Components and why they were chosen
| Component | What it does | Why this choice |
|---|---|---|
| CloudFront and WAF | Public edge. | Protects forms and static content cheaply. |
| Amazon Cognito (optional resident sign-in) | Accounts for residents who want tracking. | Guest lodgement remains available. |
| API Gateway and Lambda | Request API. | Scales for storm-event spikes. |
| Amazon Aurora PostgreSQL with PostGIS | Spatial queries and job state. | Geography matters in councils. |
| Amazon S3 with malware scanning | Photos and attachments. | Cheap and safe. |
| Amazon Bedrock (Australian region inference where available) | Triage and summaries. | Assistive only, with human confirmation. |
| Offline-first mobile app | Crew jobs. | Field coverage is unreliable. |
| Integration to the council system | Authoritative record. | Avoids a second system of record. |
Design decisions and trade-offs
AI role
Triage and summarise only, humans confirm.
Why. Accuracy and accountability.
Trade-off. Less automation.
Offline
Local store with conflict rules and idempotent sync.
Why. Reliable in the field.
Trade-off. Sync conflicts must be designed.
Spikes
Serverless front end and queues.
Why. Storm events produce bursts.
Trade-off. Downstream CRM must be protected by queueing.
Well-architected pillars
Security
Private networking, IAM Identity Center and Cognito with MFA, encryption with customer-managed keys, least-privilege roles and WAF on the public edge.
Reliability
Multi-AZ services, backups with tested restores and queue-based retries for integrations.
Performance
Edge caching for public content, asynchronous processing for anything slow and indexes tuned to the main queries.
Cost optimisation
Scale with demand, use reservations or savings plans for the steady baseline and set budgets and alerts per environment.
Operational excellence
Infrastructure as code, pipeline deployments with rollback, dashboards on service-level objectives and runbooks for the top failure modes.
Sustainability
Right-size, schedule down non-production and archive data to colder tiers on a retention schedule.
Network, identity and data
Networking
VPC with public, private and isolated data subnets and VPC endpoints. Public ingress only through the edge service with WAF. Private connectivity to on-premises or partner systems by VPN or dedicated link.
Identity and least privilege
Residents optional via Cognito. Staff through Entra ID or the council IdP with MFA. Crews use device-bound sessions with short tokens.
Data and encryption
Photos can include people and vehicles, so apply retention and blurring rules where required. Encrypt with KMS and minimise personal data in requests.
Security and compliance mapping
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Required for staff and administrators. Essential Eight. |
| Restrict administrative privileges | Just-in-time elevation and separate admin accounts. Essential Eight. |
| Regular backups | Automated backups with a copy held outside the workload account or subscription. Essential Eight. |
| Privacy and security of personal information | Encryption, access logging and retention support APP 11. |
| Logging | Central, tamper-resistant logs support ISM event logging guidance and ISMF expectations. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
Failure modes, targets and scaling
- Target RTOMinutes for zone failure; hours for a rebuild from code
- Target RPOSeconds to minutes with point-in-time recovery
- Scaling and limitsSized from measured peak demand with a load test before go-live. Check service quotas early.
| Failure mode | Mitigation |
|---|---|
| CRM API down | Queue and confirm to the resident that the report is recorded. |
| Duplicate reports after an event | Spatial duplicate detection and linking. |
| Crew sync conflict | Server-wins for status, merge notes and photos. |
| AI mis-triage | Human review and an override feedback loop. |
Observability and runbooks
- Service-level objectives for availability and latency with burn-rate alerts.
- Audit log review for sensitive actions.
- Queue depth and integration error dashboards with a named owner.
Cost drivers and levers
Compute, database, data transfer and licences for any SaaS components.
- Reserve the baseline.
- Schedule non-production down.
- Cache and compress at the edge.
- Archive old data.
Implementation and fit
Phased approach
- Discovery: process, data and obligations mapped with the business owner.
- Foundation: landing zone, network, identity and pipeline.
- Thin slice: one journey end to end in production for a small group.
- Expand and harden: remaining journeys, load and penetration testing.
Anti-patterns to avoid
- Building before the decision rights and audit needs are agreed.
- A single shared admin role.
- Personal data in logs and test data.
- Integrations without retries or a dead-letter path.
When to use it
- Request and job management with many field staff.
- Councils wanting a better front end without replacing the CRM.
When not to
- Replacing a CRM with a custom build.
- Fully automated dispatch with no human check.
More in industry patterns
Health
Health referral and intake workflow
Structured digital referrals into a clinical service, with consent, secure messaging and clinical system integration, hosted in Australia with strong audit.
Education
Student and learner services platform
One front door for enrolment, support requests and communications, integrated with the student information system and learning platform, with safeguarding built in.
Not-for-profit
Not-for-profit case management and reporting
Case notes, referrals and outcomes tracked securely by small teams, with funder reporting generated from the same data and strict access to sensitive client information.
Related insights
Discuss this architecture
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.