Offline
Local-first with idempotent batch sync.
Why. Connectivity is unreliable.
Trade-off. Conflict handling must be designed.
Industry patterns · Utilities and field services
Field inspection and asset maintenance
Inspectors capture evidence on mobile devices, offline if needed. Findings flow to the asset register and generate work orders with a complete, timestamped evidence trail.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
- Australian Privacy Principles
- ACSC Essential Eight
- Critical infrastructure security expectations where applicable
Architecture
- People and clients
- Network and edge
- Databases and data
- Object and file storage
- AI and ML
- Monitoring, audit and analytics
- SaaS and business systems
- Security and identity
- Request or data flow
- Asynchronous or optional
- Boundary: region, account, network or trust zone
Request and data flow
Inspectors complete checklists offline, with GPS, photos and signatures captured on the device.
When coverage returns, the app syncs in batches through an authenticated API with device-bound tokens.
Evidence is stored with a content hash and timestamp, so it can be shown to be unaltered.
Findings are written to the database with location and asset references.
Optional computer vision suggests defects for the inspector to confirm. It never closes a finding.
Supervisors review and approve, and critical findings alert immediately.
Approved findings create work orders in the enterprise asset system, which remains the system of record.
Components and why they were chosen
| Component | What it does | Why this choice |
|---|---|---|
| Offline-first mobile app | Capture with no coverage. | Field reality. |
| API Gateway and Cognito | Auth and sync API. | Short-lived tokens, device binding. |
| Sync service | Merge and conflict rules. | Predictable results. |
| S3 with hashing | Evidence store. | Integrity for audits and disputes. |
| Aurora PostgreSQL with PostGIS | Findings and maps. | Spatial queries. |
| Rekognition or SageMaker (optional) | Defect suggestions. | Assistive only. |
| Enterprise asset integration | Work orders and asset data. | No second asset register. |
| Alerting | Critical findings. | Safety first. |
Design decisions and trade-offs
Evidence integrity
Hash and timestamp at capture.
Why. Disputes and audits.
Trade-off. Extra processing.
AI
Suggestions only, inspector decides.
Why. Safety.
Trade-off. Less automation.
System of record
Asset system remains authoritative.
Why. One asset register.
Trade-off. Integration dependency.
Well-architected pillars
Security
Private networking, IAM Identity Center and Cognito with MFA, encryption with customer-managed keys, least-privilege roles and WAF on the public edge.
Reliability
Multi-AZ services, backups with tested restores and queue-based retries for integrations.
Performance
Edge caching for public content, asynchronous processing for anything slow and indexes tuned to the main queries.
Cost optimisation
Scale with demand, use reservations or savings plans for the steady baseline and set budgets and alerts per environment.
Operational excellence
Infrastructure as code, pipeline deployments with rollback, dashboards on service-level objectives and runbooks for the top failure modes.
Sustainability
Right-size, schedule down non-production and archive data to colder tiers on a retention schedule.
Network, identity and data
Networking
VPC with public, private and isolated data subnets and VPC endpoints. Public ingress only through the edge service with WAF. Private connectivity to on-premises or partner systems by VPN or dedicated link.
Identity and least privilege
Device-bound sessions with MFA at sign-in. Roles for inspector, supervisor and admin. Contractors on time-limited accounts.
Data and encryption
Photos may include people and sensitive infrastructure. Restrict access, encrypt, consider security classification of asset locations and retain per policy.
Security and compliance mapping
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Required for staff and administrators. Essential Eight. |
| Restrict administrative privileges | Just-in-time elevation and separate admin accounts. Essential Eight. |
| Regular backups | Automated backups with a copy held outside the workload account or subscription. Essential Eight. |
| Privacy and security of personal information | Encryption, access logging and retention support APP 11. |
| Logging | Central, tamper-resistant logs support ISM event logging guidance and ISMF expectations. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
Failure modes, targets and scaling
- Target RTOMinutes for zone failure; hours for a rebuild from code
- Target RPOSeconds to minutes with point-in-time recovery
- Scaling and limitsSized from measured peak demand with a load test before go-live. Check service quotas early.
| Failure mode | Mitigation |
|---|---|
| Lost device | Remote wipe, encrypted storage and short tokens. |
| Sync conflict | Server-wins on status, merge on notes. |
| Large uploads fail | Resumable multipart uploads. |
| Work order API down | Queue and retry. |
Observability and runbooks
- Service-level objectives for availability and latency with burn-rate alerts.
- Audit log review for sensitive actions.
- Queue depth and integration error dashboards with a named owner.
Cost drivers and levers
Compute, database, data transfer and licences for any SaaS components.
- Reserve the baseline.
- Schedule non-production down.
- Cache and compress at the edge.
- Archive old data.
Implementation and fit
Phased approach
- Discovery: process, data and obligations mapped with the business owner.
- Foundation: landing zone, network, identity and pipeline.
- Thin slice: one journey end to end in production for a small group.
- Expand and harden: remaining journeys, load and penetration testing.
Anti-patterns to avoid
- Building before the decision rights and audit needs are agreed.
- A single shared admin role.
- Personal data in logs and test data.
- Integrations without retries or a dead-letter path.
When to use it
- Inspection, audit and maintenance programs.
- Teams working in poor coverage.
When not to
- Safety-critical control systems (OT) integration without specialist review.
More in industry patterns
Aged care and community services
Aged care and community services administration
Client records, rosters, care plans and incident reporting connected on a Microsoft stack, with consent, family access and regulatory reporting handled deliberately.
State government
Citizen service portal for state government
A public channel for an application, a payment and a case, with the decision kept with an officer and a full audit trail, hosted in Australian regions.
Local government
Council request and field service platform
Residents lodge requests on web or mobile, crews work offline in the field and the council system of record stays authoritative, with AI used only to triage and summarise.
Related insights
Discuss this architecture
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.