A contractor pulls up at the gate at 6:40am with a coffee in one hand and a phone in the other. The crew behind them wants to get moving. Whatever they are about to do to sign in, they are going to do it forty times a week, in the cold, often with no signal to spare. If signing in takes longer than unlocking the phone, the design has already failed — and the first thing people do with a failed design is route around it. They prop the gate. They sign in for each other. They write the wrong time on the sheet.
So when we set out to build check-in for contractor management, the brief I gave myself was narrow. The compliance work is real and it is heavy, but the worker should never feel its weight at the gate. The gate should feel like a tap.
Compliance friction is a design failure, not a feature
There is a tempting logic in safety software that says: more questions equal more diligence. If one field is good, six are safer. It is the same logic that produces the clipboard with thirty signature boxes that nobody reads. It feels rigorous and it produces nothing, because the people filling it in have learned that the form is theatre.
I treat every field at check-in as a cost the worker pays, in seconds and in attention, and I make the system earn it. Most of what we need to know at sign-in, we already know. Whether this person’s licences and certifications are current, whether their company’s insurances are live, whether their induction is complete — none of that should be a question asked at the gate. It is data the platform already holds and evaluates the instant the worker taps to sign in. The worker does not fill in their white card number at 6:40am. We checked it overnight.
That is the principle: the gate reads, it does not interrogate. The six-check right-to-work gate returns PASS, BLOCK, or WARN with an explainable reason, and from the worker’s side it is one action. The compliance happened before they arrived.
The one thing the worker does have to prove is where they are
Of the six checks, five are answered from records. The sixth is the geofence — physically on site — and that is the one the worker genuinely supplies at the moment of check-in, by being there. We attach a configurable perimeter to each site, with a radius the site admin sets, and check-in is only accepted from inside it.
This matters more than it looks. A document store can tell you a worker is qualified. It cannot tell you they are here. Tying the right-to-work decision to a real location is what turns a folder of certificates into a live record of who is on the ground right now — which is exactly what you need when an evacuation order goes out and you want to know who to broadcast to.
The asymmetry: blocked off-site, open everywhere to leave
Here is the design choice I am most attached to, because it is the one that gets argued about.
Check-in is geofenced. If you are outside the perimeter, you cannot sign in. That is deliberate — it stops the most common abuse, which is someone marking themselves on site from the car park, the cafe, or home.
Check-out is allowed from anywhere. No geofence on the way out. None.
The symmetry is tempting and it is wrong. Picture the failure it would cause: a worker signs in fine in the morning, works a ten-hour day, and at knock-off their phone is dead, or there is no signal at the back of the site, or they have already walked out to the street to get picked up. If check-out were geofenced, that worker is now stuck “on site” in our records — a phantom presence that corrupts the headcount and, in the worst case, sends emergency responders looking for someone who left hours ago. A dead phone at the gate must never trap someone on site, in the data or in real life.
So the asymmetry is a safety decision dressed as a UX decision. We make it hard to fake your arrival and trivially easy to record your departure, because the cost of a false “present” is far higher than the cost of a generous “left”. You can always check out. You can only check in from where the work is.
Three ways in, because one channel never fits a real site
Sites are not uniform and neither are the people on them. Some workers will use their own phone. Some sites hand out a tablet. Some want a fixed point at the entrance. So check-in runs across three channels, and they all feed the same record:
- Personal device. The worker signs in from their own phone — the lowest-friction path, and the one most workers default to once they have done it once.
- QR code. A printed code at the gate or on the noticeboard. Scan, and you are at the check-in for that exact site. Good for visitors and for anyone who has not installed anything.
- iPad kiosk. A tablet mounted at the entrance, run by the site. For places where you want a single, supervised point of entry, or where personal phones are not practical on the tools.
The channel is just the doorway. Behind all three is the same gate, the same geofence, the same record.
The few fields that do earn their place
I said the gate reads rather than interrogates, and that is true for compliance status. But there is a small, deliberate set of things we do ask at sign-in, because they can only be known on the day, and because they change what the site needs to do about you.
Each site configures its own fields. The classic one is a trigger question — doing hot work today? — because the answer is not in any certificate; it depends on today’s job. We also capture the work-order number and a short description of the work, so the on-site record says not just who is here but what they are here to do.
These are not friction for friction’s sake. A trigger answer of “yes” to hot work can auto-flag a work permit and route it to an admin for approval before the work starts. That is the system using one tap of input to do something genuinely protective, rather than collecting a field because a form felt too short without it. If a question does not change an outcome, it does not belong at the gate.
What “good” looks like here
The whole module is built on a non-delegable duty of care: under Australia’s model WHS laws, a PCBU cannot contract away responsibility for the contractors on its site. That duty is the reason the gate exists. But duty does not have to feel like bureaucracy at the point of contact. The organisation carries the obligation; the platform carries the weight; the worker, standing at the gate at 6:40am, gets a tap.
That is the line I hold every time we add something to this screen. If a worker checks in without thinking about it, and an admin can still prove exactly who was on site and why, the design is doing its job — quietly, on both sides. You can read more about how the check at the gate is composed in the six-check right-to-work gate, and about the contractor module as a whole on the contractors page.