RASCI STK Process Governance & Document Generator

The problem

Nusantara Regas documents its business processes as RASCI matrices and a hierarchy of STK documents: Pedoman, TKO, TKI and TKPA. The matrices lived in spreadsheets, the documents were written by hand in Word from a controlled template, and nobody could see at a glance which process still lacked a document, which roles overlapped, or which revision was current. Writing the first draft of a procedure was the slowest step of all.

What I built

I led the team that built RASCI STK, a hosted Blazor WebAssembly application on .NET 8, and took three parts of it hands-on. I reworked the UI/UX: design tokens, shared grid components, a stepper-based STK generator with a sticky document header, and an inbox where a row click runs the document's next action. I owned the reliability work: JWT validation with key rotation and clean expiry handling, revision-scoped content and attachments, nvarchar migrations so non-Latin text survives, and test layers from xUnit and bUnit to database procedure checks and a Playwright browser run. And I built the AI module end to end: an LLM client against an OpenAI-compatible gateway, a service that drafts every section of a document as a placeholder template, writes a single section using the rest of the revision as context, and generates cross-functional flow diagrams as validated JSON rendered to SVG and attached as images.

Proof

1. 01 Hosted Blazor WebAssembly on .NET 8: a WASM client, an ASP.NET Core API that hosts it, shared DTOs, EF Core for entity CRUD, and Dapper with stored procedures for the RASCI hierarchy, pivots and dashboards.
2. 02 Document generation merges revision-scoped content, custom sub-sections and attachments into the corporate Word templates with Syncfusion DocIO and converts to PDF; tests inspect the output for header values, section openings and leftover placeholders.
3. 03 AI features stay inside the server layer: the client never talks to the model. The server loads the document context, forbids inventing facts the context lacks, sanitises replies to an allowed XHTML subset, retries a malformed reply once, and only replaces editor text until the author saves.
4. 04 Flow diagrams are produced as structured JSON (roles, steps, boxes, arrows), validated, drawn by a deterministic SVG renderer and exported to JPG, so the diagram template is changed in the renderer rather than in the prompt.
5. 05 Authentication tries the corporate endpoint first and falls back to local accounts hashed with ASP.NET Identity; every API action validates the token inline, and permission rows gate both sidebar entries and per-page buttons.
6. 06 Reliability improvements I owned: expired tokens answer 401 and return to login, historical-key fallback for JWT rotation, idempotent add-on migration scripts for production, and conversion of legacy text columns to nvarchar(max).