Case study · Spatial data / public interest
Can I lawfully go there? A question answered by computation, not opinion
Public Trails is a National Digital product. It computes whether the public may lawfully reach a wild place, and on what evidence, from official land records.
National Digital delivers platform engineering for spatial and public-records data like this.
Last updated
At a glance
- Industry
- Spatial data / public interest
- Engagement type
- In-house product
- First release
- 2026
- Team
- National Digital engineering team
✓ Verified Review
“The hardest feature in Public Trails is refusal. Places in the coverage are published without a route, with reasons, because the official records could not prove lawful access, and that restraint is what makes the routes we do publish worth trusting. When your product makes claims about the law, 'probably fine' is not a verdict.”
Cameron Young CEO at National Digital
Public Trails by the numbers
1,856
Places published
6,938
Routes published, each traced to an official record
18
Council areas published in New South Wales and Queensland
368
Places with a verdict of no lawful route
Gazetted to Community
Evidence grades on every fact
The challenge
Whether land is lawfully accessible is scattered across cadastre, protected-area estates, road reserves and tracks, which were never designed to be read together, and a wrong answer sends someone onto private land. Community data knows the names, and only official records know the law.
What we built
A deterministic pipeline over official spatial records with a grade on every fact, versioned inference rules and a verdict ladder that computes the lawful route, or refuses to publish one and states why, for every place in a council area.
- Per-jurisdiction spatial adapters over a common schema, so analysis code never sees a state
- Four named evidence grades, with community data quarantined from the legal evidence chain
- Corridor solver: lawful multi-parcel routes through road reserves and easements
- Verdict ladder with refusal, so no route is published where tenure cannot be confirmed
- Golden fixtures pinning computed verdicts against hand-checked cases
- Static site with PMTiles and MapLibre, built by a deterministic, fail-closed pipeline in CI
What we built in each area
Website & apps
An Astro and TypeScript static site draws each place on a PMTiles and MapLibre map. A deterministic, fail-closed pipeline builds it in CI.
- Astro
- TypeScript
- MapLibre
- PMTiles
- Cloudflare Pages
Data & reporting
A Python pipeline reads official spatial records through per-jurisdiction adapters onto a common schema. Append-only snapshots are kept in object storage.
- Python
- GeoParquet
- Cloudflare R2
The outcome
The site publishes 1,856 places across 18 council areas, with 6,938 routes. 368 places carry a verdict of no lawful route, and the site publishes no route for them. Where the records could not support a verdict, the page says so and gives the reason. Each page names the government layer or statute that each claim rests on.
Where it went next
Coverage grows one council area at a time. The common schema and per-state adapters mean a new state is an adapter and a source manifest, and the verdict rules are not rewritten. Aboriginal cultural heritage site locations are never ingested, stored or republished, and statutory duty-of-care notices are carried on every page.
This case study describes a live product designed and built by National Digital. Counts are read from the site's own coverage statement. The site is not a government service, and on-ground signage and temporary closures override every published page.
Key Takeaways
Why a system that refuses to answer is more trustworthy
- Refusal is the load-bearing feature: places with no lawful chain are published as refusals, with reasons.Critical
A verdict ladder that can return no lawful route is what makes the published routes credible. Without the ability to decline, every answer would carry the same unearned confidence and a reader could not tell the difference.
- A verdict is only as strong as the weakest link in its evidence chain, and that grade is published.Critical
Facts are graded from gazetted record down to community record, and the verdict inherits the lowest grade it depends on. Confidence is computed from provenance and is not asserted by the system after the fact.
- Community data is quarantined to naming, so it can never influence a legal conclusion.Critical
OpenStreetMap contributes names under ODbL terms through one-to-one pairing with official features. It is structurally excluded from access reasoning, which keeps every legal claim traceable to official sources only.
- Per-jurisdiction adapters over a common schema make a new state an adapter and a manifest.Important
Source adapters normalise each jurisdiction's data at the boundary, so corridor solving, grading and the verdict ladder never encode state-specific logic and are written and tested once.
- Golden fixtures against hand-checked cases let the inference rules improve safely.Important
Any rule change that moves a known-good verdict fails CI. Correctness already achieved cannot be silently regressed by a later improvement.
Public Trails computes whether a wild place can be lawfully visited, and on what evidence, from official spatial records alone. Every fact is graded, a verdict inherits the weakest grade in its chain, and where tenure cannot be confirmed nothing is published.
What problem does Public Trails solve?
Whether land is lawfully accessible is scattered across cadastre, protected-area estates, road reserves and tracks, which were never designed to be read together. A wrong answer sends someone onto private land.
What did National Digital build for Public Trails?
National Digital built a Python pipeline that reads official spatial records, grades every fact by the record it rests on and applies versioned inference rules. It publishes one of four verdicts for each place and publishes no route where lawful tenure cannot be confirmed.
Did a client commission Public Trails?
No client commissioned it. Public Trails is a National Digital product, and National Digital built it and runs it. The first release was in 2026.
What does Public Trails publish now?
The site publishes 1,856 places across 18 council areas, with 6,938 routes. Each page names the government layer or statute that each claim rests on.
Questions about Public Trails and how it was built
How can software answer a legal question about land access?
It does not give legal advice. It computes what the official records support and grades its own confidence. Cadastre, protected-area estates, road reserves and tracks are read together under versioned inference rules, and each place receives one of four verdicts: lawful with nothing to flag, lawful with caveats, unconfirmed, or no lawful route. A verdict's confidence is the weakest evidence grade in its chain.
Why does Public Trails publish a refusal instead of a route?
Because the alternative sends someone onto private land. Where lawful tenure cannot be confirmed, no route is published, and the page states the reason. 368 places in the current coverage carry a no lawful route verdict. A site that always has an answer cannot signal when it should not.
Which areas does Public Trails cover?
It covers 18 council areas in New South Wales and Queensland, published one area at a time. An area is published whole, so every place the names register lists is routed in it, refusals included. A place outside those areas has no verdict at all, and the site does not read that as unreachable.
How is community data such as OpenStreetMap used without contaminating the legal chain?
It is quarantined to naming only. Community records know what places are called, and official records know the law. OpenStreetMap data is paired one-to-one with official features for names under its ODbL terms and graded as a community record, so it can never contribute to an access verdict.
What stack does Public Trails run on?
A Python pipeline with shapely, pyproj and GeoParquet reads the official layers and computes the verdicts. An Astro and TypeScript site renders the static pages, with MapLibre and PMTiles for the map, and Cloudflare Pages serves it. Snapshots sit in Cloudflare R2, written append-only, and a weekly workflow refreshes them.
What makes this extend to another state without a rebuild?
A common schema with per-jurisdiction source adapters, so the analysis code never sees a state. Each jurisdiction's cadastre, estates and road-reserve data is normalised at the adapter boundary, so corridor solving, grading and the verdict ladder are written once and reused. A new state is an adapter and a source manifest.
How do you know the computed verdicts are right?
Golden fixtures pin computed verdicts and routes against hand-checked cases, including a caveated route, a refusal and a formal track. Any change to the inference rules that moves a known-good verdict fails continuous integration, so the rules can keep improving without silently breaking answers already published. The grades also tell a reader how much weight a verdict can bear.
How are cultural heritage and safety obligations handled?
Aboriginal cultural heritage site locations are never ingested, stored or republished, and a fail-closed restricted-register gate in CI enforces it. Duty-of-care notices appear on every page, and on-ground signage and temporary closures override every page. A lawful verdict is about tenure and does not rate safety.
More of our own products
What's next
Complex data, hard guarantees?
Public Trails turns scattered official records into computed, evidence-graded answers. If your domain needs the same rigour, see how we approach platform engineering, data analysis and insight platforms and system integration.
Want a platform like this for your business?
Tell us what you're building. We'll come back within one business day with what we'd do first and what it would take.