Context
The environment
University services were managed through fragmented, manual processes that made access rules, availability, and operational responsibility difficult to apply consistently. The three-person team planned and built the product together, first as a service-booking SaaS and then as a foundation for broader campus management.
Problem
What needed to change
Create one secure operating model for university services: authenticated students and staff should discover eligible services, book constrained resources, and receive appropriate access while managers retain clear policy, visibility, and audit controls.
Constraints
- Authentication had to use existing university Microsoft accounts rather than a separate identity store.
- Booking eligibility, capacity, time, role, and service rules needed enforcement beyond the interface layer.
- The product handles institutional and user data that cannot appear in public evidence.
- Architecture and product decisions were shared across a three-person full-stack team.
Contribution
My responsibility
- Full-stack product implementation across application interfaces and APIs
- OAuth and session reliability around Microsoft Entra ID and Supabase Auth
- Authorization, row-level security, and database protection work
- Rate limiting, structured audit logging, and platform hardening
- Release automation, production fixes, and interface refinement
- Shared product planning and campus-management evolution
Approach
How I structured the work
Model services as configurable operations
Represent services, resources, time slots, availability, capacity, and booking rules explicitly so different campus facilities can share one platform without sharing identical policies.
Replace rigid subscriptions with entitlements
Generalize access into entitlements with duration, usage, visibility, and approval rules, allowing the platform to support more than a single subscription workflow.
Enforce policy across layers
Combine Microsoft-backed identity, granular permissions, service-scoped access, PostgreSQL row-level security, and database constraints so important rules do not depend on client behavior.
Make operations traceable and resilient
Add rate limits, capacity protections, structured append-only audit events, release automation, and operational diagnostics to support continued production use and expansion.
Evidence
A safe view of the system
Outcome
What the work established
- Established a shared digital workflow for service discovery, eligibility, booking, and administration.
- Created a flexible entitlement and permission model that can support additional campus operations.
- Embedded identity, policy enforcement, auditability, and operational safeguards into the product foundation.