← All work

        Envoy/Compliance integrity at enterprise scale/Enterprise SaaS
      

Making compliance data something an enterprise can actually defend

Hybrid organizations enforce policy, validate compliance, and protect safety standards using workplace data they can't fully vouch for. I led two connected initiatives at Envoy: attendance correction governance, and the global accessibility infrastructure behind multi-language safety assessments.

Envoy Approvals dashboard listing pending attendance corrections with Approve and Deny actions, and a resolved table showing status, day corrected, reason for correction, approver and submission time — The approvals surface. Every resolved row keeps the reason, the approver's name, and the timestamp, so a correction is a defensible record rather than an edit.

60-second read

Problem

Compliance records could be edited directly, which corrected the number and destroyed the provenance.

System decision

Replace direct editing with a governed request chain, and treat language as infrastructure rather than translation.

My contribution

Led both initiatives: attendance correction governance, and multi-language safety assessment authoring.

Impact

Audit traceability 45% to 96%. Approval turnaround down 41%.

01 · Shipped

Two production systems that made workplace data auditable: a governed correction path for attendance, and language infrastructure that let a safety assessment mean the same thing in every language a site operates in.

45% → 96%

audit traceability coverage, structured logging

↓ 41%

correction approval turnaround

↓ 38%

manual reconciliation workload

02 · The problem

Attendance data drove real consequences (policy enforcement, compliance reporting, occupancy decisions), and it was wrong often enough to matter. Badge readers miss. People forget to check in. Someone is at an offsite, or goes home sick. The only remedy was an admin editing a record directly, which fixed the number and destroyed the provenance.

Meanwhile the same enterprises ran mandatory safety assessments across sites where English wasn't the working language. A translated quiz that silently falls back to English isn't a translation problem. It's a compliance record asserting someone understood something they never read.

The shared failure

Both systems produced records an auditor would accept and a designer shouldn't. The data looked clean precisely because the interface hid how it got that way.

03 · Initiative one Correction governance

I replaced direct editing with a request chain. An employee can't change the record; they can ask for it to be changed, with a reason, and a manager decides. The correction and its justification become the same object.

              Employee requests
              →
              Manager reviews
              →
              Approve / deny with reason
              →
              Immutable audit line
          

End-to-end flow map titled Attendance Correction flow - Multiple Days, tracing an employee opening the app, noticing low attendance, requesting a correction, selecting multiple days, receiving email confirmation, the manager receiving an email, and the admin reviewing in the dashboard — The whole path, mapped before any screen was designed: the employee notices the discrepancy in their own weekly attendance, selects one or several days, submits a reason, and the request surfaces to their manager and to the admin queue. Multi-day corrections resolve as one decision rather than five a manager rubber-stamps.↗ open full size

Flow map showing branching outcomes after submission: employee confirmation email, manager email with Approve and Deny actions, then an approved branch where the employee is notified and sees Checked in, and a denied branch where the employee is notified with a reason and can resubmit — Both branches, designed with equal care. Approval is the easy path; the denial path is where a governance system earns or loses trust, so a denial carries its reason and leaves the employee a way back in rather than a dead end.↗ open full size

Approvals dashboard with the Day to be corrected filter highlighted, set to Past 90 days with an explicit date range — Admins scope the queue by the day being corrected, not by when it was filed. During an audit the question is always about a date in the past.

Approval notification email beside the employee's mobile schedule showing Checked in with the note that the attendance correction was approved, and the resolved approvals table — The loop closed: the decision reaches the employee by email, their own schedule visibly updates to Checked in, and the same event lands in the resolved table with its approver attached.

04 · What I cut

Auto-approval for “obvious” corrections. It would have quietly reintroduced the original problem: a record no human vouched for.

The point of the chain isn't friction; it's that an approver's name sits on every change. Automating the easy cases removes exactly the thing that makes the record defensible.

Workplace settings panel with a toggle enabling attendance corrections and a multi-select control choosing which admins receive request notifications — Instead of automation, routing. Turnaround was an organizational problem, so admins choose who receives requests, so the org gets the control rather than the system getting the decision.

05 · Initiative two Language as infrastructure

Safety assessments had to be authored once and be true in every language a site operates in. The design problem wasn't a translation UI. It was keeping the default-language source visible while an admin writes the translation, so nothing gets orphaned and no gap goes unnoticed.

Assessment authoring in Spanish with each English source string pinned above its Spanish field, and per-language video and PDF slots with notes about inheriting the default language — Authoring the Spanish version. Every English source string stays pinned above its Spanish field as reference: title, description, instructions, each question and answer option. Video and PDF can inherit the default language or be overridden per language, and the interface says which, inline at the field.

06 · The states nobody demos

Most of the work in authoring infrastructure is the in-between: a field not yet written, media not yet attached, an admin who doesn't know what this field is for. Each is a legitimate configuration, and each needed a designed answer instead of an empty container.

Assessment instructions field showing placeholder guidance that explains its purpose with two worked examples — Empty, but not blank. The instructions field explains its own purpose and offers two worked examples, because the admin writing safety copy is rarely a writer.

Assessment authoring with instructions filled in, an empty Video URL field, Allow user to skip video checked, and a PDF listed as not yet uploaded — Partially configured, and honest about it. Instructions are written, the video URL is still empty, and the PDF reads “Not yet uploaded”, so an admin can see exactly what remains before this is publishable.

07 · Policy at the authoring layer

Retake rules, validity windows, pass thresholds, and which sign-in flows an assessment governs. The compliance policy itself lives in these controls. So I moved them out of a modal and into the authoring surface.

New assessment settings modal listing rules, response validity period options, location sign-in flow scoping, and a warning that changes will not be applied until the assessment is saved — Before: policy behind a modal. It works, but scope is invisible while you write, and the dialog has to warn you that nothing applies until you save, and an unsaved compliance change is its own hazard.↗ open full size

Assessment authoring page with a Setup card inline showing sign-in flow scoping and response validity period alongside the content fields — After: the same policy promoted into a Setup card on the page. Who this applies to and how long a response stays valid sit next to the content they govern, visible while authoring.↗ open full size

Visitor-facing construction safety assessment on mobile with a video to play and a question marked with an incorrect answer badge

What the visitor gets

The end of a long chain of admin decisions: the contractor's own language, the video their admin attached, and a 100% pass requirement.

A wrong answer is marked plainly, in place, and named as incorrect. In a safety assessment the point isn't to score someone. It's to make sure they leave knowing the right answer, so the record means what it claims.

08 · What connects them

Both initiatives replaced a clean-looking record with an honest one. A correction now carries who approved it and why; an assessment now carries which language a person actually read. Compliance integrity is a provenance problem, and provenance is decided in the interface.

09 · Impact

Measured after rollout across a global, multi-tenant footprint.

Audit traceability coverage 45% → 96%

Correction approval turnaround ↓ 41%

Manual reconciliation workload ↓ 38%

Attendance data accuracy ↑ 32%

Assessment configuration errors ↓ 29%

Global rollout 14 regions · 5 languages

The number I'd defend in an interview is traceability: 45% to 96% structured logging. The rest follows from it. You can't reconcile, audit, or trust what was never recorded as a decision.

10 · Takeaways

01 Governance is a design surface, not a backend concern.

02 An audit trail is only trustworthy if the interface makes provenance visible.

03 Design the denial path as carefully as the approval path. That's where trust is won or lost.

04 In multi-tenant products, the admin's authoring experience is the real product.

A record you can't explain isn't compliance. It's paperwork.

Next case study → Back to all work