Arbor
Redesigning the entity model so every layer on top could finally be trusted, from data architecture to onboarding to the UI.
The brief
The asset platform was wrong in a way no UI patch could fix: the data model misrepresented how a portfolio is structured, so every screen inherited the same blind spots. Funds, properties, buildings, spaces and meters lived in one flat list with implicit relationships, and onboarding captured them in the wrong order.
My job was to rebuild the foundation: the entity hierarchy and the relationships binding it, the onboarding that populates it, and the UI that lets customers trust what they see, before any analytics layer (Kova) could sit on top.
The foundation was broken, and every screen on top of it inherited the cracks
Six interconnected problems, one broken foundation: a data model that didn't reflect how real portfolios are organised.
The platform held entities as a flat list with name-matched joins. A single misspelt building name would silently break a fund's reporting roll-up.
ESG managers spent days reconciling the same property across spreadsheets, the platform, and the customer's actual portfolio. Asset owners stopped trusting the totals.
A data model the platform itself enforces, an onboarding flow that captures the right thing in the right order, and a UI that surfaces gaps before they become reporting incidents.
Eight customers, three roles, one recurring symptom, the model didn't match reality
Onboarding interviews with ESG managers, asset owners and the consultants who picked up the slack, plus a session walking through the live data of two existing accounts.
What does a portfolio actually look like in our customers' heads, and where does our platform's mental model diverge?
Which onboarding steps cause the most rework after go-live, and why?
What proof do customers want from us that the numbers they see are the numbers they own?
Three personas, three different relationships with the same data
The asset owner needs trust at a glance, the ESG manager needs to drill into the meter-level story, the data admin needs to keep both honest. Same hierarchy, three demands.

A journey map of the current onboarding, and where it quietly fell apart
Five phases from "we signed a contract" to "the first monthly report ships". The cliff is between phases 3 and 4, where meter-to-space mapping lives in a spreadsheet the platform can't validate against.

What we heard, on the data itself
"Every reporting cycle we email the data team three times. Once to confirm the property list, once to confirm the meters, once to ask why the totals are different from last month."ESG manager, customer fund
The complaint wasn't about email volume. It was that the platform was never the source of truth, so customers kept a parallel spreadsheet they trusted instead.


The current onboarding swim-lane, three roles, four handoffs, one fragile spreadsheet

A new entity model, an onboarding flow that earns trust as it goes, and an IA that mirrors the portfolio
Six interview themes affinity-mapped into four problem categories. Four principles came out the other side, every design decision downstream had to answer to them.
Information architecture, rebuilt around the entity tree
Funds contain properties, properties contain buildings, buildings contain spaces, spaces contain meters. The nav, the URL structure, the permissions model and the data quality roll-ups all derive from this one truth.

Phased design roadmap, six tracks, each building on the last
Entity model → onboarding flow → permissions → data quality surface → activity log → connection wizard. We shipped each in sequence so every step landed on a foundation that already worked. All of it was built on the platform's shared design system, so Arbor shipped consistent with the rest of the suite rather than as a one-off.

Three real-life scenarios, drawn out before any wireframe
A storyboard for property onboarding, a decision flow for when two sources disagree, and a worked example of a sub-meter added mid-quarter. Drawing them stopped us designing screens for cases we hadn't thought through.

.webp)
.webp)
The redesigned onboarding swim-lane
Same five phases, same three roles, but the platform now owns the validation, the resolution, and the save-draft state at every stage. The fragile spreadsheet is gone.

From affinity map to the screens that earned trust
Five wireframe tracks, each resolving one of the problems research surfaced before any pixels were polished.
Six weeks. Four tools. One customer in the dark.
Customers paid for a service, logged in on day one, and saw nothing. A third of every onboarding was consultants translating spreadsheets into a three-level model that couldn't hold the shapes real estate actually comes in. Before any pixel got drawn, we had to figure out where the time was going.
Three problems stacked on top of each other, each one a symptom of the layer beneath it.
From ~12 Dovetail sessions across 7 roles. We taped these to the wall and filtered every later design call through them.
The model couldn't hold real portfolios.
Three entity levels worked for vanilla offices. Solar farms, mixed-use, airports? Consultants made duplicates, and duplicates broke aggregation. Reports were quietly wrong.
The surface hid relationships.
Users described portfolios spatially, pointing, drawing in the air. The platform showed flat tables. People rebuilt the hierarchy in their heads (or in Excel) on every visit.
The process was a single big bang.
Everything had to land before anything went live. Different data owners on the customer side waited weeks, then got chased all at once. Nothing visible until the end.
The brief we rewroteStop redesigning the dashboard.
Start fixing the model.
The ask was “redesign onboarding screens”, but no polish would shave the six weeks: the time was in the translation, which existed because the model couldn't represent what customers owned. So we re-scoped to a foundation rebuild, slower to ship, bigger payoff, and Kova literally couldn't exist without it.
The hard sell"Four principles, agreed upfront."
To buy permission for the slower foundation work, I workshopped four design principles with engineering + CS + a senior consultant and got sign-off before any wireframes:
01 ONE HIERARCHY, ONE SOURCE OF TRUTH
02 EVERY LEVEL · VIEW · EDIT · EXPORT · AUDIT
03 THE CANVAS TEACHES THE MODEL
04 ONE UI, ROLE-BASED PERMISSIONS
Reviews dropped from 3–4 rounds per design to 1–2 because the answers were already on the wall.
Three levels, four levels, five.
Everything downstream depended on this. We card-sorted with 12 consultants, prototyped three model shapes and tested them on real portfolios, including the awkward ones nobody demos. Five levels won because nothing else could hold a solar farm and a mixed-use retail park in one schema.
What card-sorting told usThe mental model was already five.
In 12 open card-sorts, the median participant grouped entities into 4.7 buckets, one more than the platform held. The new layer wasn't invention, it matched what people already did in their heads. One drew an arrow between "building" and "meter" and wrote "but what's the unit?" That was the brief for Space.
The riskiest assumptionVersioning, we couldn't fully test it.
You can't really prototype "going back in time", so we tested the need: shown a Building that had moved between Properties, every user asked "can I see what it looked like before?" Need validated, mechanic unvalidated, so we logged the risk and shipped the simplest version, an append-only audit log per entity.
Tables for data. Canvas for relationships.
Once the model was right, the surface had to teach it. Tables answer "what do I have?", canvas answers "how is it connected?". The shipped version is both: same data, two windows. The canvas was where a usability participant fixed their own mis-mapped meter in 30 seconds.
What changed at v3 → v4Stop choosing. Combine.
v3 was a designer's instinct to pick one paradigm. v4 came from watching users work: table to filter, canvas to verify, table to bulk-edit, canvas to spot orphans. They wanted both, with state shared. Pairing a focused list view with a spatial one is the move, Linear's issues + sub-issues graph is the closest cousin.
The engineering negotiation"Canvas from L2, never L1."
Engineering pushed back on a fund-level canvas over React Flow's node budget, so we scoped canvas to Property and below and showed fund-level relationships in a slimmer chart. The constraint actually improved the design, at fund level users want totals, not topology.
Six weeks of silence, made incremental.
The fix wasn't a faster wizard, it was a different shape. Instead of demanding everything upfront and blocking until complete, every entity got a save-as-draft escape hatch. Customers see something on day three, and the right person gets pulled in when needed, not in one panic.
Before and after, the same job in half the time.
The pattern"Drafts as first-class citizens."
The mental shift: a half-filled entity isn't an error state waiting to be completed, it's a valid state with its own affordances, viewable, exportable with caveats, assignable, even reportable at portfolio level. This unlocked the JIT prompt model, "the report needs this, ask the right person now".
Where it broke"Draft sprawl" was the new risk.
Without housekeeping, customers could end up with hundreds of half-filled entities and no path to completion. Fixes shipped:
① Draft index per fund, listing all in-progress entities by what's blocking them.
② Auto-expire empty drafts after 90 days.
③ Completion estimate per draft, from required-field coverage.
Stop emailing the consultant. Start self-serving.
The old loop: a meter fails silently, the customer spots it in a report, emails the consultant, waits 2-4 days for an Excel fix. We replaced it with a live Actions panel for failed and pending meters, in-line resolution and a full audit log, so trust isn't "take our word for it", it's "here's every event for twelve months".
When an auditor or investor asks "how do I know this number is right?" the old answer was essentially "trust us".
Now: every validation, every collection event, going back 12 months. Admin-only at launch. Consultant-led, but the rationale for opening it to customers is being built.
What we shipped, and what we didn't.
A foundation rebuild is a series of small "no"s in service of one big "yes", what we kept, what we cut, and what we deferred until the next release could carry it.
| Decision | What we did | Why | Status |
|---|---|---|---|
| Five entity levels, not three | Inserted Space as level 4 between Building and Meter. Re-wrote inheritance rules; aggregations roll up instead of being entered. | Three levels couldn't represent tenant attribution, common areas, solar/EV. Duplicates were silently breaking reports. | Shipped |
| Canvas + table, paired | Same data, two views. Toggle preserves state. Canvas opens at Property level (not Fund) for performance. | Users used both, table for filter/bulk, canvas for verify/relate. Choosing one would have lost half the job. | Shipped |
| Draft mode as first-class state | Every entity can be partial. Drafts show everywhere. Just-in-time prompts fire from real report needs. | Big-bang onboarding meant 5 weeks of customer silence. Drafts collapsed that to 3 days to first view. | Shipped |
| Actions panel · self-serve | Retry / diagnostics / suggest / support. Failed-meter resolution moved from consultant ticket to customer click. | ~70% of meter failures were credential or transient, solvable without a human. Saved the consultant for what only a consultant can do. | Shipped |
| Audit log · admin-only at launch | Full event log with timestamps, statuses, role attribution. Visible to consultants & R&A, not yet customer-facing. | Provenance was the unblocker for the next conversation (Kova). Customer-facing audit needs governance work we'll do next quarter. | Partial |
| Anomaly detection in Kova scope | Pushed to a follow-up release. Argued for sequencing: ship data quality first, train a model on real engagement, then layer predictions. | You can't put anomaly detection on data nobody trusts yet. A flagged anomaly on broken data sends users back to the consultant, exactly what we were removing. | Deferred |
| Fund-level canvas | Dropped. Canvas starts at Property. Fund-level view is a slimmer aggregated chart. | React Flow's node budget capped us at a few hundred. Real funds have thousands. And at fund level users want totals, not topology, the constraint matched the job. | Cut |
| Free-text entity tags | Killed in v1 of the model. Replaced by a controlled vocabulary tied to the Space level (internal / external / tenant / common). | Tags were unenforceable. Two consultants could code the same building three different ways. The model has to mean one thing. | Cut |
| Single mega-wizard | Killed in v1 of onboarding. Replaced by per-entity create with draft-by-default. | 0 / 6 testers finished a 6-step wizard. Required-field walls trapped users at step one. | Cut |
| Customer-facing audit log | Deferred to next quarter. Governance work in progress. | Could surface confidential consultant actions. Needs a per-event visibility model first. | Deferred |
What I'd take from thisFix the model first.
Arbor shipped slower than the business wanted, but Kova couldn't exist without this foundation. The interface is the contract: when the IA is right, every downstream decision gets easier, and customers trusted numbers they could actually trace.
What I'd do differentlyTest versioning earlier.
Append-only audit was the safe bet for v1, but it left the hardest interaction, rolling back a structural change, unsolved. I'd carve out a prototype day with engineering earlier to de-risk the "going back in time" mechanic, and I'd run the anomaly-detection sequencing argument in writing from day one.
Where the platform stopped being a passive list and started keeping itself honest
The surfaces that did the heaviest lifting once Arbor shipped: the entity hierarchy and its graph, suggested actions, permissions, onboarding, and the activity log.
From a platform customers worked around to one they could actually use.
The most useful signal was qualitative: customers stopped keeping a parallel spreadsheet. The platform's entity tree became the version of the world they trusted, which is what made the next layer (Kova) possible at all.
Other Work
The rest of the work, from greenfield builds to systemic redesigns.





