Automation level
Human verification of every field at first, relax by measured accuracy.
Why. Professional liability.
Trade-off. Savings arrive gradually.
Industry patterns · Professional services
Professional services document intake and extraction
Clients upload documents, the platform classifies and extracts the key data, and a professional reviews the result before it reaches the practice system.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
- Australian Privacy Principles
- ACSC Essential Eight
- Professional confidentiality obligations
Architecture
- People and clients
- Object and file storage
- AI and ML
- Messaging, events and workflow
- Databases and data
- SaaS and business systems
- Security and identity
- Monitoring, audit and analytics
- Request or data flow
- Asynchronous or optional
- Boundary: region, account, network or trust zone
Request and data flow
A client uploads documents through the secure portal. Files are scanned and encrypted.
An event triggers OCR and layout analysis for scans, forms and tables.
A language model classifies the document and extracts the fields, returning structured output with confidence.
High-confidence results are queued for quick review. Low-confidence and unusual documents go to full review.
The professional verifies or corrects each field. Corrections feed the evaluation set.
Approved data is stored with a link to the source page and an audit record.
Data is pushed to the practice management system by API. Human sign-off is recorded before anything is lodged.
Components and why they were chosen
| Component | What it does | Why this choice |
|---|---|---|
| Client portal with malware scan | Secure upload. | Replaces email attachments. |
| Amazon Textract (or Azure AI Document Intelligence) | OCR and layout. | Layout and tables are the hardest part. |
| Amazon Bedrock (LLM) | Classification and field extraction. | Handles variable formats. |
| Review queue and UI | Human verification. | Quality control and accountability. |
| Results store and audit | Provenance. | Show the source page behind each field. |
| Practice system integration | Pushes verified data. | Removes re-keying. |
| Evaluation set | Measures accuracy. | Tracks improvement and regressions. |
| Retention and deletion | Client files. | Obligations after engagement ends. |
Design decisions and trade-offs
Provenance
Every field links to the source page and box.
Why. Fast review and defensible output.
Trade-off. More engineering.
Model
Structured output with schema validation.
Why. Reduces malformed responses.
Trade-off. Prompt and schema maintenance.
Data handling
No client data used for training.
Why. Confidentiality.
Trade-off. No fine-tuning on client data.
Well-architected pillars
Security
Private networking, IAM Identity Center and Cognito with MFA, encryption with customer-managed keys, least-privilege roles and WAF on the public edge.
Reliability
Multi-AZ services, backups with tested restores and queue-based retries for integrations.
Performance
Edge caching for public content, asynchronous processing for anything slow and indexes tuned to the main queries.
Cost optimisation
Scale with demand, use reservations or savings plans for the steady baseline and set budgets and alerts per environment.
Operational excellence
Infrastructure as code, pipeline deployments with rollback, dashboards on service-level objectives and runbooks for the top failure modes.
Sustainability
Right-size, schedule down non-production and archive data to colder tiers on a retention schedule.
Network, identity and data
Networking
VPC with public, private and isolated data subnets and VPC endpoints. Public ingress only through the edge service with WAF. Private connectivity to on-premises or partner systems by VPN or dedicated link.
Identity and least privilege
Clients via MFA-protected accounts. Staff via SSO with role-based access to their clients only.
Data and encryption
Client documents are confidential. Encrypt with CMKs, keep data in Australia, define retention and deletion at engagement end and log access.
Security and compliance mapping
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Required for staff and administrators. Essential Eight. |
| Restrict administrative privileges | Just-in-time elevation and separate admin accounts. Essential Eight. |
| Regular backups | Automated backups with a copy held outside the workload account or subscription. Essential Eight. |
| Privacy and security of personal information | Encryption, access logging and retention support APP 11. |
| Logging | Central, tamper-resistant logs support ISM event logging guidance and ISMF expectations. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
Failure modes, targets and scaling
- Target RTOMinutes for zone failure; hours for a rebuild from code
- Target RPOSeconds to minutes with point-in-time recovery
- Scaling and limitsSized from measured peak demand with a load test before go-live. Check service quotas early.
| Failure mode | Mitigation |
|---|---|
| Mis-extraction of an amount | Cross-field validation, review and confidence thresholds. |
| Poor scan quality | Reject early and ask the client to resubmit. |
| Prompt injection in a document | Treat content as data and validate output schema. |
| Practice system API failure | Queue and retry with idempotency. |
Observability and runbooks
- Service-level objectives for availability and latency with burn-rate alerts.
- Audit log review for sensitive actions.
- Queue depth and integration error dashboards with a named owner.
Cost drivers and levers
Compute, database, data transfer and licences for any SaaS components.
- Reserve the baseline.
- Schedule non-production down.
- Cache and compress at the edge.
- Archive old data.
Implementation and fit
Phased approach
- Discovery: process, data and obligations mapped with the business owner.
- Foundation: landing zone, network, identity and pipeline.
- Thin slice: one journey end to end in production for a small group.
- Expand and harden: remaining journeys, load and penetration testing.
Anti-patterns to avoid
- Building before the decision rights and audit needs are agreed.
- A single shared admin role.
- Personal data in logs and test data.
- Integrations without retries or a dead-letter path.
When to use it
- High-volume document handling such as tax, loan or case files.
- Practices re-keying data.
When not to
- Documents needing legal interpretation without review.
- Low volume where manual entry is cheaper.
More in industry patterns
Retail and distribution
Retail order and inventory integration
Orders from web, marketplace and in-store channels flow to one order management layer, with inventory, fulfilment and accounting kept in step and a clear view of stock.
Utilities and field services
Field inspection and asset maintenance
Inspectors capture evidence on mobile devices, offline if needed. Findings flow to the asset register and generate work orders with a complete, timestamped evidence trail.
Aged care and community services
Aged care and community services administration
Client records, rosters, care plans and incident reporting connected on a Microsoft stack, with consent, family access and regulatory reporting handled deliberately.
Related insights
Discuss this architecture
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.