Trackunit · Access management & safety
Who may operate which machine? Make the rules configurable.
Qualification requirements differ by country and by customer. The product decision was to make those differences configurable, rather than build a new variant for each one.
The problem
One platform. Different requirements.
Access to a machine isn’t a login question. It’s a qualification question: does this person hold the certificate, the training and the approval to operate this particular machine?
The rules aren’t the same everywhere. They vary from country to country, and in practice from customer to customer, because each customer layers its own requirements on top of the legislation. The easy route is a variant per market. That holds until market number four.
Meanwhile, key admins were handing out machine access by hand, one qualified operator at a time — because the rules lived in legislation, and the legislation was handled manually.
My responsibility
I owned operator profiles — qualifications, certificates and access rules — as core functionality in Trackunit On ↗. The product spans both the platform and the customer-facing app, so the work meant coordinating the teams on either side of that split.
The recurring call was where to draw the line: what the product should standardise, and what customers should be able to configure themselves.
The decision that mattered
Configure the requirements. Validate training at the source.
Build operator profiles as configuration that customers layer their own rules onto — and integrate with certifying bodies such as IPAF, so a qualification comes from the organisation that issued it rather than from a spreadsheet.
What happened
The vision was to pull the rules into the system, so manual key handling shrank to the exceptions. The access half shipped: conditional inspections made access to a machine depend on a completed check, instead of an administrator keeping watch.
The qualification half got very close, but we didn’t finish it. It didn’t stall on the rules. It stalled on the data underneath them — where certificates actually come from.
“Anders knows his domain inside out. He could answer detailed questions about keys, operators, portals and asset pooling off the top of his head, and when he didn’t know, he said so and found out.”
What I learned
- You don’t solve a rule that varies by building a variant per market. You build it as configuration and let the customer layer their own requirements on top of the law.
- The rule is the easy part. The data under it is the work.
- Compliance logic is rarely what’s hard. What’s hard is keeping it out of the way of someone with thirty other things to do before lunch.