The technology estate
Cabling. Accounts. Cameras.Three layers, one estate.
The physical network in the walls, the digital infrastructure that runs on it, and the security layer that watches both. Designed, built and connected as one estate rather than three projects that meet at a wall.
01Hardware layer
The hardware layer
Everything the building needs before a single account exists. Cabling, a cabinet, switching, an edge, and coverage in the places the building itself blocks.
10 elements
02Digital layer
The digital infrastructure layer
What runs on top of the cabling: one directory, one set of devices, a decision about where every record lives, and the AI that reads across all of it.
11 elements
03Security layer
The security layer
The cameras, the doors and the sensors resolving to one console, and the identity half of security that decides who reaches the data at all.
9 elements
The model
The same building,separated into three layers.
The hardware layer is what the building is wired with. The digital infrastructure layer is what runs on it. The security layer watches both and resolves to one console.
Every element is named where it sits. Pick a layer and that floor pulls out of the building, with the other two left where they are, because a building is the three of them at once.
01Hardware layer
The hardware layer
Everything the building needs before a single account exists. Cabling, a cabinet, switching, an edge, and coverage in the places the building itself blocks.
Built with, typically
- Cisco Meraki
- WatchGuard
- Buffalo
02Digital layer
The digital infrastructure layer
What runs on top of the cabling: one directory, one set of devices, a decision about where every record lives, and the AI that reads across all of it.
Built with, typically
- Microsoft 365
- Entra ID
- Intune
- SharePoint
- OneDrive
- Teams
- Copilot
- Power BI
- Jira
- Asana
- ClickUp
- Notion
- Salesforce
- HubSpot
03Security layer
The security layer
The cameras, the doors and the sensors resolving to one console, and the identity half of security that decides who reaches the data at all.
Built with, typically
- Cisco Duo
- Keeper
- Barracuda
- AvePoint
Two networks, one connection
The guest wifi and theinternal networkshould never meet.
Both run over the same cabling and out through the same connection. They are kept apart by a tag on every frame, which is what a VLAN is, so separation costs a configuration rather than a second set of cables.
The guest network gets its own address range, its own DHCP scope, client isolation so two guests cannot see each other, and a ceiling on bandwidth per device and in total. The firewall holds no rule that carries anything from it into the internal network.
What a single flat network costs
- 01A visitor's phone can see the file server, the recorder and the card terminal, because nothing ever told it not to.
- 02One infected laptop on the guest wifi scans the whole estate from inside, which is where almost nothing is watching.
- 03A camera or a printer with firmware nobody has updated in years becomes the way in, and then the way across.
- 04The payment segment stops being a segment, which is a compliance finding before it is an incident.
- 05Bandwidth is first come, first served, so the busiest hour in the lobby is the slowest hour at the counter.
The splash page
The captive portal is the one interfaceevery visitor definitely sees.
It is the branded page that appears when you join the wifi in a hotel, a clinic or a cafe. It exists to put a gate in front of a network, and while it is there it can also say who the business is.
An illustration of a captive portal: a browser bar reading network login, then the business's own mark, a heading welcoming the guest to the guest network, a line saying the network is separate from internal systems and reaches the internet only, a field for an email address, an alternative voucher code from the front desk, a checkbox accepting the acceptable use policy, a connect button, and a footer giving the session length and the per device bandwidth limit.
What it takes to set one up
01The portal itself
A page served by the gateway before any other traffic resolves, branded to the business, readable on a phone in daylight, and hosted where it stays up when the network behind it does not.
02Terms, and a record of acceptance
An acceptable use notice written to be read, with the acceptance logged against the session rather than assumed. This is the part that is usually skipped and the part a dispute turns on.
03How a guest gets on
A voucher from the front desk, an email address, or a sign in with an account the guest already has. Each one trades friction against what the business learns, and the choice belongs to the business.
04Session and bandwidth limits
How long a session lasts, what happens when it ends, how much of the connection one device may take, and what the whole guest network is capped at.
What the business gets back
A guest network that cannot reach anything
The portal is the visible half of the separation. A device that gets through it lands on a network with one exit and no route to the till, the cameras or the file server.
An opt in list that is actually consented
Where the business asks for an email address and says plainly what it will be used for, the list it builds is small, accurate and defensible, which is worth more than a large one that is not.
A count of who is in the building
Sessions, duration and returning devices, in aggregate. Useful for staffing a floor and for knowing whether the wifi is the reason people leave.
One page that looks like the business
For many visitors the portal is the first interface the business ever shows them. It is cheap to make it good and expensive to leave it as the vendor's default.
Workforce and efficiency
Tooling an operations teamcan use on a Monday.
Hours, shifts, devices and work in progress already generate a record. The job is to make that record legible to the person who has to decide something with it, and to keep it pointed at the process rather than at individuals.
01
Time and attendance
Clock in and clock out on a reader at the door or on an enrolled phone, with the rules of the agreement applied as the hours are recorded rather than argued about afterwards: breaks, overtime thresholds, shift premiums and statutory holidays.
Payroll from a record rather than a reconstruction
02
Scheduling
Shifts built against demand and against what each person is qualified and available to do, published where the team already looks, with swaps and absences routed to whoever is allowed to approve them.
A roster that survives the first sick call
03
Device and application visibility
The estate seen as an estate: which devices are enrolled, which are patched, which applications are installed and which licences are being paid for and not opened. Reported by team and by site, not by person.
Licence spend and patch gaps, both visible
04
Task and project throughput
Work as items with an owner, a date and a state, so cycle time, queue length and the stages where work waits can be read off the board instead of estimated in a meeting.
Where work actually waits
05
Reporting a manager reads on a Monday
One page per function, built on the systems above rather than on an export, with the same handful of measures every week so a change means something. Hours against plan, throughput, spend, and the exceptions that need a decision.
A short page instead of a long thread
Operational visibility, and where it stops
- Measure the work, not the person. Throughput, cycle time, hours against plan and licence use are properties of a process, and they are reported by team and by site.
- Say what is collected, in writing, before it is collected. A policy the team has read is the difference between a tool they use and a tool they work around.
- Collect what the decision needs and nothing more. Keystroke logging, screenshots and continuous location have almost no operational use and a long list of legal and cultural costs.
- Let people see their own record. Anyone should be able to open their own hours and their own schedule and raise a correction.
- Keep the employment side legal and local. Hours, breaks, overtime and consent are set by statute and by any agreement in force, and the tool is configured to them rather than the other way round.
Next
Built once, in the right order.
The layers depend on each other. A directory built before the cabling is labelled, or an AI agent pointed at data nobody has placed, produces work that has to be done twice.
