Engineering discipline you can audit, not just admire
A 228-page engineering logics specification governs how HFL software is designed, built, tested and released. Patterns, architectures, testing strategy, database approval gates, sprint structure and DevSecOps SOPs are all explicit — and all reviewable.
228
Pages of spec
5
Core patterns
4
Testing tiers
Design patterns and object-oriented fundamentals
Patterns are selected for a reason and documented with that reason. Object-oriented principles — cohesion, encapsulation, substitution and dependency direction — are the baseline expectation.
Pattern 01
MVC
Model-view-controller separation for tenant-facing portals and administrative consoles.
Pattern 02
Singleton
Controlled single-instance services for configuration registries and shared platform clients.
Pattern 03
Facade
Simplified contracts in front of complex integrations such as ERP, CRM and SCADA adapters.
Pattern 04
Observer
Event notification for telemetry, alerting and analytics pipelines reacting to domain changes.
Pattern 05
Command
Encapsulated operations that support queuing, retry and audit — essential for approval workflows.
Fundamentals
OOP principles
Inheritance, polymorphism, abstraction and encapsulation applied with documented intent.
Architectural styles we hold ourselves to
The choice of architecture is a documented decision with trade-offs recorded, not an accident of the first sprint.
N-tier / layered
Presentation, application, domain and data tiers with explicit boundaries.
Client–server
Thin clients over governed services, with contract versioning.
SOA
Reusable business services shared across LMS, EMS, CRM and governance modules.
Event-driven
Asynchronous flows for telemetry, notifications and analytics ingestion.
Layered data architecture
- 01Data ingestion — batch, streaming and edge telemetry intake
- 02Storage — operational, analytical and archive tiers
- 03Processing engines — transformation, validation and enrichment
- 04Analytics — reporting, prediction and decision surfaces
As a Technical Administrator
I want bulk enrolment via CSV import
so that I can onboard a partner cohort
without raising a support ticket.
Acceptance criteria
- Given a valid CSV with required headers
- When the file is uploaded to the DEM portal
- Then valid rows are enrolled and invalid rows
are returned with row-level error reasons
- And the upload is written to the audit log
Definition of done
- Unit, integration and system tests pass
- Database change approved by the data governor
- Security review signed off by the SOC
- Release note published to the change registerTesting strategy and quality gates
Four testing tiers, one philosophy: prove behaviour at the lowest level that can prove it, then prove the system as a whole.
Unit testing
Isolated logic and edge cases, run on every commit in the pipeline.
Integration testing
Service contracts, data boundaries and third-party adapters.
System testing
End-to-end tenant journeys, performance and failover behaviour.
TDD
Test-first development for critical logic, with the test as the specification.
CI/CD pipelines
Automated build, test, security scan and gated deployment to each environment.
UML modelling
Use-case, class, sequence and deployment models maintained alongside the code.
Database structure approval
Schema changes pass a governed approval gate before migration execution.
DevSecOps SOPs
Written procedures, not tribal knowledge. Each SOP names its trigger, its owner and the artefact it must produce.
How security reviews run todayEvery request starts with problem validation: the user problem, the affected personas, the measurable impact and the consequence of doing nothing. Requests that fail validation are documented and closed rather than carried.
Automate it or ticket it — deliberately
A task automation matrix decides, per capability, whether a request is handled by an API operation or by a support ticket through the MyIS portal. The decision is published so administrators know what to expect.
| Capability | Handling |
|---|---|
| Catalogue access provisioning | API creation / update |
| Enrolments | API + bulk CSV import |
| Custom fields | Support ticket (schema change) |
| Discounts and entitlements | API with approval workflow |
| User attributes | API / HFL Data Author for Excel |
| Banner and compliance settings | Admin job aid, self-service |
| Survey and assessment design | Admin job aid, self-service |
Course request template
Metadata, delivery method, target audience, prerequisites and post-webinar archiving rules captured at request time.
Admin job aids
Access controls, class-code formatting, compliance settings, banner management and embedded catalogue sharing.
Observability contract
Every service ships with health endpoints, structured logs and alert thresholds agreed before go-live.
Adopt the HFL engineering standard
Patterns, testing tiers, sprint structure and SOPs can be licensed into your delivery organisation alongside the platform.
