MR logo MATT RATCLIFFE_
blog

All articles

Architecture, AI, healthcare systems and product strategy.

2026-09-24 Matt Ratcliffe 5 min read

A Timestamp Is Not Proof Something Changed

Systems that infer change from a timestamp instead of the content itself will eventually do expensive, silent work based on a signal that was never actually telling the truth.
software-engineeringci-cdreliabilityarchitecture
2026-09-23 Matt Ratcliffe 5 min read

A Wrong Comment Is Still A Bug

When code review finds a comment that misdescribes correct code, fix the explanation and prove the real invariant with a test, because the next person will trust the comment over the logic.
code-reviewtestingdocumentationtrust
2026-09-22 Matt Ratcliffe 4 min read

AI Readiness Starts With Data Readiness

Every ambitious NHS AI plan is really a data integration problem wearing an AI costume, and the organisations that admit that first will be the ones AI actually helps.
healthcareaidataarchitecture
2026-09-22 Matt Ratcliffe 5 min read

Move One Thing And Watch What Happens

When a system misbehaves intermittently and every metric looks healthy, a single live intervention usually finds the cause faster than another week of monitoring.
debuggingreliabilityoperations
2026-09-21 Matt Ratcliffe 4 min read

The Sequence Of A Code Review Is Part Of The Message

A review that leads with specific, genuine strengths before naming the blocking issue gets fixed faster than one that opens with the objection, because the order decides whether the recipient defends or listens.
code-reviewengineering-leadershipcommunicationtrust
2026-09-20 Matt Ratcliffe 4 min read

The Bottleneck Is Rarely Where You Can See It

Teams keep fixing the layer of a system they can measure and justify, even when the evidence eventually shows the real problem was somewhere else entirely.
observabilityarchitecturereliabilitydecision-making
2026-09-19 Matt Ratcliffe 5 min read

A Deal Is Not A Deliverable

A signed commitment only becomes buildable once someone is accountable for turning it into requirements, and skipping that step is what actually blocks delivery, not the engineering team.
productdecision-makingsoftware-deliveryleadership
2026-09-18 Matt Ratcliffe 5 min read

A Test Needs A State It Owns

A test that starts from whatever data happens to already be there is flaky by design, and the fix is to write the starting state directly rather than driving the UI to build it.
testingreliabilitysoftware-design
2026-09-17 Matthew Ratcliffe 5 min read

Two Things That Broke Together Were Never Separate

When a fix to one feature causes an unrelated-looking feature to regress, treat that as evidence the two share hidden state, not as two separate bugs to patch in turn.
debuggingsoftware-architecturereliabilityengineering-judgement
2026-09-16 Matthew Ratcliffe 5 min read

A Green Pipeline Is A Narrower Claim Than It Looks

A passing check only proves what it actually executed, and two quiet gaps — a step that merely parses code instead of running it, and a job that never fires on the event you're watching — can both hide behind the same green tick.
software-deliverytestingcode-reviewtrust
2026-09-15 Matthew Ratcliffe 5 min read

A Bug Is A Question About Who Pays

Whether a piece of software behaviour counts as a defect depends less on whether it matches the original specification and more on who absorbs the cost when it does not match what the user needed.
software-deliveryproducttestingdecision-making
2026-09-14 Matthew Ratcliffe 4 min read

An AI Idea Needs A Price Tag Before It Needs An Architecture

Almost any AI feature is technically feasible now, so the question that actually decides whether it ships is what it costs to run at real volume, and that question has to be answered before the architecture, not after.
aiproductbusinessarchitecture
2026-09-13 Matthew Ratcliffe 4 min read

Make the Shared Thing Visible Before You Automate It

When two independent processes keep silently colliding over one shared resource, a simple visible way to claim it often beats another layer of clever automation.
software-deliveryoperationsteamworkdecision-making
2026-09-12 Matthew Ratcliffe 6 min read

A Curated List Is A Second Definition Of Your Interface

Whenever a system hand-picks which fields to expose from a richer source, that pick list becomes a second, silent definition of the interface that will drift unless something forces it to stay in sync.
architectureinfrastructurereliabilitysoftware-design
2026-09-11 Matthew Ratcliffe 4 min read

Skip The API When There's No Logic To Share

An API only earns its place when it protects you from duplicating real business logic, not when it's a detour on the way to a single table.
architectureapissoftware-designengineering
2026-09-10 Matthew Ratcliffe 5 min read

A Shortcut With No Expiry Date Becomes The Architecture

A temporary workaround used to unblock development has no natural way to announce that it has quietly become permanent, so someone has to keep asking whether it still deserves to exist.
software-deliveryarchitecturetechnical-debtdecision-making
2026-09-10 Matthew Ratcliffe 7 min read

My View Of AI (September 2026)

AI is not taking your job, but the person who has learned to manage a team of agents well is about to take it instead.
aicareersproductivityleadershipmentorship
2026-09-09 Matthew Ratcliffe 4 min read

The Prototype Was Never The Spec

A prototype or generated screen quietly becomes the requirement unless someone keeps checking it against the actual acceptance criteria.
productsoftware-deliveryairequirementsdecision-making
2026-09-08 Matthew Ratcliffe 4 min read

One Code Path Can't Hold Two Levels Of Trust

When two different kinds of caller share the same trust-inferring code path, the system quietly adopts the weaker caller's trust level for everyone.
securityarchitecturetrustcode-review
2026-09-07 Matthew Ratcliffe 4 min read

Compatible Doesn't Mean Identical

A substitute that satisfies the constraint it was chosen for can still change the thing people actually experience, so the sign-off has to come from whoever will notice that difference, not from whoever fixed the constraint.
productdesigndecision-makingsoftware
2026-09-06 Matthew Ratcliffe 4 min read

The Feature That Worked And Never Said So

A capability that works internally but never announces itself will be reported as broken by everyone outside it, so any code path that can exit quietly needs to say so.
debuggingobservabilitysoftware-designintegrations
2026-09-05 Matthew Ratcliffe 5 min read

A Fix Has To Reach Where It's Broken

A code change can be logically correct and still do nothing at all if it never runs at the moment the real failure happens, so verification has to happen at the boundary where the system is actually used, not on the page where the diff looks right.
debuggingsoftware-architectureapi-designengineering-practice
2026-09-04 Matthew Ratcliffe 5 min read

A Dependency In Prose Is Not A Dependency

An ordering constraint only survives if the system enforces it, because a sentence explaining the right sequence relies on someone reading it at exactly the right moment.
software-deliveryarchitecturereliabilitycode-review
2026-09-04 Matthew Ratcliffe 3 min read

Feedback Needs A Decision

Feedback only accelerates delivery when it is converted into a clear decision someone can test.
deliveryfeedbacktestingproductteamwork
2026-09-03 Matthew Ratcliffe 5 min read

Undecided Is Not The Same As Resolved

When software takes a default action on a judgment call nobody has actually made, the fix is to keep that decision visibly open rather than let the default pass as an answer.
software-designdecision-makingproduct-engineeringtrust
2026-09-02 Matthew Ratcliffe 4 min read

Keeping Something Visible Is Not The Same As Moving It

Naming the one or two things that must actually progress today protects them from the much longer list of things that only need to stay in view.
productivityleadershipfocusprioritisation
2026-09-01 Matthew Ratcliffe 5 min read

A Cancelled Record Still Needs To Say So

When a source system cancels or voids something it already sent downstream, the feed needs to carry that cancellation explicitly, not just quietly stop sending the record or delete it.
integrationsdataarchitecturehealthcaretrust
2026-08-31 Matthew Ratcliffe 4 min read

A Test That Agrees With Itself Isn't A Test

A test that recomputes the same logic it is meant to verify will pass forever, even after the rule it is protecting has silently drifted into two different answers.
testingsoftware-designcode-reviewtrust
2026-08-30 Matthew Ratcliffe 4 min read

The Cost Of The Attack Just Collapsed

AI has not invented new categories of vulnerability, it has removed the time and skill that used to stand between a curious person and a working exploit, so authorisation gaps that once felt theoretical now need to be treated as already found.
securityaiapidata-protection
2026-08-29 Matthew Ratcliffe 4 min read

Ten Out Of Twelve Is A Failure, Not A Result

A data-loading job that completes ten of twelve expected sites is not a partial success, it is an outage wearing a status message that looks fine.
data-integrationreliabilityhealthcareengineering-leadership
2026-08-28 Matthew Ratcliffe 5 min read

Small Releases Aren't Faster, They're Kinder

Shipping in small frequent batches isn't mainly a speed optimisation, it's a way of making sure problems get found by one person on a quiet day instead of by a whole team at once under pressure.
engineering-cultureci-cddeliveryleadership
2026-08-27 Matthew Ratcliffe 4 min read

The Waste You Only Find Under Pressure

The most expensive waste in a software system is rarely the one anyone budgeted for, and it usually stays invisible until scarcity forces someone to go looking.
ci-cdengineering-cultureefficiencyleadership
2026-08-26 Matthew Ratcliffe 4 min read

When A System Only Remembers The Last Change

A system that only shows who last touched a record, not the full history of changes, quietly pushes the cost of that missing history onto whoever has to resolve the next dispute.
dataarchitecturetrustsupportoperations
2026-08-25 Matthew Ratcliffe 4 min read

Someone Has To Own The Decision

A technical trade-off that stalls for days is rarely missing information, it is missing someone whose job it is to actually decide.
engineering-leadershipdecision-makingarchitecturesoftware-delivery
2026-08-24 Matthew Ratcliffe 3 min read

Carried Forward Is Not The Same As Worked

A task or ticket that automatically rolls into tomorrow's list can look like it is being handled when nobody has actually touched it in days.
productivityoperationsleadershiptrust
2026-08-24 Matthew Ratcliffe 4 min read

Emulation Is Not Evidence

An AI that convincingly reproduces a bug in an emulator has not proven the bug is real until someone watches it happen on the actual device.
aidebuggingengineering-judgementreliability
2026-08-21 Matthew Ratcliffe 4 min read

A Surrogate Key Is Not An Identity Rule

A generated primary key tells a database how to find a row, but only an explicit unique constraint tells it what makes two rows the same thing, and that constraint needs deliberate upkeep every time a table changes shape.
databasesdata-integritycode-reviewarchitecture
2026-08-20 Matthew Ratcliffe 4 min read

A Failed Step Is Not A Failed Outcome

Treat "did this step fail" and "did it change the result" as two separate questions, or you will spend your best attention on the wrong alarms.
reliabilityoperationsengineering-judgementtrust
2026-08-19 Matthew Ratcliffe 8 min read

The Cheapest Context Is the One You Never Load

Running AI agents cheaply is less about clever prompting and more about disciplined scope, verification and delegation.
aiengineeringproductivitycost
2026-08-19 Matthew Ratcliffe 4 min read

The Resolve Button Isn't The Agreement

Treat a resolved review thread as a prompt to check for shared understanding, not as proof that agreement already exists.
code-reviewsoftware-deliveryengineering-leadershiptrust
2026-08-18 Matthew Ratcliffe 6 min read

A Migration Is The Cheapest Time To Ask Why

Moving infrastructure is the one moment when questioning why an environment or process exists costs less than leaving it alone.
architectureinfrastructuremigrationdecision-making
2026-08-18 Matthew Ratcliffe 4 min read

A Two-Person Team That Shipped 500 Pull Requests In 14 Days

A two-person team can now sustain a pull request rate that used to need a dozen engineers, if they treat AI coding agents as a fleet to direct rather than a single assistant to chat with.
aiproductivitysoftware-deliverytooling
2026-08-17 Matthew Ratcliffe 4 min read

Delegate The Goal, Not The Steps

The instructions that need the least follow-up are the ones that specify the outcome and trust the person or system doing the work to find the path.
leadershipdelegationaiproductivity
2026-08-17 Matthew Ratcliffe 6 min read

Make Bad Input Impossible, Not Just Unlikely

Shared systems are safer when they reject what they cannot understand than when they quietly assume the most convenient interpretation.
architecturereliabilitysoftware-designtrust
2026-08-17 Matthew Ratcliffe 6 min read

The Agent That Knew What Wasn't Its Call

The most trustworthy thing an autonomous system can do is recognise which decisions belong to a human and hand them back with enough context that nobody has to redo the thinking.
aiautomationengineering leadershiptrust
2026-08-12 Matthew Ratcliffe 3 min read

Design Matching Around Real Work

Reliable matching starts with the information people naturally have, then makes uncertainty and exceptions explicit.
product-designdataworkflow
2026-08-11 Matthew Ratcliffe 2 min read

Compatibility Is Part Of The Migration

A database migration is not complete when the new interface works; it is complete when existing callers and established behaviour still work too.
software-deliverydatabasescompatibility
2026-08-10 Matthew Ratcliffe 3 min read

A Diagnosis Needs A Return Visit

Operational diagnoses become trustworthy when they predict an observable change and return to the evidence after intervention.
operationsreliabilityai
2026-08-03 Matthew Ratcliffe 3 min read

Learning Is Part Of Delivery

New technology earns adoption when teams plan the learning work as deliberately as the technical rollout.
leadershipsoftware-deliverychange-management
2026-08-02 Matthew Ratcliffe 3 min read

Claude Found a Path to God Mode in Five Minutes

AI can now expose privilege-escalation paths in minutes, giving defenders a powerful testing tool and attackers the same advantage.
securityartificial intelligencepenetration testingsoftware delivery
2026-07-31 Matthew Ratcliffe 3 min read

Trust Needs an Action Trail

AI coding assistants earn trust when consequential actions are visible, bounded, reviewable and reversible.
artificial intelligencesoftware deliveryengineering leadership
2026-07-30 Matthew Ratcliffe 3 min read

Make Status A Shared Model

A service status page is most useful when it turns scattered operational signals into shared judgement.
operationsreliabilityobservabilityleadershipdelivery
2026-07-29 Matthew Ratcliffe 3 min read

Automation Has A Signal Budget

Automation only helps a team when it protects attention instead of consuming it.
automationoperationsdeliveryattentionleadership
2026-07-28 Matthew Ratcliffe 5 min read

Managing My Attention

Most productivity systems fail for the same reason - they rely on the person using them to remember to maintain them.
aiagentsto-doplanning
2026-07-27 Matthew Ratcliffe 3 min read

Testing Needs A Shared Map

Testing becomes useful when the whole testable world is visible before the test window begins.
testingdeliveryoperationsqualityteamwork
2026-07-27 Matthew Ratcliffe 7 min read

The Psychology of "Must": When the Language of Engineering Follows Us Home

As engineers, analysts and architects, we rely on the word must to create clarity, remove ambiguity and define success. It's one of the most important words in technical writing. But psychology paints a different picture.
psychologysoftware-engineeringrequirements
2026-07-27 Matthew Ratcliffe 4 min read

What If It Actually Works?

Opportunity-focused thinking creates momentum when it is paired with the discipline to test, prioritise and finish.
optimismentrepreneurshipengineeringcreativitydecision-making
2026-07-26 Matthew Ratcliffe 3 min read

Why I Keep Coming Back to MikroTik

MikroTik earns its place by giving me practical routing power from the rack, to the cloud, to the hotel room.
networkingmikrotikrouterosinfrastructurevpn
2026-07-25 Matthew Ratcliffe 3 min read

What Swimming Pools Teach Us About Better Technology

Swimming pools are a surprisingly useful way to think about reliable, humane technology.
technologydesignoperationssystemsreliability
2026-07-24 Matthew Ratcliffe 3 min read

The Most Dangerous State in Software Is Almost Done

Reliable software distinguishes an action that looks complete from one that is genuinely durable.
software-designdistributed-systemsreliabilityuser-experienceengineering
2026-07-23 Matthew Ratcliffe 2 min read

When Your Dashboards Lie: The Hidden Cost of Missing Telemetry

Observability is only valuable when you understand what your monitoring cannot see.
observabilitysoftware-engineeringoperationsmonitoring
2026-07-22 Matthew Ratcliffe 3 min read

Make The Work Easy To Pick Up

Good delivery leadership turns vague availability into clear, safe next actions.
leadershipdeliverysoftwareteamscontext
2026-07-21 Matthew Ratcliffe 3 min read

Demo Readiness Starts Long Before the Demo

Great software demos aren't won in the meeting room. They're earned weeks earlier through disciplined engineering, calm delivery and a culture that values reliability over heroics.
software-developmentengineeringdevopsleadershipsoftware-deliverydemos
2026-07-20 Matthew Ratcliffe 2 min read

The Best AI Search Doesn't Just Find Information - It Restores Momentum

AI's greatest workplace contribution may not be generating content---it may be helping people find the right answer quickly enough to keep their momentum.
aisearchproductivityknowledge-managemententerprise
2026-07-19 Matthew Ratcliffe 4 min read

I'm a Straight-Cut Guy

Diagonal mowing can make a lawn look bigger, but sometimes the simpler, straighter approach is the one that fits real life best.
lifesimplicityproductivity
2026-07-18 Matthew Ratcliffe 3 min read

A Good Engineering Metric Can Explain Itself

Engineering health metrics are useful only when they show the evidence and trade-offs behind the number.
engineeringmetricssoftware-deliveryreliabilityleadership
2026-07-17 Matthew Ratcliffe 3 min read

Optimise The Contract, Not Just The Calls

Reliable integrations depend on knowing which supporting calls are load-bearing before you optimise them away.
architectureoperationsintegrationsreliabilitydelivery
2026-07-16 Matthew Ratcliffe 3 min read

Test the Contract Before the Workflow

Integration testing moves faster when teams verify message contracts and agree on evidence before every end-to-end dependency is ready.
integration-testingsoftware-delivery
2026-07-15 Matthew Ratcliffe 4 min read

Use Build-Time Branding for Resellers and Runtime Branding for Customers

A multi-app platform should treat reseller branding as a build input and customer branding as a controlled runtime overlay.
architecturedesign-systemswhitelabellingmulti-tenant
2026-07-14 Matthew Ratcliffe 2 min read

Configuration Is Part of Your Architecture

Business rules, identifiers and environment-specific mappings
architectureconfigurationsoftware-design
2026-07-13 Matthew Ratcliffe 3 min read

Building Safe Integration Test Environments for HL7 ADT and SIU Interfaces

Production systems should never become your testing environment. Learn how to build safe, automated HL7 integration architectures that provide realistic data while protecting clinical operations.
healthcarehl7integrationarchitecturetestinginteroperability
2026-07-13 Matthew Ratcliffe 3 min read

Make The Path Obvious

Operational risk falls when the system makes its intended path visible instead of relying on team memory.
operationsdeliveryarchitecturetestingproduct
2026-07-12 Matthew Ratcliffe 15 min read

AWS, Azure, GCP, and DigitalOcean: Which Hosting Provider Fits Which Team?

A detailed comparison of AWS, Azure, Google Cloud, and DigitalOcean for hosting, with a focus on who each provider suits, how their pricing models behave, and why simplicity sometimes matters more than raw feature count.
cloudhostingawsazuregcpdigitaloceaninfrastructure
2026-07-11 Matthew Ratcliffe 2 min read

Building AI Products for Sensitive Data: Security Cannot Be Added Later

When your software handles sensitive information, security isn't a feature to add before launch—it's an architectural decision made from day one.
aisecurityarchitectureprivacy
2026-07-11 Matthew Ratcliffe 8 min read

Shared Infrastructure with Terraform

A general explanation of shared infrastructure with Terraform, why it exists, how it should be owned, and how teams should use it.
terraformarchitectureinfrastructureplatform
2026-07-05 Matthew Ratcliffe 2 min read

AI Agents Are More Useful Than Chatbots for Real Business Work

Chatbots answer questions. AI agents complete work. Understanding the difference is the key to building systems that deliver measurable business value.
aiagentsautomationarchitecture
2026-07-01 Matthew Ratcliffe 1 min read

Configuration Over Custom Code: A Better Way to Build Multi-Jurisdiction Software

Supporting multiple jurisdictions doesn't require multiple applications. A well-designed configuration model can adapt software without sacrificing maintainability.
architecturesoftware-designconfigurationsaas
2026-06-24 Matthew Ratcliffe 2 min read

Offline Sync Is a Business Process, Not Just a Technical Feature

Successful offline synchronisation isn't solved with clever code alone. It requires clear business rules that define ownership, conflicts, recovery and operational expectations.
mobileofflinesynchronisationarchitectureenterprise
2026-06-18 Matthew Ratcliffe 2 min read

Security Lessons from Building Software for Sensitive Information

Building software that handles sensitive information changes the way you think about architecture. Security becomes a design principle rather than a feature added at the end.
securityarchitecturesoftware-developmentprivacyenterprise
2026-06-17 Matthew Ratcliffe 3 min read

HL7 DFT Messages Explained: Detailed Financial Transactions

DFT messages carry chargeable activity from clinical systems to financial ones, so health services get paid for what they actually did. Here is how financial transaction messages work and why billing interfaces are unusually unforgiving.
healthcarehl7dftintegrationinteroperability
2026-06-17 Matthew Ratcliffe 2 min read

What Makes an Enterprise API Easy to Test?

Testable APIs don't happen by accident. Consistent contracts, predictable behaviour and thoughtful design make enterprise integrations easier to validate, automate and maintain.
apitestingarchitecturesoftware-developmententerprise
2026-06-16 Matthew Ratcliffe 3 min read

HL7 MFN Messages Explained: Master File Notification

MFN messages distribute reference data — clinicians, locations, departments and services — so every connected system works from the same lists. Here is how master file notification works and why neglected reference data breaks interfaces months later.
healthcarehl7mfnintegrationinteroperability
2026-06-15 Matthew Ratcliffe 3 min read

HL7 SIU Messages Explained: Scheduling and Appointments

SIU messages keep appointment information synchronised between scheduling systems and the departments that deliver care. Here is what each SIU event means and why appointment interfaces drift out of step so easily.
healthcarehl7siuintegrationinteroperability
2026-06-15 Matthew Ratcliffe 3 min read

HL7 v2 Isn't Broken—So Why Replace It?

HL7 v2 has reliably connected healthcare systems for decades. If it still works, why is the industry investing so heavily in FHIR and modern interoperability standards?
healthcarehl7fhirinteroperabilityintegration
2026-06-14 Matthew Ratcliffe 3 min read

HL7 ORU Messages Explained: Observation Results

ORU messages deliver clinical results — pathology, radiology reports and observations — back to the systems and clinicians who need them. Here is how result messages are structured, and why corrections and preliminary results cause most of the trouble.
healthcarehl7oruintegrationinteroperability
2026-06-13 Matthew Ratcliffe 3 min read

HL7 ORM Messages Explained: Orders and Order Management

ORM messages carry clinical orders — pathology, imaging, medication and procedures — from the ordering system to whoever has to do the work. Here is how order messages are structured and why order state is harder than it looks.
healthcarehl7ormintegrationinteroperability
2026-06-12 Matthew Ratcliffe 4 min read

HL7 ADT Messages Explained: Admission, Discharge and Transfer

ADT messages are the backbone of hospital integration, carrying patient registrations, demographic updates, transfers and discharges. Here is what each event type means and where ADT interfaces usually go wrong.
healthcarehl7adtintegrationinteroperability
2026-06-12 Matthew Ratcliffe 3 min read

Understanding ADT, ORM, MFN, DFT, SIU and ORU Messages Without the Jargon

HL7 message names can seem cryptic, but each one simply represents a business event in a healthcare organisation. Understanding them makes healthcare integration far less intimidating.
healthcarehl7integrationinteroperabilityfhir
2026-06-11 Matthew Ratcliffe 2 min read

A Practical Way to Build and Maintain a Technical Debt Register

Technical debt becomes manageable when it is visible, prioritised and connected to business outcomes rather than treated as a dumping ground for old ideas.
architecturetechnical-debtsoftware-developmentengineering
2026-06-08 Matthew Ratcliffe 3 min read

Why Front-End Security Checks Do Not Protect Your API

Hiding buttons and protecting pages improves the user experience, but it doesn't secure your backend. Real security lives in the API, not the interface.
securityapiarchitectureauthorisationenterprise
2026-06-03 Matthew Ratcliffe 2 min read

How to Break a Large Enterprise Product into Deliverable Technical Stories

Large enterprise products aren't delivered by tackling everything at once. They succeed when complex initiatives are broken into small, traceable technical stories that each deliver measurable value.
architectureagileenterprisesoftware-developmentengineering
2026-05-27 Matthew Ratcliffe 2 min read

Cursor Pagination: Why 'Previous Page' Is Harder Than It Looks

Cursor pagination delivers better performance than page numbers, but supporting previous pages, stable ordering and changing datasets requires more design than most teams expect.
apipaginationarchitecturesoftware-developmentbackend
2026-05-18 Matthew Ratcliffe 3 min read

Authentication vs Authorisation: What Each One Actually Does

Authentication answers who you are. Authorisation answers what you are allowed to do. They run at different moments, are enforced in different places, and are built from entirely different material.
securityarchitectureauthenticationauthorisationsoftware-development
2026-05-14 Matthew Ratcliffe 3 min read

The Access Control Mistake That Exposes Entire Organisations

The most serious breaches rarely involve a clever exploit. They happen because an application verified who a user was and never verified what that user was allowed to do. Here are the patterns that cause it, and how to test for them.
securityauthenticationauthorisationarchitectureenterprise
2026-05-02 Matthew Ratcliffe 2 min read

Designing Software Around Operational Reality, Not the Happy Path

Great software isn't judged by how well it handles the perfect scenario. It's judged by how gracefully it deals with everything that goes wrong.
architecturesoftware-developmentworkflowsenterpriseengineering
2026-04-30 Matthew Ratcliffe 2 min read

Device Authentication vs User Authentication in Enterprise Mobile Apps

Authenticating a trusted device and authenticating the person using it solve different problems. Understanding the distinction leads to more secure and practical enterprise mobile applications.
mobilesecurityauthenticationenterprisearchitecture
2026-04-22 Matthew Ratcliffe 2 min read

From Business Workflow to Software Architecture

Great software architecture starts with understanding how people work. When business workflows drive technical decisions, systems become easier to build, maintain and evolve.
architecturesoftware-developmentbusiness-analysisenterprise
2026-04-17 Matthew Ratcliffe 3 min read

FHIR vs HL7: Why the Future Is Taking Decades

FHIR promises to modernise healthcare integration with APIs, JSON and web standards, yet decades after its introduction HL7 v2 remains the dominant messaging standard. Understanding why explains one of healthcare IT's biggest challenges.
healthcarefhirhl7interoperabilityintegration
2026-04-15 Matthew Ratcliffe 3 min read

The Danger of Treating a Missing Role as Full Access

Secure systems should deny access when permissions are unknown. Treating missing roles as unrestricted access is a subtle mistake that can expose sensitive functionality across an entire application.
securityauthorisationarchitectureenterprisesoftware-development
2026-04-09 Matthew Ratcliffe 3 min read

Designing Mobile Business Applications That Still Work When the Network Does Not

Enterprise mobile applications can't assume a perfect network. Designing for offline operation, synchronisation and recovery creates software users can rely on wherever they work.
mobilearchitectureofflineenterprisesoftware-development
2026-03-31 Matthew Ratcliffe 2 min read

Designing APIs for Barcode-Driven Workflows

Barcode-driven applications demand APIs that prioritise speed, accuracy and operational resilience. Good API design keeps scanning workflows simple, even when the underlying business rules are complex.
apibarcodearchitecturemobileenterprise
2026-03-19 Matthew Ratcliffe 2 min read

The Hidden Value of Mapping Technical Stories Back to Business Workflows

Technical stories become far more valuable when they're connected to the business workflows they support. Traceability improves planning, communication and long-term maintainability.
architectureagilebusiness-analysissoftware-developmententerprise
2026-03-07 Matthew Ratcliffe 3 min read

Why You Should Document Your Current Architecture Before Designing the Future

Every team wants to design the perfect future architecture, but skipping the current state almost always leads to hidden dependencies, underestimated complexity and costly surprises.
architecturesoftware-developmententerprisedocumentationtechnical-debt
2026-02-28 Matthew Ratcliffe 2 min read

Why Request-Response APIs Eventually Need Events and Background Processing

Request-response APIs are an excellent starting point, but growing enterprise platforms eventually need events and background processing to remain responsive, scalable and resilient.
apiarchitectureeventsdistributed-systemsenterprise
2026-02-26 Matthew Ratcliffe 2 min read

Why Enterprise Architecture Diagrams Become Outdated—and How to Prevent It

Architecture diagrams don't become obsolete because architects stop caring. They become outdated because documentation isn't treated as part of the delivery process.
architecturedocumentationenterprisesoftware-development
2026-02-21 Matthew Ratcliffe 2 min read

How to Pen-Test a Multi-Tenant SaaS Application

Multi-tenant SaaS platforms require more than traditional penetration testing. Verifying tenant isolation, authorisation and data boundaries is essential for protecting every customer.
securitypenetration-testingsaasarchitectureapi