Secure business portals that join your people and systems up

Role-based access is the layer above that. We define roles against actual duties, then permissions against roles, then assign people to roles. It sounds pedantic and it is the difference between a permission model you can still reason about in year three and a pile of individual exceptions. Access is also scoped by data, not just by screen. A regional manager sees their region's records, a national role sees all of them, and a contractor sees only the jobs they are assigned to. Where the portal exposes personal information, that scoping is part of how you meet your obligations under the Privacy Act 1988 and the Australian Privacy Principles.

We model chains explicitly. A request routes by value, by cost centre or by category. If the approver is on leave, their delegate receives it automatically and the record shows why. If nothing happens within an agreed period, it escalates rather than sitting in someone's notifications. Emergency overrides exist, because operations sometimes need them, and every use is logged and reportable so the exception does not silently become the norm. The audit trail records the full chain, so months later you can answer who approved the variation without anyone searching their inbox.

For those workflows we build offline-capable screens. Forms, checklists, job notes and photos are captured locally on the device and queue for upload, with a visible indicator of what has synced and what has not so nobody is left guessing. Conflict rules are agreed up front for the cases where two people update the same record. Photos are compressed on the device so a day of site images does not stall on a single bar of reception. We test this on real handsets in real conditions, because assumptions about coverage made in a Sydney office do not hold on a job site outside Dubbo. Where the field workflow is the whole product, a dedicated mobile app is sometimes the better answer and we will say so.

The custom case appears when the portal must combine data from systems that do not talk to each other, enforce a permission model your existing tools cannot express, or carry an approval process with real thresholds and audit obligations. If your need is outward facing rather than internal, you are probably looking at client portals or supplier portals, which have different security and onboarding requirements. And if the underlying issue is that the same data is rekeyed between two systems every day, the cheaper fix may be workflow automation rather than a new interface over the top. Large organisations with many systems tend to need the portal eventually, which is why we scope this carefully with enterprise clients before committing.