Why GUARDIAN Is Offline-First

Count the institutions a single child-protection case in Ghana can legitimately touch: the Commission on Human Rights and Administrative Justice, the Department of Children, the Department of Gender, the Department of Social Welfare, the Labour Department, the Ghana Police Service. Six bodies, six mandates, six sets of records.

That list is not evidence of neglect. It is evidence of a country that has built protection institutions. The problem is not that no one is responsible; it is that responsibility is distributed and the connective tissue between the parts is a phone call, a letter and, in the worst case, the memory of whichever officer happened to take the report.

GUARDIAN — Ghana Unified Referral and Digital Intelligence for Action on Neglect — is the platform I designed and built against that specific failure. It was submitted by UNIYIA under the Last-Mile Protection Gap challenge and was a finalist in the UNICEF StartUp Lab Pitch. I want to explain the architectural decisions honestly, and I want to be equally clear at the outset about what it is not, which I will come back to at the end.

The gap is the handoff

If you model child protection as a pipeline, the losses do not concentrate where you would expect. They concentrate at the joints.

A case reported to one agency has to reach the agency with the mandate and capability to act on it. Between those two points sit a series of transfers, each of which can silently fail. Nobody refuses. The referral is simply made verbally, or made in writing to a person who has moved on, or made correctly and then never followed up because no one holds a clock on it. Each agency’s record shows its own part of the case discharged. No record shows the child.

Systems rarely fail by saying no. They fail by leaving a case in a queue that belongs to no one.

Every design decision below follows from taking that diagnosis seriously.

Three channels, one case record

Reporting is multi-channel: USSD, WhatsApp and web.

USSD is the one that matters most and is least fashionable. It runs over the GSM signalling channel as a session-based menu, which means it works on a basic feature phone, with no smartphone, no app installation, no data bundle and no app store. In the districts where the protection gap is widest, that is not a fallback — it is the primary realistic channel. Anything that requires a data plan has quietly excluded the people the platform exists for.

WhatsApp meets people where a great deal of Ghanaian communication already happens, and carries what USSD cannot: images, location, longer narrative.

Web serves officers, organisations and anyone reporting from a desk.

The design consequence is that intake surface and case record must be separated. A case is not a WhatsApp thread or a USSD session; it is a record that three very different surfaces can create and enrich. Otherwise you build three parallel systems and reproduce the coordination problem inside your own database.

Offline-first is a claim about geography, not a feature

Here is the thing that decided the architecture. The districts with the weakest connectivity and the districts with the widest protection gap are substantially the same districts.

That correlation is fatal for any design that assumes a live connection. If recording a case requires the network to be up at the moment of recording, the system will be used most reliably in the places that need it least, and will be abandoned in exactly the places it was built for. An officer with no signal does not wait for the system. They write on paper, and the paper does not route, does not escalate and does not appear on anyone else’s dashboard.

So the platform is offline-first by construction, on Next.js 15 with PostgreSQL and PostGIS: capture works locally against a device-side store, work queues durably, and synchronisation happens when connectivity returns rather than being a precondition for doing the work at all.

This is harder than it sounds, and the difficulty is not the caching. It is that offline-first forces you to think properly about identity, ordering and conflict — what happens when two officers touch the same case from two disconnected devices, and which version of the truth wins when they meet. Getting that wrong in a case-management system is worse than being online-only, because a silently lost update looks exactly like a case nobody reported.

Routing to the nearest qualified agency

Cases are routed geospatially, which is what PostGIS is doing in the stack. But the operative word is not nearest — it is qualified.

Proximity alone produces confident, fast, wrong referrals: a trafficking case routed to the closest office that has no mandate over trafficking, which then has to make its own onward referral, reintroducing precisely the manual handoff the platform was built to remove. Routing therefore has to run against geography and mandate together — which body can act on this category of case, at this severity, in this location.

Encoding that is as much an institutional question as a technical one. It requires agreeing, explicitly and in advance, who handles what. A good deal of what looks like software design here is really the documentation of an inter-agency agreement that has previously only existed as professional custom.

Escalation, because silence is the failure mode

Severity-based service-level escalation is the answer to the queue problem. Each case carries a severity, each severity carries a response expectation, and when that expectation is not met the case does not sit quietly — it escalates.

The purpose is not to punish officers, most of whom are carrying more cases than any reasonable load. It is to make inaction visible at the moment it becomes consequential, rather than at an audit two years later. A case that no one has claimed should be loud.

The dashboard is a spine, not a replacement

The inter-agency dashboard links CHRAJ, the Department of Children, the Department of Gender, Social Welfare, the Labour Department and the Ghana Police Service, putting the referral trail in one place across bodies that currently keep separate records.

It deliberately does not try to be each agency’s system of record. Attempting that is how coordination platforms die: they demand that six institutions abandon working internal processes for a newcomer’s, and six institutions decline. What GUARDIAN offers instead is the connective layer — the shared trail showing where a case came from, who holds it now, and how long they have held it.

What GUARDIAN is, and what it is not

It is a submitted platform and a competition finalist. It is not a deployed national system. It has no operational caseload, no live agency users and no field evidence behind it. Every claim above is a design claim, argued from the failure mode, not a result.

I think that distinction is worth stating plainly, because civic technology has a habit of blurring it, and the blurring does real harm — it crowds out attention from systems that have actually been run in anger.

What would have to be true before deployment is a longer list than the build was: a lawful basis and custody arrangement for sensitive data about children, formal agreement among six agencies on routing rules and record ownership, a short code and aggregator arrangement for the USSD channel, and training for the officers who would carry it.

None of that is software. All of it is the reason software like this succeeds or fails — which is, in the end, the same argument the platform itself makes about child protection: the hard part was never the individual capability. It was the handoff.