Student Recruitment & Education Operations Platform

The application was the unit of truth: a student’s identity lived inside it, so applying twice created two unrelated copies of the same person.

I introduced a first-class Student record that owns only what belongs to the person, with a hard rule that university, course, campus, intake, status and outcome stay on the application and are never copied across. The link is deliberately nullable and additive — the embedded data stays the source of truth until every reader has moved, and applications created before the backfill simply carry null and keep working.

Only first and last name are required, because the existing data genuinely lacked dates of birth; requiring them would have forced the migration to invent identity data. The backfill has a dry run, a batch id for scoped rollback, and a marker so migrated rows stay identifiable. Student and application IDs are issued server-side from atomic counters inside validation hooks, are immutable, and are stripped from any payload that tries to supply one — an ID quoted on a phone call only works if it means the same thing forever.

The application detail route had no permission check. The list route scoped itself by the owner id the browser sent, so omitting it returned every application in the business.

I replaced that with one authorization module in front of every application-touching route, with eighteen named actions rather than a single boolean. Two decisions carry the weight. It fails closed: the scope builder returns either "unrestricted" or an explicit deny-all clause, never an empty object — an empty object is exactly what made a caller entitled to nothing indistinguishable from a caller entitled to everything. And it does not leak IDs: a non-authority caller gets 403 whether the record is forbidden or absent, so responses cannot be used to probe which IDs are real.

The guard runs at the route, before the handler, including on child resources — so a note, document or task ID can never reach a parent you cannot open, and no signed file URL is minted before access is established. The same scope powers the dashboard counters and the websocket subscriptions, so realtime is not a side door and a count can never contradict the list behind it.

On the same production data, in the same hour, the three roles are looking at three different systems: an administrator every application in the business, a manager only the files they hold or were given, an agent nothing but their own.

The same passport was being uploaded once per application. Sharing the stored object naively would have been worse: deleting an application deleted every object it referenced, unconditionally.

Ownership and association are now separate. A student document belongs to the person and owns the stored object; an application document is the association, and is therefore the reference count. Every association is either reused or owned, enforced by a validation hook — never both, never neither. From there the rules fall out: detaching never deletes bytes, a student document can only be deleted when no active association references it, and deleting an application may delete its own files but never borrowed ones.

Versioning never rewrites the past — a new version is a new record, so an application that used version one still points at version one and its history stays truthful. Promoting a file from an application onto the profile is transactional and keeps the identical storage key: nothing is copied, nothing is moved, and every signed URL already sitting in an inbox keeps resolving. Permission is applied twice — the route proves you may work this application, then the service applies edit permission on the person.

The data-protection agreement is signed by a student with no account, through a public link. The signing page refuses any record that already carries a signature, so re-sending after signing minted a fresh token that opened onto "Form already signed" — and replacing the record wholesale destroyed the evidence that the student had signed at all.

A completed agreement is now an immutable historical record. Re-issuing archives it — the signature, its stored object, the timestamp and the exact consent wording that was agreed to — and replaces the active slot in a single atomic write, so a signature can never be cleared without its copy being kept. Token invalidation is a property of the data model rather than a revocation list: archived tokens are deliberately never indexed and never looked up, so a superseded link stops working the moment it is archived.

The email is now sent before anything is recorded, because the previous order wrote "Data protection sent" into the history of applicants who had received nothing. And the public surface became its own router carrying exactly two routes — it replaced a single flag that guarded only the last few registrations, which had left list, detail, create, update, delete, status, assignment, notes and documents all silently mounted with no authentication.

Every agent negotiates their own commission ladder, and agents compete with each other. The agent endpoint is authenticated, not administrative — so any signed-in user could read an agent record.

The fix is at the schema level, not the view: commission and internal notes are excluded from every query unless one asks for them by name, so a field cannot leak through a route nobody remembered to check. Validation then enforces the shape a human actually negotiated — whole students from one, no overlapping tiers and no gaps (1–5 then 7–10 leaves the sixth student unpriced), exactly one open-ended top tier and it must be last, percentages capped at 100, fixed amounts requiring a currency — with every error returned at once, because an administrator editing four tiers wants all four mistakes in one round trip.

The module deliberately computes nothing. When a student counts as recruited, and what a percentage is taken from, are not recorded anywhere in the system; shipping a plausible earnings figure would have been easy and would have been wrong. The result is visible three ways on one record: an administrator sees the ladder, a manager sees "not configured", and the agent sees their own terms marked shown for reference.

A notification broadcasts the existence of a record. Fanning out to "everyone involved" tells people about applications, students and partner applications they cannot open, and a retry puts the same thing in a bell twice.

Every candidate recipient is re-authorised by calling the same functions the entity’s own routes use — the application authorization module for applications, the task access module for tasks, explicit relationship checks for accounts and partner applications — and inactive accounts are dropped. Idempotency is enforced by the database: a partial unique index on recipient and event key, partial specifically so production rows predating the key survive while every new event yields exactly one notification per person.

Notifications carry a structured destination rather than a baked URL, so they keep working when routes change, and delivery over websockets authenticates with the same cookie and authorises every subscription.