← Work

Case study

Career Plan

What it is

A longitudinal student career record platform for a university career center.

Who it serves

Students and the staff who work with them, through staff workflows and a senior check‑in path.

Status

In development under institutional security review. Built and tested on synthetic data only.

Role

Architect, Product Manager and Sole Builder. The one‑person technical team.

The shape of itA FERPA record system built by a team of one, where the security model lives in the database and the delivery plan is paced by security sign‑off rather than by the build.

Four weeks

From proposal to a working application in four weeks, with staff workflows, a senior check‑in path and SAML login, all on synthetic data.

The prototype

The visual reference the real application follows. Click into it.

A white‑label version of the Career Plan prototype on synthetic data. The production build is in development under institutional security review.

Explore the prototype ↗

Problem

A career record that follows a student over time is a FERPA record, classified PL‑3. Suffolk had no supported departmental database platform to hold it, so the platform had to earn approval before it could hold anything real.

What it does

One longitudinal record per student that the student and the staff who work with them build on together, with staff workflows, a senior check‑in path and institutional login through SAML.

Architecture

01 / Security in the database

Row‑level security is forced on every student table. Access logging and small‑count suppression are enforced in the database, not in the interface.

02 / Sign‑off before data

Delivery is phased so no real student data enters the system before security sign‑off. ITS has approved the technology stack, and the work runs directly with the Deputy CIO and CISO.

03 / No AI inside the product

The product carries no AI features until IT approves a vendor. AI is a development tool here, not a runtime dependency.

04 / Every change by hand

Built with Claude Code one prompt at a time. Every change is reviewed, tested and committed by hand, and CI runs lint, build, migration and row‑level security tests.

Stack

Next.js, TypeScript, Tailwind, PostgreSQL, GitHub Codespaces, GitHub Actions and SAML.