Decision-making
Officer decides, system records reasons and evidence.
Why. Administrative law and fairness.
Trade-off. Slower than full automation, but defensible.
Industry patterns · State government
Citizen service portal for state government
A public channel for an application, a payment and a case, with the decision kept with an officer and a full audit trail, hosted in Australian regions.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
- WCAG 2.2 AA
- Australian Privacy Principles
- SA ISMF expectations
- ACSC Essential Eight
Architecture
- People and clients
- Network and edge
- Databases and data
- Messaging, events and workflow
- Security and identity
- SaaS and business systems
- Monitoring, audit and analytics
- Request or data flow
- Asynchronous or optional
- Boundary: region, account, network or trust zone
Request and data flow
A citizen reaches the portal through Front Door and WAF.
Traffic reaches the application over a private origin. No public ingress exists on the app.
Sign-in uses the agency's chosen identity service over OIDC. The form asks only what the decision needs.
Fees are taken on the payment provider's hosted page, so card data never touches the portal.
The case, evidence and an append-only audit trail are written to the database.
A case officer assesses and records the decision with reasons. The system never decides alone.
The outcome is filed to the records system and the citizen is notified.
Components and why they were chosen
| Component | What it does | Why this choice |
|---|---|---|
| Azure Front Door and WAF | Entry, TLS and protection. | Keeps the origin private and absorbs abuse. |
| Container Apps or App Service | Public portal and staff console. | PaaS lowers operations effort. |
| Azure SQL Database | Case data and audit tables. | Relational integrity for case state. |
| Service Bus | Reliable hand-off to records and notices. | Retries when downstream systems are down. |
| Identity service (Entra External ID, myGovID where applicable) | Citizen sign-in. | Do not build credential storage. |
| Hosted payment page | Card capture. | Keeps the portal out of PCI scope. |
| Records integration | Files the case to the system of record. | Records obligations are met in the existing system. |
| Notification service (Azure Communication Services or GovNotify-style) | Email and SMS. | Templates controlled and logged. |
Design decisions and trade-offs
Audit
Append-only audit log in a separate store.
Why. Evidence survives application bugs.
Trade-off. More storage and a second schema.
Payments
Hosted payment page.
Why. Reduces compliance scope.
Trade-off. Less control over the payment UI.
Hosting
Australia East primary, Australia Southeast for backup.
Why. Residency expectations for government data.
Trade-off. Not all services launch in both regions at once.
Well-architected pillars
Security
Private networking, Entra ID with Conditional Access, encryption with customer-managed keys, least-privilege roles and WAF on the public edge.
Reliability
Zone-redundant services, backups with tested restores and queue-based retries for integrations.
Performance
Edge caching for public content, asynchronous processing for anything slow and indexes tuned to the main queries.
Cost optimisation
Scale with demand, use reservations or savings plans for the steady baseline and set budgets and alerts per environment.
Operational excellence
Infrastructure as code, pipeline deployments with rollback, dashboards on service-level objectives and runbooks for the top failure modes.
Sustainability
Right-size, schedule down non-production and archive data to colder tiers on a retention schedule.
Network, identity and data
Networking
Spoke virtual network with private endpoints to data services. Public ingress only through the edge service with WAF. Private connectivity to on-premises or partner systems by VPN or dedicated link.
Identity and least privilege
Citizens through the external identity service. Staff through Entra ID with MFA and role-based access to case types. Break-glass accounts monitored.
Data and encryption
Classify case data and apply PROTECTED handling if required. Encrypt with customer-managed keys, retain per the records schedule and restrict officer access to assigned cases.
Security and compliance mapping
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Required for staff and administrators. Essential Eight. |
| Restrict administrative privileges | Just-in-time elevation and separate admin accounts. Essential Eight. |
| Regular backups | Automated backups with a copy held outside the workload account or subscription. Essential Eight. |
| Privacy and security of personal information | Encryption, access logging and retention support APP 11. |
| Logging | Central, tamper-resistant logs support ISM event logging guidance and ISMF expectations. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
Failure modes, targets and scaling
- Target RTOMinutes for zone failure; hours for a rebuild from code
- Target RPOSeconds to minutes with point-in-time recovery
- Scaling and limitsSized from measured peak demand with a load test before go-live. Check service quotas early.
| Failure mode | Mitigation |
|---|---|
| Records system unavailable | Queue the filing with retries. The case closes only after confirmation. |
| Identity provider outage | Clear message and retry. Saved drafts survive. |
| Spike on a deadline day | Autoscale and a queue-based waiting room if needed. |
| Inaccessible form change | Accessibility tests in the pipeline. |
Observability and runbooks
- Service-level objectives for availability and latency with burn-rate alerts.
- Audit log review for sensitive actions.
- Queue depth and integration error dashboards with a named owner.
Cost drivers and levers
Compute, database, data transfer and licences for any SaaS components.
- Reserve the baseline.
- Schedule non-production down.
- Cache and compress at the edge.
- Archive old data.
Implementation and fit
Phased approach
- Discovery: process, data and obligations mapped with the business owner.
- Foundation: landing zone, network, identity and pipeline.
- Thin slice: one journey end to end in production for a small group.
- Expand and harden: remaining journeys, load and penetration testing.
Anti-patterns to avoid
- Building before the decision rights and audit needs are agreed.
- A single shared admin role.
- Personal data in logs and test data.
- Integrations without retries or a dead-letter path.
When to use it
- Applications, permits and payments with an officer decision.
- Services needing accessible and mobile-friendly delivery.
When not to
- Fully automated decisions affecting entitlements.
- One-off forms (use a forms platform).
More in industry patterns
Local government
Council request and field service platform
Residents lodge requests on web or mobile, crews work offline in the field and the council system of record stays authoritative, with AI used only to triage and summarise.
Health
Health referral and intake workflow
Structured digital referrals into a clinical service, with consent, secure messaging and clinical system integration, hosted in Australia with strong audit.
Education
Student and learner services platform
One front door for enrolment, support requests and communications, integrated with the student information system and learning platform, with safeguarding built in.
Related insights
- WCAG 2.2 for SA Government and council websites: what buyers should require
- Australian data residency for SA Government ICT projects: what buyers and suppliers should ask
- Online forms and payments for SA councils and small businesses: a practical guide
- Software testing and UAT for SA Government and council projects: a practical guide
Discuss this architecture
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.