Enterprise Data Platform · UX Case Study · Data Lakehouse
Warehouse and lake in one platform, under one set of rules
A data lakehouse that unifies warehouse and lake in one platform, holding legacy archiving, live production copies and analytics under one approach to management, security and governance. End-to-end UX ownership across archiving, governance and administration: strategy, architecture, complex workflow design, design system, and developer handoff.
- Employer
- Platform 3 Solutions
- Role
- Senior UX Lead
- Participation
- UI / UX 100%
- Years
- 2022 to 2026
- Scope
- 8 modules, 5 user roles
- Team
- Led 1–2 UX designers
- Type
- Enterprise product
- Modules
- Archival · Ingestion · Migration · Restore · Search · Alerts · Governance · Administration
What this deck shows, and what it withholds
Everything described here is work I did. The product is withheld under confidentiality, and the interfaces shown here are redrawn rather than captured.
- 01
Withheld
The product name, its internal module names, and any customer or sample data. No production screenshot appears here.
- 02
Shown
The structure I designed, the decisions I made and why, how I led the work, and what changed as a result.
- 03
Redrawn
Where a screen carries the argument, it is reconstructed: the structure, layout and behaviour kept, the identifying content removed and every value replaced with a placeholder.
What the platform does
and what it has to hold together
The platform is an application management solution covering three use cases: archiving legacy data, holding live copies of a production system, and running analytics over both.
It unifies warehouse and lake in one platform, removing the silos that separate data engineering, analytics and machine learning. My work sat on the archiving, governance and administration side of that platform.
Centralised metadata, optimised storage and distributed computing maintain data integrity. Everything is organised into applications: self-contained repositories holding their own metadata, searches, storage policy, permissions and compliance rules.
- 01
Retention as a product primitive
One common approach to management, security and governance runs across everything. Retention, hold and disposition apply at application, table, record and job level, so compliance state is legible on almost every screen.
- 02
Cost and infrastructure choice
The platform reduces operational cost and business risk while keeping infrastructure choice open. Storage tier is selected per application and changeable per table, so cost is a user-facing decision rather than an invoice.
- 03
Provable integrity
Chain-of-custody and source-to-target validation reports let customers prove data integrity to a regulator. Audit tracking captures user actions across a four-level hierarchy.
Five roles, one product
and a very wide gap between them
An irreversible, compliance-governed, asynchronous platform, shared by five roles with radically different expertise, absorbing new capability release after release.
The same product serves a developer authoring SQL-backed search definitions with custom XSLT output, and a support agent who needs one customer record and has never opened it before.
- 01
Administrator: high
System setup, users, groups, permissions, storage, licensing and jobs.
- 02
Developer: highest
Configures applications and metadata, and authors the search screens everyone else consumes.
- 03
Retention Manager: domain-deep
Owns retention, hold and disposition policy. Approves disposal lists.
- 04
Auditor: read-oriented
Reviews system activity for organisational audit and legal purposes.
- 05
End User: low
Runs pre-built searches to retrieve records. Often business, legal or support staff.
What I owned
UX strategy, architecture and product experience, end to end
- 01
Requirement gathering
Worked with Project Managers, Business Analysts, Product Owners and stakeholders to understand the goal behind each module and what users were actually trying to finish.
- 02
Requirement translation
Took feature-list requirements from product owners back to the task and the role behind them, and checked each against the archiving, live-copy and analytics use cases the platform has to serve.
- 03
Information architecture
Separated global destinations from application-scoped modules, and defined when a task belongs on a page, in a side panel, or in a dialog.
- 04
Wireframes and UI
I owned the wireframes and final designs for archival, ingestion, rehydration, search, approvals, alerts and administration, and signed off each design before build.
- 05
Design system
Built one library so dashboards, workflows and governance modules stopped inventing their own patterns, and so light and dark stayed in step.
- 06
Handoff and QA
Reviewed builds against approved designs with engineering, wrote the developer spec, and raised what design walkthroughs surfaced as requirements.
- 07
Leadership
Led a small UX team of one to two designers: direction, prioritisation, assigning work, reviews and critiques, mentoring, and performance discussions. Established the design-review process the team worked to.
Closest to the client
what informed the design, and how it was checked
Research ran through the teams closest to our clients: implementation and client-facing colleagues who work with customers every day and know what they expect and where they get stuck.
Research inputs
- Implementation-team expectations and recurring pain points
- Client feedback relayed through the implementation team
- Client expectations and implementation challenges
- Business requirements and stakeholder objectives
- Competitive analysis and product research
Design validation
- UX and design reviews inside the team
- Stakeholder walkthroughs and demonstrations
- Technical and engineering feasibility discussions
- QA and design review before release
- Implementation review against approved designs
- 01
What we heard
A client needed some user groups to view search results without being able to export them. Export could only be restricted by column.
- 02
What I identified
Run, background run and export shared one split button. Once export had its own permission, one control could not show what each user may do.
- 03
Design response
Split the control in two: a Run menu for search and background search, and a separate Export menu that is enabled or disabled by permission.
- 04
UX value
Shipped: Run and Export are separate menus, each following its own permission. Engineering extended the permission model to support it.
Source: client request raised by the client-facing team.
One path, every feature
from requirement to shipped screen, with a design gate before build
Every feature followed the same route. Requirements were reviewed with the people who would build and test them, the flow was settled in wireframes, and nothing went into development until the final design was signed off.
- 01
Stakeholder reviews
Cross-functional requirement reviews with product, architecture, engineering and QA. I validated the direction and turned agreed outcomes into design.
- 02
Wireframes first
I built each flow in low fidelity to settle structure, states and edge cases before any visual design.
- 03
Final design
I produced the high-fidelity screens for every state a flow could reach, from empty and loading to conflict and failure.
- 04
A written gate
Each requirement document named me to verify and confirm the final design before UI implementation began.
The gate is written into the requirements, so design review was a step in delivery, not a courtesy after it.
Six patterns
what the research and the product kept pointing at
- 01
One hierarchy, one expression
Application, schema, table, column are expressed the same way everywhere, so the level you are acting on is never in doubt.
- 02
Configuration and consumption are separated
Search has an author surface and an audience surface. They are different interfaces with different densities.
- 03
Commitment is progressive
Creation is a four-step wizard in which only the first step is mandatory. Later steps are deferrable.
- 04
Consequences are stated, not implied
Destructive operations name what will be destroyed, and what survives in the audit trail.
- 05
Asynchronous work shares one spine
Migration, disposal, exports, reports and restore all schedule, report and deliver through background jobs.
- 06
Patterns precede screens
Review states in one module mirror another. Scheduling reuses the same shell wherever it appears.
One-way doors
and how the product holds them shut
Safety here is structural rather than dialog-based. Permanent disposal separates the user who generates the list from the Retention Manager who approves it. User deletion enumerates what it destroys and is blocked until ownership of cross-app searches is transferred. Protected-storage configuration locks once a table holds records.
Approval is separated from generation, and assigned to a specific role. The constraint is enforced by the workflow, not by a warning.
- 01
Metadata columns: stated at the point of decision
Columns can be added to a table’s metadata but never removed. The constraint is surfaced where the column is added, not discovered afterwards.
- 02
Protected storage: closed by sequence
Protected-storage configuration can no longer be added or removed once a table holds ingested records. The door closes before it can be regretted.
- 03
Application deletion: blocked before confirm
Blocked up front while the application holds data, with the reason shown, instead of confirming and then failing. This needed a new data flag from engineering.
- 04
Session rollback: a way back
The exit that does exist. A rollback removes everything ingested in a session, for duplicate, invalid or test data.
Disposition, gated by role separation: Qualify (retention expired and no active hold) → Generate list (status: under review) → Approve (human gate, Retention Manager only) → Dispose (data permanently destroyed).
Stating the consequence
before the action, not after it
Deleting a user is irreversible and reaches further than the account. The dialog carries the whole consequence before the destructive control becomes available.
- 01
Irreversibility is stated twice
The title says it cannot be undone, and the acknowledgement repeats it at the point of commitment.
- 02
Destroyed and retained are separated
A red block lists what is permanently deleted. Neutral lines below state what survives in metadata, logs and audit trails.
- 03
What is deleted is named
Scheduled background jobs owned by the user, and their output, are named as permanently deleted, so the loss is known rather than discovered.
- 04
Search ownership must move first
Cross-app searches owned by the user must be transferred to another user. My early wireframe allowed skipping this; the final design makes it mandatory.
- 05
The destructive control stays disabled
Delete user is unavailable until the transfer is resolved and the acknowledgement is ticked.
The dialog states what is destroyed, what survives, and what must happen first, before the destructive control becomes available.
A safe path into production
moving archived data back into live systems without surprises
Rehydration writes archived data back into operational databases. A partial or misdirected write into production is hard to reverse, so the flow is built to catch problems before anything runs.
- 01
Staging before production
Data lands in staging first. Pushing it to production is a separate step that needs approval.
- 02
Validate before scheduling
A field-by-field check shows whether each source field exists in the target. Missing metadata is flagged, with an action to create it.
- 03
Dependencies are offered
When related tables exist, the user is asked to include them. Leaving them out needs an explicit acknowledgement that records may be orphaned.
- 04
Approval states the impact
Before a production push, the approver reviews an impact summary and confirms it. A rejection requires remarks.
Shipped. One flow, reachable from status monitoring, metadata and ad-hoc search. Scheduling takes a start time only, because an end window was not technically feasible.
Approval without guesswork
multi-stage review before sensitive data is used
Some searches and data operations need sign-off before they run. Approvers can be individuals or groups, across several stages, and everyone involved needs to know where a request stands.
- 01
People and groups
A stage builder mixes users and groups, with a running count of who is included in each stage.
- 02
Two inboxes, not one
Requests received and requests raised are separated, so approvers and requesters each see their own queue.
- 03
Whose turn it is
The review screen shows the stage path, marks the current stage as your turn, and keeps the full history in view.
- 04
Decisions can move back
Besides approve and reject, a request can be sent back to an earlier stage when it needs another look.
Shipped. Terminology, group membership and simultaneous approvals were worked through in cross-functional reviews.
One feature, two audiences
and no compromise between them
Searches are authored by developer-role users and activated for everyone else. A draft or inactive search stays visible to its author and invisible to end users. One feature, two audiences, two densities.
Author: configuration
- Two-step wizard: identity and access, then definition
- Input parameters, result columns, retrieval logic, permissions
- Table template for many results, section template for one
- Custom HTML, JS, CSS or XSLT presentation overrides
- XSL-FO output for generated PDF reports
- Conditional links into other searches, across applications
Audience: consumption
- A listing viewable as grid, list or tree
- Searches identified by author-chosen icons and tags
- An empty state that suggests how to start
- Results exported to CSV, PDF or Excel
- Ad hoc zero-configuration lookup for discovery
- Permission-scoped, with clear messaging on restricted links
- 01
Basic
Query auto-generated from selections.
- 02
Advanced
Hand-written SQL.
- 03
Report
Report-oriented, formatted output.
- 04
Group
A virtual folder, no query.
The compromise a single screen would have forced: enough configuration to confuse the reader, not enough to serve the author.
Three layouts, one shipped
and the reason the duller option won
Search results are where an end user spends their time. I explored three ways to present them before settling on one.
- 01
Cards: explored
Each result as a card with its own labels and padding. Reads well with a handful of results. At two hundred rows the padding and repeated field labels turn scanning into browsing.
- 02
Dense grid: explored
A tighter grid, less padding, more results per screen. Better density than cards, but still repeats every label per item and gives nowhere to put an action that applies to a selection.
- 03
Data table with row selection: shipped
Columns, header labels stated once, checkbox per row. Labels appear once in the header. Values align in columns so a user scans down rather than reading across. Row selection gives export and restore somewhere to live.
Designing inside a hard limit
running a search from an uploaded file
Users needed to run a search against a list of values from a CSV file. The query engine has a fixed size limit that cannot be changed, so bad or oversized input had to be caught before execution.
- 01
The existing field model
File upload joined the existing field types, and validation used the existing message feature rather than a separate one.
- 02
Every state is visible
Uploading, validating, validated and failed each have their own state, shown on the field itself.
- 03
Conflicts are a choice
When uploaded columns match existing ones, the user chooses to add new fields only or replace the existing ones.
- 04
Structure before execution
Payload fields map to CSV columns, so a missing mandatory column stops the search before it runs.
Shipped. File upload was added to the existing field model rather than built as a separate feature.
Two structures, two levels
the architecture decisions everything else hangs from
An application is one unit of ownership and access: data, metadata, searches, permissions, storage and compliance. Navigation follows the same line, with global destinations always on the rail and application modules only inside one.
The data hierarchy is reused across metadata, catalog scoring, permissions and reporting: application, schema, table, column, record. Actions are offered at several of these levels at once. Entering a task from a deeper level pre-fills and locks the levels above it, so context is inherited rather than re-declared.
- 01
Application workspace: level 2, the rail swaps on entry
Searches · Metadata · Compliance · App config · Activity tracker. Audience: developers, end users, retention managers.
- 02
System management: level 1, always on the rail
Settings · Permissions · Groups · Users · Storage · Jobs · Licensing. Audience: administrators.
- 03
Governance: level 1, cuts across every application
Dashboard · Catalog · Classification · Lineage · Encryption · Protected storage · Audit. Audience: retention managers, auditors, admins.
Entering an application swaps the rail, and a back link returns to all applications. The breadcrumb always states the level, and system and governance work never hide inside an application.
Making the wait legible
long-running work, scheduled, watched and proven
Ingestion runs as a background job across many tables at once. Some succeed, some fail, some are still queued. The screen has to answer where it is, what failed, and what to do next, without the user leaving to find out.
- 01
Progress before detail
A completion figure and a segmented bar carry succeeded, failed, in-progress and pending counts, so the state of every table in the session reads at a glance.
- 02
Failure is visible, not buried
Table-level status sits in a persistent list, so a failed table is findable without opening every row.
- 03
Drill-down keeps the session in view
Selecting a table opens set-level detail, files, records, elapsed time and status timeline, inside the session.
- 04
Evidence is reachable from here
File lists, counts and validation reporting hang off the same screen, so proving the load and running it are one journey.
Restore reuses the same spine (basic details, staging database, production database, schedule), configured in stages, verified before scheduling, then handed to job monitoring.
One concept, every surface
making tokenised data recognisable wherever it appears
Sensitive fields can be replaced with tokens and the originals held in isolated storage. That one concept touched metadata, search results, query tools, compliance views, dashboards and administration.
- 01
One marker, everywhere
A single icon identifies tokenised fields in every table, result and lookup.
- 02
Requesting the original
Where tokenised data appears, a fixed column provides the route to request the original values.
- 03
Types, explained
Each tokenisation type is explained with what it does, when to use it, and an example.
- 04
Access is guarded
Security keys have their own flow, with attempts remaining, a lockout, and a stated purpose of use.
Shipped. Tokenisation cannot be changed once data is ingested, and the setup screen says so at the point of configuration.
One vocabulary, agreed late
built to pull a grown platform into one modern language
The platform grew module by module, with spacing, control heights and states settled per screen. The design system brought them into one modern language, across light and dark.
Twenty-seven pages in total: colour, typography, spacing, elevation, every control, and the full data table with header, row, empty, loading and filter states. Token names are what engineering references, never the hex.
- 01
Wizard with early exit
Application creation · Search creation · Job creation · Restore
- 02
Job scheduling shell
Migration · Disposal generation · Exports · Reports · Data deletion
- 03
One picker for people
Approvers · Alert recipients · Grant access
- 04
Level-scoped action
Ingestion · Data export · Validation reports · Retention
- 05
Hierarchical drill-down
Metadata · Catalog scoring · Permissions · Governance
- 06
Review-state bulk workflow
Protected-storage recommendations · Disposal lists
- 07
Exploration becomes a search
Query console · Ad-hoc search
- 08
Empty states that teach
Search listing suggests how to begin when nothing exists
Leading the work
direction, a review practice, and one decision I reversed
A small UX team, one to two designers: direction, prioritisation, assigning work, reviews and critiques, mentoring, stakeholder alignment, overall UX quality and performance discussions. Designers owned feature-level execution.
I established a review gate before high fidelity: ideation and rough design, UX review, feedback and refinement, then high-fidelity mockup. UX issues surfaced before high-fidelity work started, rework dropped because direction was agreed first, and established patterns got reused rather than reinvented.
- 01
Initial hypothesis
Configure the restore in a side panel, triggered from the job card, so the user stays in context.
- 02
Technical discussion
I worked the direction through with the technical team.
- 03
Constraint identified
The query filter area could become lengthy, and table names and references could need significant space.
- 04
UX reassessment
That volume would not fit comfortably in a side panel; constrained space would affect readability and usability.
- 05
Final decision
Changed direction to a dedicated page, which scales with the information the workflow carries.
An explored direction reconsidered on evidence, not a failed one. It changed in design rather than in build.
Designing inside real constraints
and making sure the build matched the design
Several constraints could not be designed away, only designed around. In each case the honest job is to make the limitation legible at the point of decision rather than hide it until something fails.
Accessibility was specified in the design rather than left to build: contrast across both themes, focus order, keyboard operability and accessible names for icon-only controls.
Constraints I designed around
- Schema that is additive only, stated at the point of decision, not discovered afterwards
- Configuration that locks once data exists, held by sequence, not by a warning
- Capability that covers part of the estate, scope stated up front, not at run time
- Policy owned outside the interface, the UI reports a state it cannot change
- Capability shipping ahead of its surface, labelled as such rather than dressed up
- Destructive actions with no approval workflow, consequence enumerated before commitment
How the work reached production
- Developer spec: wrote the handoff spec covering layout, tokens, states and behaviour, so engineering was not interpreting a static frame
- Implementation review: reviewed built UI against approved designs and requirements, logged UX and UI inconsistencies, and drove them to closure with engineering
- Cross-functional working: facilitated UX reviews, stakeholder demos, design walkthroughs and solutioning sessions with PMs, BAs, POs, engineering and QA
- Guided UX designers through direction, feedback and reviews
Behaviour specified in the wireframe rather than left to the build: which items can be deleted, which are system-defined and edit-only, and what each state looks like. Each pin states a behaviour, not a measurement.
Data quality, made visible
a score users can act on, and a search that keeps the hierarchy
The data catalog scores how well each application, schema, table and column is described. The score had to be readable at every level, and search had to keep that hierarchy reachable.
- 01
A score at every level
Scores roll up from column to application, and appear across catalog views and the application dashboard.
- 02
A grade and a next step
Each score carries a grade and a recommendation, such as adding tags or descriptions, so users know how to raise it.
- 03
The search gap
QA found that search showed a matching application or schema, but hid everything inside it.
- 04
What I did
I wrote the behaviour as user stories: matches expand to their children, matching children first. Requirements were amended and the fix verified.
The fix was not a feature. It was defining what search returns at every level, and what stays reachable.
What changed
stated plainly
Experience outcomes
- Consistent UX patterns across a large and evolving product surface
- Clearer separation between technical configuration and end-user consumption
- Non-technical users could retrieve archived records without a developer running the search for them
- High-risk and irreversible operations became understandable before commitment
Team and process outcomes
- UX issues identified earlier through the review gate before high-fidelity work
- Less rework, because direction was agreed before execution
- Fewer fragmented design decisions, because reusable patterns existed to reach for
- Designers worked to a shared process rather than to individual judgement
- 01
Clearer implementation guidance for engineering through the developer spec
- 02
Improved implementation fidelity through design QA against approved designs
- 03
New capability composed from established patterns rather than designed from scratch
- 04
Light and dark held as modes on one component set, not two sets of screens
Shipped from these designs: approval workflow · data rehydration · protected storage and tokenisation · bulk CSV search · application dashboard. These describe how the product works, not a projection. Quantified results were not captured on this product, so none are claimed here.
What I would do differently
one call I would sequence differently, given the same constraints
The modern UI guidelines came after some modules had already shipped on the earlier design system.
That was not an oversight. Engineering was building in parallel to meet client commitments, and design was keeping pace with delivery rather than getting ahead of it.
- 01
Composite patterns: genuinely had to wait
A wizard shell, a job scheduling pattern, a review-state workflow. You cannot systematise something that has not repeated yet. These needed the product to mature first, and settling them early would have been guesswork.
- 02
Primitives: did not
Spacing, control heights, states, colour roles. None of these needed the product to mature. They could have been modernised in an early release at almost no cost to the timeline.
What I took from it
and what I would carry into the next one
- 01
A feature list is not a requirement
Every item had to be taken back to the task and the role behind it before it could be designed. That translation was the work, not a step before the work.
- 02
Serving opposite expertise levels means designing two products
Search has an author surface and an audience surface, at very different densities. Averaging them into one interface would have failed both.
- 03
One module has to serve every use case
Archiving, live production copies and analytics share the same metadata, search and compliance surfaces. Designing a module for only one of them breaks the other two.
- 04
Structure before styling
Deciding which level a task belongs to, and whether it belongs on a page, a panel or a dialog, settled most of the design before anything was drawn.
- 05
Retrofitting a system is mostly negotiation
Drawing the components was the easy part. Bringing modules that had each settled their own spacing, control heights and states into one language meant agreeing rules across the whole product.