GuardCore · Rostering & time
Rostering that refuses the guard it ought to refuse
Eligibility worked out live for the shift date from the licences on file — never from a stored score that has gone stale — and the licence class the shift asks for checked, not just that a licence exists.
The problem this solves
Putting an unlicensed guard on a shift is the one rostering mistake in this industry that is not a scheduling problem. It is a regulatory one, and it happens because the check lives somewhere other than the save button: a compliance score computed last night, a spreadsheet of expiries, a supervisor who knows.
GuardCore evaluates it at the save, for the date of that shift, from the licences on file — and deliberately does not read the stored compliance score, because a score is a fact about when it was computed. All five paths that can place a guard on a shift go through the same evaluation, including both legs of a swap, checked before either leg is written.
The class matters as much as the licence. Where a shift or its template names a required class, the guard must hold that class. Alongside it, five configurable conflict rules — double booking, which is always on whatever the configuration says; minimum rest, which can come from the pay instrument’s own rest hours; expired licence; required class; incomplete onboarding, with the rule that the person who waived a blocking item may not be the person whose save it unblocks. A warning-level rule can be overridden with a reason, and the audit event carries the reason.
On the pay side there is one thing to be clear about, because it is a decision rather than a gap: there is no award interpreter. GuardCore records time worked — rostered, actual and approved, all three kept — and exports it. It does not compute what anyone is owed.
Worked example
A supervisor drags a guard onto a Saturday night shift that requires a specific licence class.
- 1
The licences are read for that date
From the licence register and from the guard’s own row, evaluated live. A licence that expires on the Friday fails the Saturday shift.
- 2
The class is resolved
From the shift, or from the template it was generated by, and matched against the classes the guard actually holds.
- 3
The save is refused
With a named refusal and a human reason — not a warning banner over a shift that saved anyway.
- 4
A warning-level conflict can be overridden
With a reason, which the audit event then carries. A blocking one cannot be overridden at all.
The roster is the compliance control, so the compliance report and the roster cannot disagree.
Capabilities
What rostering & time gives you
All 7 of these are in the product today. Each one names what it is built on.
Recurring rosters that leave the shift open
LiveA weekly template generates shifts across a horizon you set, overnight shifts included, and generates them unassigned — because deciding who works is a person’s job and generating a name is how a roster stops being trusted.
The roster refuses an unlicensed guard
LiveEligibility is worked out live for the shift date from the licences on file, never from a stored score that could be stale — and where the shift asks for a licence class, the guard must hold that class and not merely a licence.
Double-booking, rest and onboarding, refused at the save
LiveFive configurable rules — double booking, which is always on; minimum rest; expired licence; required licence class; incomplete onboarding — refusing the save, with a warning-level rule overridable only with a reason the audit event then carries.
Open shifts and swaps
LiveAn unfilled shift offered to a group, applied for, and filled — and a swap between two guards written as one transaction where both legs are checked against the gates before either is saved.
Rostered, actual and approved, all kept
LiveThree windows per shift, separately retained, so a correction changes what will be paid without overwriting what happened — and the variance between rostered and actual is typed per direction rather than flagged as "different".
Hours leave once, and are locked behind them
LiveApproved hours export to a nine-column CSV under a lock: the period can only export once, each hour is marked exported in the same transaction, and every line keeps its own snapshot. There is no award interpreter — this records time worked and hands it over.
No clock-on with an unread post order
LiveA guard cannot clock on at a site with an approved post order they have not acknowledged. The refusal names the document, so the fix is reading it rather than finding a supervisor.
What backs these claims
Each capability names the decision record, module, route or table it is built on. Ask us for any of them in an evaluation and we will walk you through the code.
- Recurring rosters that leave the shift open
- ADR 0021 · src/server/imss-roster-recurrence.ts plannedDates · src/server/imss-jobs/roster-generation.ts · POST /api/imss/roster-templates · imss_roster_shifts
- The roster refuses an unlicensed guard
- ADR 0004 · src/server/imss-roster-rules.ts evaluateRosterability assertGuardRosterable · src/server/imss-licence-classes.ts resolveRequiredLicenceClass
- Double-booking, rest and onboarding, refused at the save
- src/server/imss-roster-conflict-rules.ts · imss_conflict_rules · /imss/roster
- Open shifts and swaps
- GET /api/imss/open-shifts · POST /api/imss/shift-swaps · POST /api/imss/mobile/shift-swaps · imss_open_shifts · /imss/shift-swaps
- Rostered, actual and approved, all kept
- src/server/imss-timesheet-entry.ts payableHours · src/server/imss-timesheet-variance.ts · imss_timesheets · /imss/timesheets
- Hours leave once, and are locked behind them
- ADR 0018 · src/server/imss-payroll-export.ts lockApprovedTimesheets · imss_timesheet_exports · /imss/payroll-export
- No clock-on with an unread post order
- src/server/imss-post-order.ts outstandingAtSite · src/server/api/imss/mobile/POST.ts · POST /api/imss/mobile/post-orders
Where this sits
Back to
GuardCore — every capability in one place
The whole module: what is live, and what is only on the roadmap.
Read next
Licences, SWMS, and an audit trail that shows tampering
Four expiry bands swept in the background, licence classes catalogued across eight Australian jurisdictions, and every write hash-chained per organisation under a constraint that makes a forked chain impossible.
Twenty minutes on a real contract.
Real data, four logins, nothing typed on the day — including the parts we have not built, which we will point out ourselves.