Assignment 3 · Architecture proposal
Attendance at Scale Without Smartphones
A resilient, auditable attendance design for a distributed workforce where personal smartphones cannot be assumed.
Problem
One thousand employees work across 100 offices with uneven connectivity and no guarantee that every employee owns, carries or can use a smartphone at work. Attendance must remain available during network outages while preventing buddy punching, location spoofing and silent record changes.
The solution therefore needs trusted shared hardware at each office, an offline path, a controlled exception path and one central source of truth for payroll and HR.
1,000
Employees
100
Offices
Offline
Capable
Audited
End to end
Proposed architecture
100 locations
RFID kiosk
RFID card plus employee PIN or biometric verification.
Every office
Local edge queue
Encrypted durable queue keeps check-ins available offline.
Source of truth
Central backend
Validates events, applies policy and writes the audit history.
Fallback channel
Registered landline + Hunar
Accepts voice attendance only from a known office number.
Human control
Manager approval
Reviews voice and other exceptional attendance events.
Accountability
Immutable audit trail
Preserves submission, verification, decision and correction history.
Normal check-in flow
Identify
Tap RFID card at the office kiosk.
Verify
Enter a PIN or use the biometric reader.
Queue locally
Create a signed, timestamped edge event.
Synchronize
Central backend validates and stores the event.
Calculate
Rules engine updates the attendance record.
Network outage flow
Detect outage
Kiosk continues without central connectivity.
Persist safely
Encrypted events remain in the local edge queue.
Reconnect
Queue resumes with ordered, idempotent delivery.
Reconcile
Backend deduplicates and records original event time.
The kiosk displays a local receipt immediately. Original device timestamps and monotonic sequence numbers are retained; reconnecting never changes when the employee checked in.
Voice fallback flow
Call office line
Employee uses the registered location landline.
Hunar verifies
Voice agent collects identity, PIN and attendance intent.
Route exception
Manager reviews the exceptional attendance request.
Record decision
Approval or rejection enters the immutable audit trail.
Caller ID from the registered office landline is a location signal, not sufficient proof by itself. The voice request remains exceptional until manager approval.
Fraud prevention
- Bind every RFID card to one active employee and require a second factor.
- Use liveness-capable biometric readers where policy and consent allow.
- Sign kiosk events with device credentials and rotate keys centrally.
- Allow voice fallback only from registered office landlines.
- Flag duplicate, impossible or unusual check-in patterns for review.
- Require manager approval for exceptions; never overwrite the original event.
LLM versus deterministic-code responsibilities
- Natural-language daily summaries
- Anomaly explanations for reviewers
- HR questions over authorized data
- Readable management reports
- Final present, late or absent status
- Shift, grace-period and overtime rules
- Deduplication and event ordering
- Payroll-ready attendance totals
The LLM may explain a result, but deterministic, versioned rules always calculate it.
Scaling for 1,000 employees across 100 offices
- Provision one independently identifiable edge device per office, with a spare-device process.
- Partition inbound events by office and preserve ordering within each device stream.
- Use idempotency keys so reconnects and retries cannot double-count attendance.
- Process check-ins asynchronously while keeping central reads strongly consistent.
- Monitor queue depth, last synchronization, device health and clock drift per location.
- Keep stateless backend instances horizontally scalable behind a load balancer.
Privacy and employee consent
- Offer PIN as a non-biometric alternative wherever legally or operationally required.
- Collect explicit, informed consent before biometric enrollment.
- Store biometric templates—not raw images—and isolate them from attendance records.
- Limit HR, manager and operator access by role and office scope.
- Publish retention periods, correction rights and the purpose of every data field.
- Never use attendance data or LLM outputs for undisclosed employee monitoring.