Synthetic teaching example for a website delivery brief. Not a client result, live account test or certification.
A public form should not become a public records portal
For a Victorian owners corporation manager commissioning a website, the useful design decision is how a records request reaches an authorised reviewer. It is not how to make every requested document downloadable immediately. A visitor selecting “lot owner” has made a claim, not proved authority.
| Intake field | Fictional example | Next step |
|---|---|---|
| Requested record | Meeting minutes | Reviewer identifies the specific record |
| Claimed role | Lot owner | Authority evidence not yet checked |
| Purpose | Review a maintenance decision | Do not infer a right to export the register |
| Delivery | Private reviewed channel | No automatic attachment or public link |
Use the filled example
Download the finite Node checker and filled input. Run with Node 24 or newer; no account, API or network is used.
node checks.mjs oc-record-request-intake oc-record-request-intake.jsonThe output is MANUAL_AUTHORITY_AND_PRIVACY_REVIEW, automaticAccessGranted false and commercialRegisterExportAllowed false. That last field is a safety boundary in this teaching model, not a legal ruling about every applicant. The model does not apply eligibility tests, calculate fees or decide which redactions are lawful.
Commission the workflow, not a legal shortcut
Ask the supplier to separate the acknowledgement from the reviewer’s decision. Give the reviewer a request reference, claimed relationship and requested record category without placing sensitive evidence in a public inbox or URL. The authorised records process should define identity checks, access controls, decision ownership, delivery and an auditable response. Avoid requesting identity documents through an ordinary marketing enquiry attachment.
Test the case where a requester asks for the whole register for commercial use. The site should route that request for specific review rather than treat a selected role as permission. A denied or incomplete request must not trigger a publicly cached document link. Actual legal obligations and applicant rights need the responsible manager’s current advice.
This example opens no records and changes no permissions. It covers intake, not a management transfer. For the separate handover of website and operational evidence, see the existing owners corporation handover scenario.
Primary facts and limits
Consumer Affairs Victoria: records: Describes written requests, register access and specific commercial-use/privacy boundaries. This guide is workflow design, not legal advice.
Sources reviewed 15 October 2026. The supplied input and acceptance rules are original teaching design; check current platform versions and your actual delivery contract before implementation.
Review attachment handling before collecting private evidence