When people can't check out:
Redesigning Accountability in a Secure Military Environment

Role: UX Designer

Context: Government / Defence (NDA‑safe)

TL;DR

In secure military environments, escort officers are held accountable for visitor compliance — but the system gave them no way to act on it. When visitors forgot to check out (and they always did), the existing safeguard was a midnight auto-checkout at 2359H. It didn't solve the problem. Visitors doing legitimate late-shift or overnight work got automatically checked out mid-task, generating false audit records. The fix was corrupting the data it was meant to protect.

The root issue wasn't UX friction. It was a broken accountability model: the system was designed around visitors, but the consequences of failure fell on someone else entirely.

I argued for removing the auto-checkout entirely and reframing the system around shared responsibility — giving escort officers real-time visibility and direct check-out authority. Stakeholders raised a fair concern: if visitors forget, what stops escort officers from forgetting too? The answer wasn't more automation. It was giving the right people the right tools, and making accountability explicit. Check-in/out completion rate increased by 36% — sessions that had previously gone unresolved were now being completed accurately. The midnight auto-checkout and the logbooks stayed in the drawer.

Problem

Accountability Without Visibility - and a safeguard making things worse

Escort officers are responsible for security and audit compliance at each site. Yet the existing system relied almost entirely on visitors remembering to check out — a dependency that consistently failed in practice.

Environmental Constraints & Accuracy Trade-offs

Security Zones & Device Constraints

Operational environments were segmented into Safe, Caution, and Critical zones, each with different device and security constraints:

• Safe zones
  Visitors and escort officers can carry camera-enabled phones.
  Impact: Full digital flow possible for all parties

• Caution zones
  Escort officers may carry camera-enabled phones, while visitors must store theirs in lockers and use non-camera devices.
  Impact: Visitor self-service degraded; escort-assisted flows essential

• Critical zones
  No phones are permitted for either visitors or escort officers.
  Impact: All digital check-in must occur at entrance before proceeding

In critical zones, both parties store devices at entrance and proceed on foot to the worksite — creating a consistent ~5 to 10 minutes gap between digital check-in and physical arrival, depending on location. This was flagged early, reviewed with POs and compliance stakeholders, and formally accepted: the gap was predictable, did not affect audit integrity, and eliminating it would introduce greater operational friction than the discrepancy itself.

Solution Strategy

From visitor-dependent to shared accountability

Rather than patching the existing model with more reminders or rules, I reframed the system around who actually holds responsibility in the physical world. The midnight auto-checkout was removed. In its place: escort officers gained real-time visibility and direct check-out authority.

Stakeholders raised a legitimate concern: without the auto-checkout safety net, what would prevent escort officers from forgetting too? The response was that this framed the wrong problem. Escort officers weren't passive bystanders prone to forgetting — they were already physically managing site access and visitor presence. The gap wasn't attention or motivation. It was tools. Giving them system visibility to match their real-world authority made the auto-checkout redundant, not just inconvenient.

Usability Testing with escort officers

Outcomes

Operational Efficiency
Check-in/out completion rate increased by 36% post-launch — sessions that had previously gone unresolved (abandoned, forgotten, or auto-checked out incorrectly at midnight) were now being completed accurately by escort officers. Previously-unresolvable states — abandoned sessions, missed check-outs, connectivity failures — were resolved without reverting to paper logs.

Audit integrity preserved under constraint
The system moved from reactive log review to live accountability. Escort officers could see exactly who was on-site, where, and in what check-in state, in real time. The formally accepted 10-minute discrepancy in critical zones raised no compliance issues post-launch. The auto-checkout — which had been generating false records — was removed without replacement.

A model change, not a feature change
The most significant outcome wasn't a metric. Escort officers — previously accountable for outcomes they couldn't influence — became active system operators with genuine authority. This was validated in testing: the assisted check-out model was accepted without friction around the authority transfer.

Design decisions that held post-launch
The timestamp edit restriction, which I pushed back on during design, was not revisited after launch. The auto-checkout removal, which met stakeholder concern during design, produced no unclosed-session audit issues in production. Both calls held.

Reflection

What I'd do differently:

The reframe from visitor-UX to accountability-model was the right call — but it came later than it should have. I began research within the existing brief frame rather than challenging it first. A single stakeholder conversation in week one, focused on who actually bears the consequence of system failure, would have sharpened the research questions significantly and potentially surfaced the auto-checkout issue earlier in the process.

I'd also push harder for a post-launch review with access to real audit log data. The 36% completion rate figure came from usability testing, not production. Understanding whether the escort-assisted model held under real operational load — shift handovers, high-visitor days, concurrent incidents — would tell me something the test environment couldn't replicate.

Takeaway

Designing for secure environments means accepting that people, devices, and connectivity will fail — and building systems that don't depend on any of them to behave ideally. Sometimes that means removing the safeguard that was making things worse.