Inventory
Manager view starts with status.
Available, checked out, total keys, notifications, search, and bottom navigation make the system scannable.
The problem
KeyAudit
The old key process depended on paper. When multiple keys were checked out, managers had no live custody state, no return proof, and no clean way to explain which handoff failed. This is the problem KeyAudit fixes.
Multiple
Keys can go out at once with no reliable live status.
Paper
Sign-out sheets record intent, but they do not enforce return.
Missing
When a key disappears, the evidence is scattered or incomplete.
This was the risk.
A paper sheet can say a key was signed out, but it cannot prove custody, enforce return, or explain multiple missing keys.
My fix
KeyAudit turns the paper sheet into a control surface.
I rebuilt the workflow as a small custody system: every key gets a state, every return gets a manager confirmation, and every exception can be reviewed later.
What changed
My fix makes physical keys behave more like tracked access assets. A key can be assigned, requested back, verified by a manager, overridden when needed, and exported into an audit record.
1
Clear ownership
Every active key has a visible holder, timestamp, elapsed time, and custody state.
2
Return code handshake
The person returning the key receives a one-time code, and the manager confirms it before custody closes.
3
Manager controls
Override and assignment actions are separated from the user return flow.
4
Audit export
Returned, pending, and override records can leave the app as a human-readable report.
Security model
Built for accountability, not theater.
For cyber and operations people, the interesting part is not that it looks clean. It is that the interface reduces ambiguity in a physical access workflow where informal handoffs usually become the weak point.
Control
Chain of custody
KeyAudit makes possession, return request, manager confirmation, and final status separate events.
Separation
Role-aware return
The holder can initiate return, but the manager closes the loop after receiving the physical key.
Exception
Override path
Manager override exists as an explicit operational path instead of a hidden backdoor in the process.
Evidence
Exportable record
Returned, override, pending, duration, and timestamps become reviewable outside the phone.
Product proof
The app now explains its own audit trail.
These screens show the full loop: inventory, active custody, one-time code, manager verification, confirmation, and export. The Apple recording/status chrome has been cropped away so the workflow is the focus.
Custody
Checked-out keys stay visible.
The app records who has the key, when it left, how long it has been out, and what action comes next.
Handshake
Return requires a shared code.
The user requests return, receives a one-time code, and remains assigned until the manager confirms receipt.
Verification
Manager closes the loop.
The manager receives the physical key, enters the four-digit code, and turns the pending return into a confirmed record.
Closure
The result is legible.
Key number, holder, date, logged time, return request, returned time, and total duration are presented together.
The export matters because phones are not the audit boundary.
A cyber-minded reviewer should be able to ask: who had the asset, what state was it in, what exception path happened, and what evidence can be retained? KeyAudit answers those questions without requiring a manager to reconstruct the shift from memory.
Progress
From checklist to control surface.
The progress is visible in the workflow itself: the app moved from capturing names and keys to modeling custody as a sequence of events with proof, roles, and recoverable exceptions.
01
Paper baseline
A manual sheet defined the basic need: name, key number, sign-out, sign-in, and key check.
02
Digital inventory
The keys became cards with searchable availability, status filters, and manager visibility.
03
Return protocol
The handoff became a two-party loop: request return, show code, receive key, confirm code.
04
Audit evidence
The system now records duration, return state, override status, retention, and printable activity logs.
KeyAudit is small on purpose. It does not try to be a full identity platform. It takes one risky physical workflow and gives it the controls people expect from serious systems.
Custody state
Explicit
Return proof
Code verified
Exception path
Manager visible
Review artifact
Exportable