Context
At TPIsoftware I worked on enterprise web products used by banks and insurers. One internal CMS deployment served a finance client's policy team. They emailed Word files with track changes; published PDFs on a staff portal were often one version behind.
Compliance needed an audit trail. Operations needed something faster than email chains.
What I built
Workflow states on policy documents:
- Draft - author edits rich text + attachments
- Compliance review - reviewer comments inline; cannot publish
- Approved - publish triggers staff portal update + PDF snapshot
- Archived - superseded versions kept read-only
Version diff summary (title, effective date, attachment hash)-not a full legal redline tool, but enough for audit questions.
Technical approach
Integrated with existing CMS auth roles-no parallel user table. Database migrations reviewed with their DBA. Feature flags so compliance could pilot on one product line before company-wide rollout.
Office-based iteration with product owner and QA in Taipei; specs changed twice mid-sprint and we adjusted without throwing away the workflow model.
Outcomes
- Policy publish cycle shortened from ~2 weeks of email to same-day after approval
- Audit could answer "who published what when" from admin log
- Learned how enterprise "small changes" touch compliance, legal copy, and three approvers
Stack
Enterprise Java/web stack · CMS platform · SQL Server · Internal SSO