Daniel KumarSenior UX Lead · UX Architect
← All work

Enterprise Data Platform · UX Case Study · Data Lakehouse

Warehouse and lake in one platform, under one set of rules

A data lakehouse that unifies warehouse and lake in one platform, holding legacy archiving, live production copies and analytics under one approach to management, security and governance. End-to-end UX ownership across archiving, governance and administration: strategy, architecture, complex workflow design, design system, and developer handoff.

Employer
Platform 3 Solutions
Role
Senior UX Lead
Participation
UI / UX 100%
Years
2022 to 2026
Scope
8 modules, 5 user roles
Team
Led 1–2 UX designers
Type
Enterprise product
Modules
Archival · Ingestion · Migration · Restore · Search · Alerts · Governance · Administration
Confidentiality

What this deck shows, and what it withholds

Everything described here is work I did. The product is withheld under confidentiality, and the interfaces shown here are redrawn rather than captured.

THE TERMS
  1. 01

    Withheld

    The product name, its internal module names, and any customer or sample data. No production screenshot appears here.

  2. 02

    Shown

    The structure I designed, the decisions I made and why, how I led the work, and what changed as a result.

  3. 03

    Redrawn

    Where a screen carries the argument, it is reconstructed: the structure, layout and behaviour kept, the identifying content removed and every value replaced with a placeholder.

Product & business context

What the platform does

and what it has to hold together

The platform is an application management solution covering three use cases: archiving legacy data, holding live copies of a production system, and running analytics over both.

It unifies warehouse and lake in one platform, removing the silos that separate data engineering, analytics and machine learning. My work sat on the archiving, governance and administration side of that platform.

Centralised metadata, optimised storage and distributed computing maintain data integrity. Everything is organised into applications: self-contained repositories holding their own metadata, searches, storage policy, permissions and compliance rules.

WHAT THE PLATFORM HAS TO RECONCILE
  1. 01

    Retention as a product primitive

    One common approach to management, security and governance runs across everything. Retention, hold and disposition apply at application, table, record and job level, so compliance state is legible on almost every screen.

  2. 02

    Cost and infrastructure choice

    The platform reduces operational cost and business risk while keeping infrastructure choice open. Storage tier is selected per application and changeable per table, so cost is a user-facing decision rather than an invoice.

  3. 03

    Provable integrity

    Chain-of-custody and source-to-target validation reports let customers prove data integrity to a regulator. Audit tracking captures user actions across a four-level hierarchy.

The users

Five roles, one product

and a very wide gap between them

An irreversible, compliance-governed, asynchronous platform, shared by five roles with radically different expertise, absorbing new capability release after release.

The same product serves a developer authoring SQL-backed search definitions with custom XSLT output, and a support agent who needs one customer record and has never opened it before.

FIVE ROLES, BY DEPTH OF EXPERTISE
  1. 01

    Administrator: high

    System setup, users, groups, permissions, storage, licensing and jobs.

  2. 02

    Developer: highest

    Configures applications and metadata, and authors the search screens everyone else consumes.

  3. 03

    Retention Manager: domain-deep

    Owns retention, hold and disposition policy. Approves disposal lists.

  4. 04

    Auditor: read-oriented

    Reviews system activity for organisational audit and legal purposes.

  5. 05

    End User: low

    Runs pre-built searches to retrieve records. Often business, legal or support staff.

My role & responsibilities

What I owned

UX strategy, architecture and product experience, end to end

  1. 01

    Requirement gathering

    Worked with Project Managers, Business Analysts, Product Owners and stakeholders to understand the goal behind each module and what users were actually trying to finish.

  2. 02

    Requirement translation

    Took feature-list requirements from product owners back to the task and the role behind them, and checked each against the archiving, live-copy and analytics use cases the platform has to serve.

  3. 03

    Information architecture

    Separated global destinations from application-scoped modules, and defined when a task belongs on a page, in a side panel, or in a dialog.

  4. 04

    Wireframes and UI

    I owned the wireframes and final designs for archival, ingestion, rehydration, search, approvals, alerts and administration, and signed off each design before build.

  5. 05

    Design system

    Built one library so dashboards, workflows and governance modules stopped inventing their own patterns, and so light and dark stayed in step.

  6. 06

    Handoff and QA

    Reviewed builds against approved designs with engineering, wrote the developer spec, and raised what design walkthroughs surfaced as requirements.

  7. 07

    Leadership

    Led a small UX team of one to two designers: direction, prioritisation, assigning work, reviews and critiques, mentoring, and performance discussions. Established the design-review process the team worked to.

Research & validation

Closest to the client

what informed the design, and how it was checked

Research ran through the teams closest to our clients: implementation and client-facing colleagues who work with customers every day and know what they expect and where they get stuck.

Research inputs

  • Implementation-team expectations and recurring pain points
  • Client feedback relayed through the implementation team
  • Client expectations and implementation challenges
  • Business requirements and stakeholder objectives
  • Competitive analysis and product research

Design validation

  • UX and design reviews inside the team
  • Stakeholder walkthroughs and demonstrations
  • Technical and engineering feasibility discussions
  • QA and design review before release
  • Implementation review against approved designs
ONE INPUT, WORKED THROUGH
  1. 01

    What we heard

    A client needed some user groups to view search results without being able to export them. Export could only be restricted by column.

  2. 02

    What I identified

    Run, background run and export shared one split button. Once export had its own permission, one control could not show what each user may do.

  3. 03

    Design response

    Split the control in two: a Run menu for search and background search, and a separate Export menu that is enabled or disabled by permission.

  4. 04

    UX value

    Shipped: Run and Export are separate menus, each following its own permission. Engineering extended the permission model to support it.

Source: client request raised by the client-facing team.

How I worked

One path, every feature

from requirement to shipped screen, with a design gate before build

Every feature followed the same route. Requirements were reviewed with the people who would build and test them, the flow was settled in wireframes, and nothing went into development until the final design was signed off.

FIG. 01A page from the working wireframe decks, with the annotations that went to engineering.Representative interface reconstruction. Sanitized representation of the original product design.
System management · alert templates09 / 14System management › Settings › AdministrationAdministrationPermissionsGroupsUsersStorageEmail templatesSearch by template+Filter by activity typeFilter by moduleTemplate nameActivity typeModuleLast modified atLast modified byActionNotification template 01Job schedule statusJobsNotification template 02Job schedule statusJobsNotification template 03Job schedule statusJobsNotification template 04Job schedule statusJobsNotification template 05Job schedule statusJobsNotification template 06Job schedule statusJobsEditDeleteGlyph distinguishes a system template fromone a customer created.Only customer templates can be deleted.System templates can be edited but never removed.Row action opens the same menuused everywhere else in the product.WORKING WIREFRAME · ANNOTATIONS REVIEWED WITH ENGINEERING BEFORE BUILD
  1. 01

    Stakeholder reviews

    Cross-functional requirement reviews with product, architecture, engineering and QA. I validated the direction and turned agreed outcomes into design.

  2. 02

    Wireframes first

    I built each flow in low fidelity to settle structure, states and edge cases before any visual design.

  3. 03

    Final design

    I produced the high-fidelity screens for every state a flow could reach, from empty and loading to conflict and failure.

  4. 04

    A written gate

    Each requirement document named me to verify and confirm the final design before UI implementation began.

Requirement → Stakeholder review → Wireframe → Final design → Design sign-off → Build → UX review

The gate is written into the requirements, so design review was a step in delivery, not a courtesy after it.

Key insights

Six patterns

what the research and the product kept pointing at

  1. 01

    One hierarchy, one expression

    Application, schema, table, column are expressed the same way everywhere, so the level you are acting on is never in doubt.

  2. 02

    Configuration and consumption are separated

    Search has an author surface and an audience surface. They are different interfaces with different densities.

  3. 03

    Commitment is progressive

    Creation is a four-step wizard in which only the first step is mandatory. Later steps are deferrable.

  4. 04

    Consequences are stated, not implied

    Destructive operations name what will be destroyed, and what survives in the audit trail.

  5. 05

    Asynchronous work shares one spine

    Migration, disposal, exports, reports and restore all schedule, report and deliver through background jobs.

  6. 06

    Patterns precede screens

    Review states in one module mirror another. Scheduling reuses the same shell wherever it appears.

Designing for risk

One-way doors

and how the product holds them shut

Safety here is structural rather than dialog-based. Permanent disposal separates the user who generates the list from the Retention Manager who approves it. User deletion enumerates what it destroys and is blocked until ownership of cross-app searches is transferred. Protected-storage configuration locks once a table holds records.

Approval is separated from generation, and assigned to a specific role. The constraint is enforced by the workflow, not by a warning.

THE OTHER ONE-WAY DOORS, AND WHAT HOLDS THEM
  1. 01

    Metadata columns: stated at the point of decision

    Columns can be added to a table’s metadata but never removed. The constraint is surfaced where the column is added, not discovered afterwards.

  2. 02

    Protected storage: closed by sequence

    Protected-storage configuration can no longer be added or removed once a table holds ingested records. The door closes before it can be regretted.

  3. 03

    Application deletion: blocked before confirm

    Blocked up front while the application holds data, with the reason shown, instead of confirming and then failing. This needed a new data flag from engineering.

  4. 04

    Session rollback: a way back

    The exit that does exist. A rollback removes everything ingested in a session, for duplicate, invalid or test data.

Disposition, gated by role separation: Qualify (retention expired and no active hold) → Generate list (status: under review) → Approve (human gate, Retention Manager only) → Dispose (data permanently destroyed).

Designing for risk

Stating the consequence

before the action, not after it

Deleting a user is irreversible and reaches further than the account. The dialog carries the whole consequence before the destructive control becomes available.

FIG. 02Deleting a user: what is destroyed, what is kept, and the transfer that has to happen first.Representative interface reconstruction. Sanitized representation of the original product design.
System managementAdministration settingsUsersAdd userSearch usersAll statusesUSERNAMEFIRST NAMEBUSINESS JUSTIFICATIONSTATUSACTIONUser_01ActiveUser_02ActiveUser_03ActiveUser_04ActiveUser_05ActiveUser_06ActiveShowing 1 to 6 of 26 usersDelete user User_07?This cannot be undone.×PERMANENTLY DELETEDAll credentials and security tokens, invalidated immediatelyAll scheduled background jobs and their output dataAll saved queries in the query editor, private and publicAll query historyiThe user's name remains in metadata, logs and audit trails.iJob schedules and compliance policies owned by this user are not transferred.Transfer 14 cross-application searches to *Select a userEligible owners are active users who hold the manage cross-app search privilege.I understand this cannot be undoneCancelDelete user
  1. 01

    Irreversibility is stated twice

    The title says it cannot be undone, and the acknowledgement repeats it at the point of commitment.

  2. 02

    Destroyed and retained are separated

    A red block lists what is permanently deleted. Neutral lines below state what survives in metadata, logs and audit trails.

  3. 03

    What is deleted is named

    Scheduled background jobs owned by the user, and their output, are named as permanently deleted, so the loss is known rather than discovered.

  4. 04

    Search ownership must move first

    Cross-app searches owned by the user must be transferred to another user. My early wireframe allowed skipping this; the final design makes it mandatory.

  5. 05

    The destructive control stays disabled

    Delete user is unavailable until the transfer is resolved and the acknowledgement is ticked.

The dialog states what is destroyed, what survives, and what must happen first, before the destructive control becomes available.

Designing for risk

A safe path into production

moving archived data back into live systems without surprises

Rehydration writes archived data back into operational databases. A partial or misdirected write into production is hard to reverse, so the flow is built to catch problems before anything runs.

FIG. 03Creating an application: a trade-off stated on an axis, and two ways out of the same step.Representative interface reconstruction. Sanitized representation of the original product design.
ApplicationsCreateCreate applicationApplication infoLegacy finance system · Active archiving2Storage typeChoose where this application stores its data3MetadataUpload a metadata file, ZIP or JSON4Application complianceApply retention or hold at application levelStorage tierTiers trade availability against cost. This becomes the default for every table in the application, and can be changed later per table.HIGH AVAILABILITYLOW COSTCluster file systemHighest availability. Data stays on the cluster.DEFAULT TIERObject storageLower cost per TB. Higher latency on first read.← PreviousContinue to metadataCreate applicationTwo exits from the same step: carry on configuring,or create the application now and finish the rest later.
  1. 01

    Staging before production

    Data lands in staging first. Pushing it to production is a separate step that needs approval.

  2. 02

    Validate before scheduling

    A field-by-field check shows whether each source field exists in the target. Missing metadata is flagged, with an action to create it.

  3. 03

    Dependencies are offered

    When related tables exist, the user is asked to include them. Leaving them out needs an explicit acknowledgement that records may be orphaned.

  4. 04

    Approval states the impact

    Before a production push, the approver reviews an impact summary and confirms it. A rejection requires remarks.

A write into production is hard to take back, so every check happens before the job runs, not after it fails.

Shipped. One flow, reachable from status monitoring, metadata and ad-hoc search. Scheduling takes a start time only, because an end window was not technically feasible.

Governance

Approval without guesswork

multi-stage review before sensitive data is used

Some searches and data operations need sign-off before they run. Approvers can be individuals or groups, across several stages, and everyone involved needs to know where a request stands.

FIG. 04The approval review chain, with the reviewer set countable on the page.Representative interface reconstruction. Sanitized representation of the original product design.
ApplicationsApplicationSearchesSearch 04Search nameSearch 04PreviousSaveSearch formResultExpand resultQueryPermissionAdditional configurationApproval workflowEnable approval review chaini1Stage name *Stage 1Manage approversApprovers:42 users · 9 groupsUser_01×User_02×User_03×User_04×Grp_05×Grp_06×Grp_07×Grp_08×User_09×User_10×User_11×Grp_12×Grp_13×Grp_14×Grp_15×User_16×User_17×User_18×Grp_19×Grp_20×Grp_21×Grp_22×User_23×User_24×Add new stage
  1. 01

    People and groups

    A stage builder mixes users and groups, with a running count of who is included in each stage.

  2. 02

    Two inboxes, not one

    Requests received and requests raised are separated, so approvers and requesters each see their own queue.

  3. 03

    Whose turn it is

    The review screen shows the stage path, marks the current stage as your turn, and keeps the full history in view.

  4. 04

    Decisions can move back

    Besides approve and reject, a request can be sent back to an earlier stage when it needs another look.

An approval flow fails when people cannot tell whose turn it is. The design answers that on every screen.

Shipped. Terminology, group membership and simultaneous approvals were worked through in cross-functional reviews.

Search UX

One feature, two audiences

and no compromise between them

Searches are authored by developer-role users and activated for everyone else. A draft or inactive search stays visible to its author and invisible to end users. One feature, two audiences, two densities.

Author: configuration

  • Two-step wizard: identity and access, then definition
  • Input parameters, result columns, retrieval logic, permissions
  • Table template for many results, section template for one
  • Custom HTML, JS, CSS or XSLT presentation overrides
  • XSL-FO output for generated PDF reports
  • Conditional links into other searches, across applications

Audience: consumption

  • A listing viewable as grid, list or tree
  • Searches identified by author-chosen icons and tags
  • An empty state that suggests how to start
  • Results exported to CSV, PDF or Excel
  • Ad hoc zero-configuration lookup for discovery
  • Permission-scoped, with clear messaging on restricted links
THE GRADUATED CEILING: A DEVELOPER NEVER HAS TO ABANDON THE TOOL AND START AGAIN
  1. 01

    Basic

    Query auto-generated from selections.

  2. 02

    Advanced

    Hand-written SQL.

  3. 03

    Report

    Report-oriented, formatted output.

  4. 04

    Group

    A virtual folder, no query.

The compromise a single screen would have forced: enough configuration to confuse the reader, not enough to serve the author.

Explorations

Three layouts, one shipped

and the reason the duller option won

Search results are where an end user spends their time. I explored three ways to present them before settling on one.

FIG. 05The three result layouts explored, and the reason the duller one won.Representative interface reconstruction. Sanitized representation of the original product design.
EXPLOREDCardsEach result as a card with its ownlabels and padding.Reads well with a handful of results.At two hundred rows the padding andrepeated field labels turn scanninginto browsing.EXPLOREDDense gridA tighter grid, less padding, moreresults per screen.Better density than cards, but stillrepeats every label per item and givesnowhere to put an action that appliesto a selection.SHIPPEDData table with row selectionColumns, header labels stated once,checkbox per row.Labels appear once in the header.Values align in columns so a user scansdown rather than reading across. Rowselection gives export and rehydrationsomewhere to live.THE TRADE-OFF I ACCEPTEDA table is the duller thing to look at. For users checking results rather than discovering them, that was the right thing to give up.
  1. 01

    Cards: explored

    Each result as a card with its own labels and padding. Reads well with a handful of results. At two hundred rows the padding and repeated field labels turn scanning into browsing.

  2. 02

    Dense grid: explored

    A tighter grid, less padding, more results per screen. Better density than cards, but still repeats every label per item and gives nowhere to put an action that applies to a selection.

  3. 03

    Data table with row selection: shipped

    Columns, header labels stated once, checkbox per row. Labels appear once in the header. Values align in columns so a user scans down rather than reading across. Row selection gives export and restore somewhere to live.

A table is the duller thing to look at. For users checking results rather than discovering them, that was the right thing to give up.
Search UX

Designing inside a hard limit

running a search from an uploaded file

Users needed to run a search against a list of values from a CSV file. The query engine has a fixed size limit that cannot be changed, so bad or oversized input had to be caught before execution.

FIG. 06Running a search from an uploaded file, against a size limit the engine cannot change.Representative interface reconstruction. Sanitized representation of the original product design.
ApplicationsApplicationSearchesSearch 04Search nameSearch 04Search formResultExpanded resultsQueryPermissionAdditional configurationContainer 1+Upload fileFILE UPLOADUploadingsample_a.csv42%×Validating the uploaded filesample_b.csv86%×Validated. 1,000 values foundsample_c.csv×Rejected. Value count is above the engine limitsample_d.csv!×Three uploaded columns match fields that already existAdd the new fields only, and leave the existing fields as they areReplace the existing fields with the uploaded onesMap payload fieldsCancelAddAdd stays disabled while a file is rejected.
  1. 01

    The existing field model

    File upload joined the existing field types, and validation used the existing message feature rather than a separate one.

  2. 02

    Every state is visible

    Uploading, validating, validated and failed each have their own state, shown on the field itself.

  3. 03

    Conflicts are a choice

    When uploaded columns match existing ones, the user chooses to add new fields only or replace the existing ones.

  4. 04

    Structure before execution

    Payload fields map to CSV columns, so a missing mandatory column stops the search before it runs.

When the engine cannot change, the interface has to catch bad input early and say exactly what is wrong.

Shipped. File upload was added to the existing field model rather than built as a separate feature.

UX architecture

Two structures, two levels

the architecture decisions everything else hangs from

An application is one unit of ownership and access: data, metadata, searches, permissions, storage and compliance. Navigation follows the same line, with global destinations always on the rail and application modules only inside one.

The data hierarchy is reused across metadata, catalog scoring, permissions and reporting: application, schema, table, column, record. Actions are offered at several of these levels at once. Entering a task from a deeper level pre-fills and locks the levels above it, so context is inherited rather than re-declared.

FIG. 07The two navigation levels: eight global modules on the rail, application modules only inside an application.Representative interface reconstruction. Sanitized representation of the original product design.
← All applicationsApplicationActive archiving · 8 searchesDashboardSearchesQuery editorMetadataComplianceApp info and configValues listApplicationsApplicationSearchesSearches8Adhoc searchImportNew searchSearch searchesSearch filterCategory filterClear cacheSearch 01Advanced searchValidatedActiveSENSITIVE1 schema · 1 tablesSearch 02Basic searchValidatedDraft2 schema · 2 tablesSearch 03Report searchValidatedInactiveSENSITIVE1 schema · 3 tablesSearch 04Advanced searchValidatedActive2 schema · 4 tablesSearch 05Basic searchValidatedDraft1 schema · 5 tablesSearch 06Report searchValidatedInactive2 schema · 1 tablesSearch 07Advanced searchValidatedActive1 schema · 2 tablesSearch 08Basic searchValidatedDraftSENSITIVE2 schema · 3 tablesLEVEL 1 · PRODUCTAlways present. Eight modules,the same eight wherever you are.LEVEL 2 · INSIDE ONE APPLICATIONAppears only once an application is open, and carries the name and lifecycle state of that application above it.A user is never offered a module that has nothing to act on.
THREE PLANES BY AUDIENCE, ON TWO NAVIGATION LEVELS
  1. 01

    Application workspace: level 2, the rail swaps on entry

    Searches · Metadata · Compliance · App config · Activity tracker. Audience: developers, end users, retention managers.

  2. 02

    System management: level 1, always on the rail

    Settings · Permissions · Groups · Users · Storage · Jobs · Licensing. Audience: administrators.

  3. 03

    Governance: level 1, cuts across every application

    Dashboard · Catalog · Classification · Lineage · Encryption · Protected storage · Audit. Audience: retention managers, auditors, admins.

Entering an application swaps the rail, and a back link returns to all applications. The breadcrumb always states the level, and system and governance work never hide inside an application.

Asynchronous work

Making the wait legible

long-running work, scheduled, watched and proven

Ingestion runs as a background job across many tables at once. Some succeed, some fail, some are still queued. The screen has to answer where it is, what failed, and what to do next, without the user leaving to find out.

FIG. 08An ingestion session in flight: the aggregate first, then the table that failed.Representative interface reconstruction. Sanitized representation of the original product design.
Status monitoringIngestion sessionIngestion sessionIn progress · 90%Updated 12s agoAuto refreshSession overviewTables28 of 31 finished90.3%Succeeded26Failed2In progress2Pending1Tables31Search tablesAll statusesTABLE_01SucceededTABLE_02SucceededTABLE_03FailedTABLE_04FailedTABLE_05SucceededTABLE_06Running1 to 10 of 31‹ ›TABLE_02Succeededschema · dataset · tableSet 1Succeeded1 file · 1,042,318 recordsSetsStatus historyFILES1RECORDS1,042,318CONTENT COUNT3ELAPSED TIME2m 06sLAUNCH TIME10:14:02START TIME10:14:02FINISHED TIME10:16:08SETS1 of 2Ingestion completed successfully.STATUS TIMELINEPreparingScheduledStartedIn progressSucceeded
  1. 01

    Progress before detail

    A completion figure and a segmented bar carry succeeded, failed, in-progress and pending counts, so the state of every table in the session reads at a glance.

  2. 02

    Failure is visible, not buried

    Table-level status sits in a persistent list, so a failed table is findable without opening every row.

  3. 03

    Drill-down keeps the session in view

    Selecting a table opens set-level detail, files, records, elapsed time and status timeline, inside the session.

  4. 04

    Evidence is reachable from here

    File lists, counts and validation reporting hang off the same screen, so proving the load and running it are one journey.

Restore reuses the same spine (basic details, staging database, production database, schedule), configured in stages, verified before scheduling, then handed to job monitoring.

Data protection

One concept, every surface

making tokenised data recognisable wherever it appears

Sensitive fields can be replaced with tokens and the originals held in isolated storage. That one concept touched metadata, search results, query tools, compliance views, dashboards and administration.

FIG. 09Protection configured per column, with the one-way nature of the decision stated at the point of the decision.Representative interface reconstruction. Sanitized representation of the original product design.
ApplicationsApplicationMetadataEntityPropertiesColumnsDataSearch columnsORDINALCOLUMNTYPE1COLUMN_01STRING2COLUMN_02STRING3COLUMN_03STRING4COLUMN_04STRING5COLUMN_05STRING6COLUMN_06STRING7COLUMN_07STRINGProtection configuration×iProtection cannot be changed or reconfigured once data has been ingested.COLUMN NAMEPROTECTION TYPEGRANT ACCESS TOREMOVECOLUMN_02Select protection typeTokeniseGrant accessUser group (+2 others)COLUMN_05Select protection typeMaskGrant accessUser group (+2 others)COLUMN_08Select protection typeEncryptGrant accessUser group (+2 others)CancelSave
  1. 01

    One marker, everywhere

    A single icon identifies tokenised fields in every table, result and lookup.

  2. 02

    Requesting the original

    Where tokenised data appears, a fixed column provides the route to request the original values.

  3. 03

    Types, explained

    Each tokenisation type is explained with what it does, when to use it, and an example.

  4. 04

    Access is guarded

    Security keys have their own flow, with attempts remaining, a lockout, and a stated purpose of use.

A protection model only works if people recognise it everywhere, so the concept was designed once and applied across the product.

Shipped. Tokenisation cannot be changed once data is ingested, and the setup screen says so at the point of configuration.

Design system & scalability

One vocabulary, agreed late

built to pull a grown platform into one modern language

The platform grew module by module, with spacing, control heights and states settled per screen. The design system brought them into one modern language, across light and dark.

Twenty-seven pages in total: colour, typography, spacing, elevation, every control, and the full data table with header, row, empty, loading and filter states. Token names are what engineering references, never the hex.

FIG. 10One page from the design system: every header and row state of the data table.Representative interface reconstruction. Sanitized representation of the original product design.
COMPONENTSData table: header and row statesThe row is its own component set, so every row in a table instance can carry a different state.Header cellSortable columns show a neutral sort glyph until sorted, then a directional arrow in the accent.ColumnDEFAULTColumnSORTABLEColumnSORTED ASCENDINGColumnSORTED DESCENDINGSELECT ALLRow statesDefault is the resting state. Hover, selected, disabled and expanded are interaction states.ApplicationREF-0318CompletedActive archivingMAOwner name14 Mar 2026DEFAULTApplicationREF-0318CompletedActive archivingMAOwner name14 Mar 2026HOVERApplicationREF-0318CompletedActive archivingMAOwner name14 Mar 2026SELECTEDApplicationREF-0318RetiredActive archivingMAOwner name14 Mar 2026DISABLEDApplicationREF-0318CompletedActive archivingMAOwner name14 Mar 2026EXPANDEDSTORAGE TIERObject · standardTABLES26VOLUME4.6 GBLAST INGEST9 min agoMETADATAUploaded
WHAT THE SYSTEM STANDARDISED
  1. 01

    Wizard with early exit

    Application creation · Search creation · Job creation · Restore

  2. 02

    Job scheduling shell

    Migration · Disposal generation · Exports · Reports · Data deletion

  3. 03

    One picker for people

    Approvers · Alert recipients · Grant access

  4. 04

    Level-scoped action

    Ingestion · Data export · Validation reports · Retention

  5. 05

    Hierarchical drill-down

    Metadata · Catalog scoring · Permissions · Governance

  6. 06

    Review-state bulk workflow

    Protected-storage recommendations · Disposal lists

  7. 07

    Exploration becomes a search

    Query console · Ad-hoc search

  8. 08

    Empty states that teach

    Search listing suggests how to begin when nothing exists

UX leadership

Leading the work

direction, a review practice, and one decision I reversed

A small UX team, one to two designers: direction, prioritisation, assigning work, reviews and critiques, mentoring, stakeholder alignment, overall UX quality and performance discussions. Designers owned feature-level execution.

I established a review gate before high fidelity: ideation and rough design, UX review, feedback and refinement, then high-fidelity mockup. UX issues surfaced before high-fidelity work started, rework dropped because direction was agreed first, and established patterns got reused rather than reinvented.

A DESIGN DECISION I CHANGED · RESTORE SCHEDULING, SIDE PANEL TO DEDICATED PAGE
  1. 01

    Initial hypothesis

    Configure the restore in a side panel, triggered from the job card, so the user stays in context.

  2. 02

    Technical discussion

    I worked the direction through with the technical team.

  3. 03

    Constraint identified

    The query filter area could become lengthy, and table names and references could need significant space.

  4. 04

    UX reassessment

    That volume would not fit comfortably in a side panel; constrained space would affect readability and usability.

  5. 05

    Final decision

    Changed direction to a dedicated page, which scales with the information the workflow carries.

An explored direction reconsidered on evidence, not a failed one. It changed in design rather than in build.

Handoff & engineering

Designing inside real constraints

and making sure the build matched the design

Several constraints could not be designed away, only designed around. In each case the honest job is to make the limitation legible at the point of decision rather than hide it until something fails.

Accessibility was specified in the design rather than left to build: contrast across both themes, focus order, keyboard operability and accessible names for icon-only controls.

Constraints I designed around

  • Schema that is additive only, stated at the point of decision, not discovered afterwards
  • Configuration that locks once data exists, held by sequence, not by a warning
  • Capability that covers part of the estate, scope stated up front, not at run time
  • Policy owned outside the interface, the UI reports a state it cannot change
  • Capability shipping ahead of its surface, labelled as such rather than dressed up
  • Destructive actions with no approval workflow, consequence enumerated before commitment

How the work reached production

  • Developer spec: wrote the handoff spec covering layout, tokens, states and behaviour, so engineering was not interpreting a static frame
  • Implementation review: reviewed built UI against approved designs and requirements, logged UX and UI inconsistencies, and drove them to closure with engineering
  • Cross-functional working: facilitated UX reviews, stakeholder demos, design walkthroughs and solutioning sessions with PMs, BAs, POs, engineering and QA
  • Guided UX designers through direction, feedback and reviews

Behaviour specified in the wireframe rather than left to the build: which items can be deleted, which are system-defined and edit-only, and what each state looks like. Each pin states a behaviour, not a measurement.

Data quality

Data quality, made visible

a score users can act on, and a search that keeps the hierarchy

The data catalog scores how well each application, schema, table and column is described. The score had to be readable at every level, and search had to keep that hierarchy reachable.

FIG. 11One score at every level of the hierarchy, with the grade and the next step that would raise it.Representative interface reconstruction. Sanitized representation of the original product design.
ApplicationsApplicationData catalogDescription qualityOne score, rolled up from column to applicationSearch the catalogAPPLICATIONApplication 0185%GoodDescriptions completeSCHEMASCHEMA_A72%FairAdd tags to raise the scoreTABLETABLE_0464%FairAdd tags to raise the scoreCOLUMNCOLUMN_0230%PoorAdd a description and tagsSearch behaviourBEFOREA matching schema was returned on its own.Its tables and columns were hidden, so theuser read an empty result as missing data.AFTERA match expands to its children, with thematching children listed first. Written asuser stories, amended into the requirement.THE SAME GAUGE APPEARS ON THE APPLICATION CARD, THE CATALOG TREE AND THE APPLICATION DASHBOARD
  1. 01

    A score at every level

    Scores roll up from column to application, and appear across catalog views and the application dashboard.

  2. 02

    A grade and a next step

    Each score carries a grade and a recommendation, such as adding tags or descriptions, so users know how to raise it.

  3. 03

    The search gap

    QA found that search showed a matching application or schema, but hid everything inside it.

  4. 04

    What I did

    I wrote the behaviour as user stories: matches expand to their children, matching children first. Requirements were amended and the fix verified.

A search that shows only the match fails quietly. The user sees no schemas or tables and concludes the data is missing, not that the search hid it.

The fix was not a feature. It was defining what search returns at every level, and what stays reachable.

Outcomes

What changed

stated plainly

Experience outcomes

  • Consistent UX patterns across a large and evolving product surface
  • Clearer separation between technical configuration and end-user consumption
  • Non-technical users could retrieve archived records without a developer running the search for them
  • High-risk and irreversible operations became understandable before commitment

Team and process outcomes

  • UX issues identified earlier through the review gate before high-fidelity work
  • Less rework, because direction was agreed before execution
  • Fewer fragmented design decisions, because reusable patterns existed to reach for
  • Designers worked to a shared process rather than to individual judgement
PRODUCT OUTCOMES
  1. 01

    Clearer implementation guidance for engineering through the developer spec

  2. 02

    Improved implementation fidelity through design QA against approved designs

  3. 03

    New capability composed from established patterns rather than designed from scratch

  4. 04

    Light and dark held as modes on one component set, not two sets of screens

Shipped from these designs: approval workflow · data rehydration · protected storage and tokenisation · bulk CSV search · application dashboard. These describe how the product works, not a projection. Quantified results were not captured on this product, so none are claimed here.

Reflection

What I would do differently

one call I would sequence differently, given the same constraints

The modern UI guidelines came after some modules had already shipped on the earlier design system.

That was not an oversight. Engineering was building in parallel to meet client commitments, and design was keeping pace with delivery rather than getting ahead of it.

WHAT HAD TO WAIT, AND WHAT DID NOT
  1. 01

    Composite patterns: genuinely had to wait

    A wizard shell, a job scheduling pattern, a review-state workflow. You cannot systematise something that has not repeated yet. These needed the product to mature first, and settling them early would have been guesswork.

  2. 02

    Primitives: did not

    Spacing, control heights, states, colour roles. None of these needed the product to mature. They could have been modernised in an early release at almost no cost to the timeline.

Separate the two. Modernise the primitives early, and let the patterns emerge. Retrofitting spacing and states later meant renegotiating decisions some modules had already made.
Key takeaways

What I took from it

and what I would carry into the next one

  1. 01

    A feature list is not a requirement

    Every item had to be taken back to the task and the role behind it before it could be designed. That translation was the work, not a step before the work.

  2. 02

    Serving opposite expertise levels means designing two products

    Search has an author surface and an audience surface, at very different densities. Averaging them into one interface would have failed both.

  3. 03

    One module has to serve every use case

    Archiving, live production copies and analytics share the same metadata, search and compliance surfaces. Designing a module for only one of them breaks the other two.

  4. 04

    Structure before styling

    Deciding which level a task belongs to, and whether it belongs on a page, a panel or a dialog, settled most of the design before anything was drawn.

  5. 05

    Retrofitting a system is mostly negotiation

    Drawing the components was the easy part. Bringing modules that had each settled their own spacing, control heights and states into one language meant agreeing rules across the whole product.

The interface was never the hard part. Agreeing on one set of rules was.
Next case study
Nine source systems, one way of working
Enterprise ETL Platform · 2019–2023