---
type: CaseStudy
title: 'Public Trails: Lawful Access, Computed from Official Records'
description: How National Digital built publictrails.au - a provenance-graded spatial pipeline that computes whether you can lawfully visit a wild place, and by which route.
resource: https://nationaldigital.com.au/case-studies/public-trails/
tags:
  - spatial data analysis
  - geospatial application development
  - open government data integration
  - interactive mapping development
  - Spatial data
timestamp: '2026-08-19T00:00:00.000Z'
language: en-AU
publisher: National Digital
author: Cameron Young
authorRole: CEO
datePublished: '2026-08-19'
dateModified: '2026-08-19'
canonical: https://nationaldigital.com.au/case-studies/public-trails/
---

_Home — Recent Work — Public Trails: Lawful Access, Computed from Official Records_

# Public Trails: Lawful Access, Computed from Official Records

*Case study · Spatial data / public interest*

## Can I lawfully go there? A question answered by computation, not opinion

**At a glance**

- Industry: Spatial data / public interest
- Engagement type: In-house product
- First release: 2026
- Team: National Digital engineering team

[Digital Product Development](/digital-product-development) · [Platform Engineering](/platform-engineering)

### The challenge

Whether land is lawfully accessible is scattered across cadastre, protected-area estates, Crown road reserves and easements - records that were never designed to be read together, and where a wrong answer sends someone onto private land. Community data knows the names; only official records know the law.

### What we built

A deterministic pipeline over official spatial records with a provenance grade on every fact, versioned inference rules, and a verdict ladder that computes the lawful route - or refuses to publish one, with reasons - for every place in a region.

Python pipeline with per-jurisdiction source adapters over a common schema; corridor solving across parcel chains; one-to-one name pairing that quarantines OpenStreetMap (ODbL) data to naming only; golden fixtures that pin computed routes against hand-checked ground truth; a static TypeScript front end with PMTiles and MapLibre; fail-closed licensing and restricted-register gates in CI.

**Workstreams:**
- Per-jurisdiction spatial adapters over a common schema - analysis code never sees a state
- Provenance grading A-D with community data quarantined from the legal evidence chain
- Corridor solver: lawful multi-parcel routes via easements and Crown road reserves
- Verdict ladder with refusal - no route is published where tenure cannot be confirmed
- Golden fixtures pinning computed routes against hand-checked ground truth
- Static site with PMTiles + MapLibre; deterministic, fail-closed pipeline in CI

### The outcome

The live pilot covers the Gold Coast Hinterland with real Queensland data end to end: 109 places, 435 routes and 549 published pages, each carrying its verdict tier, evidence chain and emergency reference. Where the data could not support a verdict, the site says so - 58 candidate routes were refused with reasons rather than published on a guess. The hand-checked golden route agrees with the computed one to within 30 centimetres.

### Where it went next

The jurisdiction-proof core - a common schema with per-state adapters - is the point: covering a new state is an adapter and a source manifest, not a rebuild. Aboriginal cultural heritage site locations are never ingested, stored or republished; statutory duty-of-care notices are carried on every page.

**The stack:** Python, TypeScript, PMTiles, MapLibre, Cloudflare Pages

_This case study describes a live product designed and built by National Digital. Figures describe the shipped pilot region; on-ground signage and temporary closures override every published page, by design._

## Architecture

- **Delivery** — Static pages, PMTiles + MapLibre
- **Verdict engine** — Versioned inference rules
- **Common schema** — Per-jurisdiction adapters
- **Official records** — Cadastre, estates, reserves, easements
- **Pipeline & CI gates** — Deterministic, fail-closed

- **58** — Routes refused, with reasons, rather than guessed
- **435** — Routes published, each traced to an official record
- **30 cm** — Agreement with the hand-checked route
- **A-D** — Provenance grade carried on every fact

> The hardest feature in Public Trails is refusal. Fifty-eight routes in the pilot are not published, with reasons, because the official records could not prove lawful access - and that restraint is exactly what makes the 435 routes we do publish worth trusting. When your product makes claims about the law, 'probably fine' is not a verdict.

— Cameron Young, CEO at National Digital

- Verified review

*Key Takeaways*

## Why a system that refuses to answer is more trustworthy

Public Trails computes whether a wild place can be lawfully visited, and by which route, from official spatial records alone. Every fact is provenance-graded, a verdict inherits the weakest grade in its evidence chain, and where tenure cannot be confirmed nothing is published.

- **Refusal is the load-bearing feature: 58 pilot routes were withheld with reasons rather than guessed.** A verdict ladder that can return no lawful route is what makes the 435 published routes credible. Without the ability to decline, every answer would carry the same unearned confidence and a reader could not tell the difference. _Critical_
- **A verdict is only as strong as the weakest link in its evidence chain, and that grade is published.** Facts are graded from gazetted register down to community record, and the verdict inherits the lowest grade it depends on. Confidence is therefore computed from provenance rather than asserted by the system after the fact. _Critical_
- **Community data is quarantined to naming, so it can never influence a legal conclusion.** OpenStreetMap contributes toponyms under ODbL terms through one-to-one pairing with official features. It is structurally excluded from access reasoning, which keeps every legal claim traceable to official sources only. _Critical_
- **Per-jurisdiction adapters over a common schema mean covering a new state is configuration, not a rebuild.** Source adapters normalise each jurisdiction's data at the boundary, so corridor solving, provenance grading and the verdict ladder never encode state-specific logic and are written and tested exactly once. _Important_
- **Golden fixtures against hand-checked ground truth let the inference rules improve safely.** The pilot's golden route agrees with the computed route to within 30 centimetres, and any rule change that moves a known-good route fails CI. Correctness already achieved cannot be silently regressed by a later improvement. _Important_

## Questions decision-makers ask about this build

### How can software answer a legal question about land access?

It does not give legal advice - it computes what the official records support and grades its own confidence. Cadastre, protected-area estates, Crown road reserves and easements are read together under versioned inference rules, and each route receives one of four verdicts: formal track, public estate, corridor with conditions, or no lawful route. A verdict's confidence is the weakest provenance grade in its evidence chain.

### Why is refusing to answer treated as a feature?

Because the alternative sends someone onto private land. Where lawful tenure cannot be confirmed, no route is published at all - 58 candidate routes in the pilot were refused with reasons rather than published on a guess. The 435 routes that are published are only worth trusting because the system is willing to publish nothing; a product that always has an answer cannot signal when it should not.

### How is community data such as OpenStreetMap used without contaminating the legal chain?

It is quarantined to naming only. Community records know what places are called; official records know the law. OpenStreetMap data is paired one-to-one with official features for toponyms under its ODbL terms and graded at the bottom of the A-to-D provenance scale, so it can never contribute to an access verdict. An evidence chain for a legal claim contains only gazetted and official sources.

### What makes this extend to another state without a rebuild?

A common schema with per-jurisdiction source adapters, so the analysis code never sees a state. Each jurisdiction's cadastre, protected-area estates and road-reserve data is normalised at the adapter boundary, which means corridor solving, provenance grading and the verdict ladder are written once and reused. Covering a new state is an adapter and a source manifest, not a second system.

### How do you know the computed routes are actually right?

Golden fixtures pin computed routes against hand-checked ground truth, and the pilot's golden route agrees with the pipeline's computed route to within 30 centimetres. Any change to the inference rules that moves a known-good route fails continuous integration, so the rules can keep improving without silently breaking answers that were already correct and already published.

### How are cultural heritage and safety obligations handled?

Aboriginal cultural heritage site locations are never ingested, stored or republished, and a fail-closed restricted-register gate in continuous integration enforces that rather than a policy document. Statutory duty-of-care notices are carried on every page, and on-ground signage and temporary closures override every published page by design. The site supports planning; it is never the authority at the gate.

## More of our work

- [Surgery Waits: Comparable Hospital Waiting Times](/case-studies/surgery-waits/) — Health data
- [how2vote.au: A Provably Neutral Voting Tool](/case-studies/how2vote/) — Civic technology

*What's next*

## Complex data, hard guarantees?

Public Trails turns scattered official records into computed, evidence-graded answers. If your domain needs the same rigour, see how we approach [data analysis and insight platforms](/ai-automation/data-analysis-and-insights) and [system integration](/platform-engineering/system-integration), part of our wider [custom software development](/digital-product-development) work.

## Want a platform like this for your business?

Tell us what you're building. We'll come back within one business day with what we'd do first and what it would take.

- [Book a call](https://calendly.com/cameron-at-national-digital/discovery)
- Email: enquiries@nationaldigital.com.au
- Phone: 1300 800 855

## Related

**Parent:**
- [Real platforms, in production.](/okf/case-studies.md)

**Related:**
- [NRMA Parks & Resorts: WordPress to Contentful Migration](/okf/case-studies/nrma-parks-and-resorts.md)
- [Luxico & Staylonger: One Property Management Platform](/okf/case-studies/luxico.md)
- [MyStrengths: Student Assessment Platform](/okf/case-studies/mystrengths.md)
- [Gratofy: Custom E-commerce Marketplace](/okf/case-studies/gratofy.md)
- [Micro-X: Operator and Passenger Interfaces for Imaging Hardware](/okf/case-studies/micro-x.md)
- [how2vote.au: A Provably Neutral Voting Tool](/okf/case-studies/how2vote.md)
- [Surgery Waits: Comparable Hospital Waiting Times](/okf/case-studies/surgery-waits.md)
- [Booking systems built around your operation.](/okf/booking-systems.md)
- [Custom software, built by senior engineers.](/okf/custom-software.md)
- [AI that survives contact with production.](/okf/ai-automation-services.md)
- [FreeCamps: Where You Can Lawfully Stay, Traced to the Source](/okf/case-studies/freecamps.md)
- [publicdata.au: Versioned Government Open Data, Ready for AI Agents](/okf/case-studies/publicdata.md)
- [AI Visibility Management](/okf/services/ai-visibility-management.md)