Kyros — internal document approval system

Internal documents — memos, requests, orders — go through a chain of approvers. As long as that process lives on paper and in messengers, nobody can answer a simple question: who has the document right now, and how long has it been sitting there?

The constraints rule out most off-the-shelf products:

• the company runs on a local network with no internet access, so cloud services are out;
• there is no domain and no Active Directory;
• users work over RDP on a Windows terminal server;
• the scale is small: up to 30 users and around 30 documents a day, so rolling out a full ECM costs more than the problem it solves;
• qualified digital signatures aren't needed — this is an internal tool with no legal weight.

Architecture sized to the problem

The original plan was a desktop client plus a separate Web API. I deliberately dropped it for a single web application: fewer moving parts, one place to install and update, and something the in-house IT team can maintain.

Approval routing

A document moves through a chain of approvers, and the system always shows who holds it. A separate "informed" role covers people who need to see a document without approving it.

Permissions without a domain

Access is an explicit list on each document rather than groups and job titles. Accounts are created by an administrator. Since users start each morning with a fresh terminal session, "remember me" was intentionally left out.

Install and update

A WiX installer deploys the system to the same server and updates over the installed version with a correct version number. The company's own administrator handles deployment — no DevOps, no external access.

Runs on what's already there

SQL Server is already licensed on that server, so no new hardware is required.

Code they can maintain

An explicit requirement: the code must be readable by a junior-plus developer so the company isn't locked to its author. The UI was built in Claude Design as production-ready markup.

The project is complete: a working solution for a scenario where the cloud isn't available and enterprise ECM is overkill. The company gets document approvals with a transparent history, with no per-user monthly fee, no data leaving the local network and no new hardware.