Case study · Spatial data / public interest
Can I lawfully go there? A question answered by computation, not opinion
- Python
- TypeScript
- PMTiles
- MapLibre
- Cloudflare Pages
✓ Verified Review“The hardest feature in Public Trails is refusal. Fifty-eight routes in the pilot are not published, with reasons, because the official records could not prove lawful access - and that restraint is exactly what makes the 435 routes we do publish worth trusting. When your product makes claims about the law, 'probably fine' is not a verdict.”
Routes refused, with reasons, rather than guessed
Routes published, each traced to an official record
Agreement with the hand-checked route
Provenance grade carried on every fact
The challenge
Whether land is lawfully accessible is scattered across cadastre, protected-area estates, Crown road reserves and easements - records that were never designed to be read together, and where a wrong answer sends someone onto private land. Community data knows the names; only official records know the law.
What we built
A deterministic pipeline over official spatial records with a provenance grade on every fact, versioned inference rules, and a verdict ladder that computes the lawful route - or refuses to publish one, with reasons - for every place in a region.
- Per-jurisdiction spatial adapters over a common schema - analysis code never sees a state
- Provenance grading A-D with community data quarantined from the legal evidence chain
- Corridor solver: lawful multi-parcel routes via easements and Crown road reserves
- Verdict ladder with refusal - no route is published where tenure cannot be confirmed
- Golden fixtures pinning computed routes against hand-checked ground truth
- Static site with PMTiles + MapLibre; deterministic, fail-closed pipeline in CI
The stack
Python pipeline with per-jurisdiction source adapters over a common schema; corridor solving across parcel chains; one-to-one name pairing that quarantines OpenStreetMap (ODbL) data to naming only; golden fixtures that pin computed routes against hand-checked ground truth; a static TypeScript front end with PMTiles and MapLibre; fail-closed licensing and restricted-register gates in CI.
The outcome
The live pilot covers the Gold Coast Hinterland with real Queensland data end to end: 109 places, 435 routes and 549 published pages, each carrying its verdict tier, evidence chain and emergency reference. Where the data could not support a verdict, the site says so - 58 candidate routes were refused with reasons rather than published on a guess. The hand-checked golden route agrees with the computed one to within 30 centimetres.
Where it went next
The jurisdiction-proof core - a common schema with per-state adapters - is the point: covering a new state is an adapter and a source manifest, not a rebuild. Aboriginal cultural heritage site locations are never ingested, stored or republished; statutory duty-of-care notices are carried on every page.
This case study describes a live product designed and built by National Digital. Figures describe the shipped pilot region; on-ground signage and temporary closures override every published page, by design.
Key Takeaways
Why a system that refuses to answer is more trustworthy
- Refusal is the load-bearing feature: 58 pilot routes were withheld with reasons rather than guessed.Critical
A verdict ladder that can return no lawful route is what makes the 435 published routes credible. Without the ability to decline, every answer would carry the same unearned confidence and a reader could not tell the difference.
- A verdict is only as strong as the weakest link in its evidence chain, and that grade is published.Critical
Facts are graded from gazetted register down to community record, and the verdict inherits the lowest grade it depends on. Confidence is therefore computed from provenance rather than asserted by the system after the fact.
- Community data is quarantined to naming, so it can never influence a legal conclusion.Critical
OpenStreetMap contributes toponyms under ODbL terms through one-to-one pairing with official features. It is structurally excluded from access reasoning, which keeps every legal claim traceable to official sources only.
- Per-jurisdiction adapters over a common schema mean covering a new state is configuration, not a rebuild.Important
Source adapters normalise each jurisdiction's data at the boundary, so corridor solving, provenance grading and the verdict ladder never encode state-specific logic and are written and tested exactly once.
- Golden fixtures against hand-checked ground truth let the inference rules improve safely.Important
The pilot's golden route agrees with the computed route to within 30 centimetres, and any rule change that moves a known-good route fails CI. Correctness already achieved cannot be silently regressed by a later improvement.
Public Trails computes whether a wild place can be lawfully visited, and by which route, from official spatial records alone. Every fact is provenance-graded, a verdict inherits the weakest grade in its evidence chain, and where tenure cannot be confirmed nothing is published.
Questions decision-makers ask about this build
How can software answer a legal question about land access?
Why is refusing to answer treated as a feature?
How is community data such as OpenStreetMap used without contaminating the legal chain?
What makes this extend to another state without a rebuild?
How do you know the computed routes are actually right?
How are cultural heritage and safety obligations handled?
What's next
Complex data, hard guarantees?
Public Trails turns scattered official records into computed, evidence-graded answers. If your domain needs the same rigour, see how we approach data analysis and insight platforms and system integration, part of our wider custom software development work.