Public trust systems fail when verification requires privileged access, or when PDFs are generated without auditability.
A sound shape separates management apps, identity/roles, document generation workers, object storage, and a minimal public verify experience.
QR-backed PDFs and strict role models turn “please email the office” into a verifiable digital path.
Identity is the architecture
Ministry, institution, and public personas are different products sharing a registry. Role mistakes are data breaches waiting to happen.
Put a mature IdP in front early — bolting roles onto app tables later is expensive.
Generate documents out of band
PDF rendering belongs in workers with retries. Request threads should accept jobs, not block on browsers-in-containers.
Keep public verify narrow
Verification should answer authenticity questions — not become a backdoor search across personal records.
Publish only what the policy allows; store the rest behind authenticated admin surfaces.
Takeaways
- Verify without expose.
- Document generation is asynchronous infrastructure.
- Role design is security design.