
Feb 19
Hard MVP deadline
7
Internal user groups
0 -> RBAC
From open access to tiered
Everyone sees everything
A marketing copywriter saw the same controls as IT. No separation of concern, no trust model.
Navigation by data model
Labels matched table names. Users had to translate their goal into schema before they could act.
Top tasks buried
The flows each team used most lived three or four clicks deep, behind engineer-written labels.
A growing interface tax
Every new feature was bolted on top — and routed back to engineering as another support ticket.
MAPPING MENTAL MODELS
The Vigilant Guardian
SECURITY, ADMIN, IT
The Objective Witness
GRC, LEGAL, AUDITORS
The Strategic Observer
BUSINESS & STAKEHOLDERS
THE DESIGN SOLUTIONS
Iteration velocity vs. manual cycles
Weekly check-ins
Users shaping the work

Inclusivity, not a checklist.
Built alongside the design system owner: color, focus order, motion, and content patterns reviewed together. WCAG 2.2 AA was met at launch, not patched in after.
RESULTS
Shipped on time
Launched on the deadline with no scope cuts to the core RBAC model.
Engineering unblocked
Department leads now self-serve — interface tickets stopped flowing back to engineering.
Foundation to build on
Finance, Ops, and future modules slot directly into the same permission system.
"Wow! This is exactly what we needed. It's much better to use."
— DEPARTMENT LEAD, POST- LAUNCH
REALITY CHECK