IJRA@ is structured the way mature engineering teams build systems — clear separation of concerns, no hidden coupling, and every layer designed to be replaced.
Layers communicate through explicit contracts. There is no shared global state, no implicit coupling, no “and-then-magic-happens” integrations.
Modern, well-supported, widely-known. No exotic dependencies. No vendor-locked runtime.
| Layer | Stack | Posture |
|---|---|---|
| Frontend | HTML5 · CSS3 · JavaScript · TypeScript · Bootstrap | Open |
| Backend | .NET Core · ASP.NET MVC · C# | Microsoft |
| Web Services | REST · SOAP · WSDL · gRPC | Standards |
| Mobile | Flutter · iOS · Android · Cordova | Cross-platform |
| Data | SQL Server · Umbraco CMS · ServiceNow | Enterprise |
| Deploy | Cloud · On-premise · Hybrid · Air-gapped | Flexible |
Standards-compliant vocabulary, extended with the task types modern enterprise execution actually needs. The base notation stays portable.
IJRA@ brokers between your existing identity infrastructure and every workflow it runs — with role-, attribute-, and process-scoped authorization layered on top.
| Identity Provider | Protocol | Use |
|---|---|---|
| Active Directory | LDAP · Kerberos | Internal staff authentication |
| Azure AD / Entra | SAML 2.0 · OIDC | Cloud-federated SSO |
| National ID System | OAuth 2.0 · OIDC | Citizen-facing portals |
| PKI / Smart Cards | X.509 · mTLS | High-assurance gov & defense |
| Custom IdP | SAML / OIDC / Custom | Per-deployment configuration |
Six layers of defense, six compliance frameworks supported. Configurable per deployment, audit-ready by default.
Data subject rights · DPO support · processing records · cross-border transfer controls.
Saudi Personal Data Protection Law. Data localization, consent management, breach notification.
UAE Federal Decree-Law 45/2021. Data subject rights and lawful processing requirements.
Information Security Management System aligned controls across all platform layers.
Saudi Essential Cybersecurity Controls. Mapped to platform configuration baseline.
Per-jurisdiction frameworks supported via configurable policy modules.
| Layer | Controls |
|---|---|
| Network | WAF · DDoS protection · network segmentation · zero-trust |
| Transport | TLS 1.3 mandated · mTLS for service-to-service |
| Application | OWASP-aligned · SAST · DAST · pen-testing cycle |
| Data | AES-256 at rest · field-level crypto for PII · key vault |
| Identity | MFA · session pinning · credential rotation |
| Audit | WORM logs · 7-year retention · SIEM-ready feeds |
Customer chooses. The same engine runs on AWS, Azure, OCI, sovereign cloud, customer data centers, and air-gapped enclaves. Data residency is enforced at the database, document repository, and audit log layers.
Fully customer-controlled. Government data centers. Customer's network only. Hardware specs negotiated per deployment.
Customer-tenanted on Azure, AWS, OCI, or local sovereign cloud. Single-tenant isolation guaranteed.
Sensitive workloads on-premise. Citizen-facing portal on cloud. One control plane spans both.
Zero external connectivity. Offline patch delivery. Hardened OS images. Verified package signatures.
Benchmarks performed on a 3-node cluster, commodity gov-grade hardware. Linear scaling to 10× throughput verified up to 12 nodes.
Sustained, single deployment.
Active process throughput.
User task → engine response.
Active-active deployment SLA.
| Metric | Target | Notes |
|---|---|---|
| Platform Availability | 99.95% | Multi-AZ active-active |
| API Latency (P95) | <200ms | Process query endpoints |
| Task Assignment | <2s | Routing + notification |
| Rule Evaluation | <50ms | DMN decision tables |
| Audit Log Write | <100ms | Synchronous WORM commit |
| RPO / RTO | 5min / 1hr | Disaster recovery objectives |
| Patch Window | Zero-downtime | Rolling deployment |
Every architectural decision is a defence against a specific way that BPM platforms typically rot.
Every behaviour the engine performs is declaratively specified. There are no hidden hooks where logic accumulates invisibly.
Layers communicate through explicit contracts. The integration layer cannot reach into the process engine; the process engine cannot bypass the rules layer.
Every artifact — process model, rule, form, mapping, credential — is versioned and audit-logged. Nothing changes without a record.
BPMN 2.0 is an OMG standard. SQL is SQL. Rules export as deterministic specifications. You can leave at any time.
Most first deployments go live in 6–12 weeks. Pick a single process, see it modelled, automated and measured — then decide what to roll out next.