title: "Use Case: Nesto Worker Onboarding Compliance"
eyebrow: Use Cases / Nesto
version: UC1-NESTO-v2.0
date: 2026-05-07
owner: Uued Viljapuuaiad
status: Active
authority: Tier 2
sub: >
Worker onboarding compliance platform for Gulf-region employers. Automates
document collection, Atlas OCR extraction, 17-rule compliance validation,
HR approval gates, and multi-government API forwarding (MoHRE UAE, eMigrate
India, POLO Philippines) for foreign workers from PH, IN, BD, PK.
Section 01 -- Overview [M]
| Field | Value |
|---|---|
| Use Case ID | UC1-NESTO |
| Client Reference [M] | CZ-NST-2026-04-001 |
| System Name [M] | Nesto |
| Domain [M] | HR Technology / Worker Onboarding / Compliance Automation |
| One-Line Description [M] | Automated worker onboarding compliance platform: document collection, OCR extraction, 17-rule validation, HR approval gate, and parallel government API forwarding for Gulf-region employers hiring from Philippines, India, Bangladesh, and Pakistan. |
| Status [M] | Development -- pipeline graph complete, demo queued |
| Target Delivery [M] | Q3 2026 (demo-complete) |
Summary [M]
Nesto is a worker onboarding compliance platform for Gulf-region employers. It automates the intake of foreign workers from Philippines, India, Bangladesh, and Pakistan -- handling document collection, OCR extraction, compliance rule validation, HR approval gates, and multi-government API forwarding (MoHRE UAE, eMigrate India, POLO Philippines).
The problem: employers onboarding workers must collect 6-8 documents per worker, validate country-specific compliance rules, and register with up to 3 government systems. Current process relies on HR email and Excel tracking with no audit trail. Processing time: 3-5 days per worker.
The Nexus solution: worker submits one ChameleonV2 form. Documents uploaded directly. Atlas OCR extracts fields. Nexus validates 17 compliance rules in seconds. HR Manager sees a simplified decision form. On approval, all government API calls fire automatically. Processing time: under 15 minutes. Full audit trail in deltaPrism.
Section 02 -- Actors [M]
| Role [M] | Description [M] | Access Level [D] | Frequency [D] |
|---|---|---|---|
| Worker | Foreign worker being onboarded. Fills self-service form, uploads documents. | Own record only (self-service portal) | Once per onboarding |
| HR Admin | Back-office operator. Creates worker records, manages document checklists, handles validation failures. | All workers in own employer org | Daily |
| HR Manager | Approves or rejects worker onboarding at the human gate. Reviews compliance summary. | All workers in own employer org (decision authority) | As queue demands |
| Document Admin | Reviews low-confidence OCR extractions. Corrects OCR errors. | Document entities only | As flagged by system |
| Operations Lead | Escalation point for HR Manager decisions. Monitors pipeline throughput. | All workers, read-only + escalation | Weekly |
| Compliance Officer | Audits completed onboardings. Views full timeline and all decisions. | All records, read-only (audit variant) | Monthly |
| System Administrator | Configures pipelines, manages org settings, user roles. | Full system access | As needed |
Section 03 -- User Stories [M/D]
Actor: HR Admin
- P1 [M]: As an HR Admin, I want to submit a new worker record with 10 fields, so that the onboarding pipeline starts automatically.
- P1 [M]: As an HR Admin, I want to see which documents are missing per worker, so that I can chase the worker or upload on their behalf.
- P1 [M]: As an HR Admin, I want to receive notification when compliance validation fails, so that I can review the specific failures and take action.
- P2 [D]: As an HR Admin, I want to filter the worker queue by status, so that I can prioritise pending items.
Actor: Worker
- P1 [M]: As a Worker, I want to upload my documents via a self-service link, so that I do not need to visit the employer office.
- P2 [D]: As a Worker, I want to see my onboarding status, so that I know what stage I am at.
Actor: HR Manager
- P1 [M]: As an HR Manager, I want to review the compliance summary and approve or reject a worker, so that only compliant workers proceed to government registration.
- P1 [M]: As an HR Manager, I want to request more information from a worker, so that incomplete cases return for additional documents.
- P2 [D]: As an HR Manager, I want an SLA indicator on my decision queue, so that I can meet the 1-business-day decision target.
Actor: Compliance Officer
- P2 [D]: As a Compliance Officer, I want to view the full audit trail for any worker onboarding, so that I can verify process integrity.
Section 04 -- System Flows [M/D]
Flow: Worker Onboarding (9-step pipeline) [M]
Trigger [M]: HR Admin submits worker record via ChameleonV2 form.
| # | Step [M] | Actor [M] | Input [M] | Output [D] | Decision [M] |
|---|---|---|---|---|---|
| 1 | form-create | HR Admin | 10-field worker form | NestoWorker entity (Draft) | -- |
| 2 | form-docs | Worker / HR Admin | Document uploads (PDF/JPEG/PNG) | Document entities per file | All required docs present? |
| 3 | ocr | System (Atlas) | Document images | OCR fields + confidence per doc | Confidence >= 0.85? |
| 4 | validate | System (Engine) | Worker data + OCR fields | ValidationResult (17 rules) | All rules pass? |
| 5 | store-worker | System | Validated worker + results | deltaPrism entities | -- |
| 6 | hr-gate | HR Manager | Compliance summary + documents | HRDecision (approve/reject/requestInfo) | Approve? |
| 7 | store-decision | System | HRDecision | deltaPrism entity | -- |
| 8 | notify | System | Decision outcome | Email + SMS to worker + HR Admin | -- |
| 9 | forward (x3) | System | Worker data | ForwardResult per API (MoHRE/eMigrate/POLO) | -- |
Result [M]: Worker status = Complete. Government reference IDs stored. Full audit trail in deltaPrism.
Exceptions [D]:
- OCR confidence < 0.85: Document Admin notified for manual review.
- Validation fails: HR Admin notified with specific rule failures. Worker remains InValidation.
- HR Manager rejects: Pipeline terminates. Worker status = Rejected. All parties notified.
- HR Manager requests more info: Pipeline returns to form-docs step. Worker re-uploads.
- Government API error: ForwardResult records error. Government Liaison notified.
SLA [D]: Target end-to-end: < 15 minutes (excluding HR gate wait). HR gate SLA: 1 business day.
Volume [M]: 50-200 workers per month per employer.
Data Persistence [M]
| Question [M] | Answer |
|---|---|
| Data lifecycle | Ingest-store. Worker records and documents persist permanently. Government references stored. |
| Sync cursor | Pipeline run_id per worker. Each step advances sequentially. |
| Deduplication key | passport_number (BR-16: no duplicate active workers with same passport) |
| Refresh frequency | Never. Worker data ingested once, not re-fetched. Government APIs called once on approval. |
| Storage target | deltaPrism for all 5 entity classes. Document files in secure storage with file_ref pointer. |
Section 05 -- Data Model [M/D]
Entities
| Entity [M] | Description [M] | Key Fields [M] | States [D] | Relationships [D] |
|---|---|---|---|---|
| NestoWorker | Worker record | worker_id, name, nationality, passport_number, passport_expiry, visa_type, employer_name, contract_start_date, status, run_id | Draft, DocumentsPending, InValidation, PendingReview, Approved, Rejected, Forwarded, Complete | 1:N Document, 1:1 HRDecision, 1:N ForwardResult, 1:N ValidationResult |
| Document | Uploaded document with OCR | doc_id, worker_id, doc_type, file_ref, ocr_fields, ocr_confidence, upload_timestamp | Uploaded, OCRProcessed, OCRFlagged | N:1 NestoWorker |
| HRDecision | HR Manager approval/rejection | decision_id, worker_id, decision, reviewer_user_id, note, timestamp | -- (immutable) | 1:1 NestoWorker |
| ForwardResult | Government API response | forward_id, worker_id, endpoint, response_status, reference_id, timestamp | -- (immutable) | N:1 NestoWorker |
| ValidationResult | Compliance check output | result_id, worker_id, run_id, overall_status, rule_results[], timestamp | -- (immutable) | N:1 NestoWorker |
Business Rules [M/D]
| ID | Rule [M] | Trigger [D] | On Violation [D] |
|---|---|---|---|
| BR-01 | passport_not_expired: Expiry > today + 6 months | Validation step | Fail. HR Admin notified. |
| BR-02 | medical_valid: Medical certificate < 12 months old | Validation step | Fail. |
| BR-03 | polo_required_if_ph: Philippine nationals must have POLO clearance | Validation step | Fail if PH and missing. NA otherwise. |
| BR-04 | all_docs_present: All required documents for nationality uploaded | Document upload step | Block pipeline advancement. |
| BR-05 | fit_to_work: FitToWork = true | Validation step | Fail. |
| BR-06 | ocr_passport_match: OCR passport number matches HR Admin input | Validation step | Fail. Document Admin notified. |
| BR-07 | hr_decision_sla: HR Manager must decide within 1 business day | HR gate | SLA warning to Operations Lead. |
| BR-08 | contract_start_future: contract_start_date > today | Validation step | Fail. |
| BR-09 | visa_type_valid: Must be work_visa, visit_visa, or transit | Validation step | Fail. |
| BR-10 | emigrate_required_if_in: Indian nationals need eMigrate registration | Validation step | Fail if IN and missing. NA otherwise. |
| BR-11 | bmet_required_if_bd: Bangladeshi nationals need BMET clearance | Validation step | Fail if BD and missing. NA otherwise. |
| BR-12 | beoe_required_if_pk: Pakistani nationals need BE&OE clearance | Validation step | Fail if PK and missing. NA otherwise. |
| BR-13 | photo_icao_compliant: Passport photo required (all nationalities) | Validation step | Fail. |
| BR-14 | medical_fit_to_work: fit_to_work field must be true | Validation step | Fail (not just present). |
| BR-15 | mohre_14day_contract: MoHRE registration within 14 days of entry | Post-forwarding | Warning to Operations Lead. |
| BR-16 | duplicate_worker_check: No active worker with same passport_number | Form submission | Fail. Duplicate flagged. |
| BR-17 | document_expiry_margin: All docs valid >= 30 days from submission | Validation step | Fail. |
Section 06 -- Screens [D]
| Screen [D] | Actor [M] | Purpose [D] | Key Elements [D] |
|---|---|---|---|
| Worker Onboarding Form | HR Admin | Submit new worker record | 10 input fields, nationality dropdown, date pickers |
| Document Upload Portal | Worker / HR Admin | Upload required documents per nationality | File upload, checklist with green/red indicators, completeness bar |
| Worker Queue | HR Admin | View and filter all workers by status | Table with status column, filters, search |
| Decision Form | HR Manager | Review compliance + approve/reject | Compliance summary (17 rules), document thumbnails, decision radio, note textarea, SLA indicator |
| Audit Trail View | Compliance Officer | Full onboarding timeline | Chronological event list, entity links, decision details |
| Dashboard | Operations Lead | Pipeline throughput overview | Worker counts by status, SLA compliance, forwarding success rate |
| Navigation Sidebar | All | Org navigation | 4 sidebar items: Dashboard, Worker Onboarding, Queue, Audit |
Section 07 -- Integrations [M]
| System [M] | Direction [M] | Data [M] | Format [D] | Frequency [M] | Fallback [D] |
|---|---|---|---|---|---|
| Atlas OCR | Internal | Document images -> extracted fields + confidence | Internal API | Per document upload | Flag for manual review |
| MoHRE (UAE) | Outbound | Worker data -> work permit registration | REST API | Per approved worker | Queue + retry. Government Liaison notified. |
| eMigrate (India) | Outbound | Worker data -> emigration clearance | REST API | Per approved Indian worker | Queue + retry. |
| POLO/FEIMS (Philippines) | Outbound | Worker data -> POLO verification | REST API | Per approved Filipino worker | Queue + retry. |
| deltaPrism | Internal | All 5 entity classes | Entity store API | Every pipeline step | Hard dependency (no fallback). |
| ChameleonV2 | Internal | Form schemas -> rendered forms | Schema-driven | User interaction | Hard dependency. |
| Email SMTP | Outbound | Notifications to workers + HR | SMTP | Per pipeline event | Queue + retry. |
| SMS Gateway | Outbound | Notifications to workers | API | Per pipeline event | Queue + retry. |
Section 08 -- Infrastructure [D]
| Layer | Choice [D] | Reason [D] |
|---|---|---|
| Hosting | Docker (Nexus standard) | Consistent with all Nexus orgs |
| Entity Store | deltaPrism v1.2.0 | Graph entity storage with audit trail |
| Form Renderer | ChameleonV2 v2.1.0 | Schema-driven, role-variant forms |
| Rule Engine | Wormwood v1.4.4 | 17 compliance rules, configurable per nationality |
| OCR Engine | Atlas | Document field extraction |
| Runtime | Python 3.11 + Node.js | Backend + frontend standard |
Constraints [M]
- Data residency: UAE required (worker PII must be stored in UAE region).
- Document retention: 7 years for compliance documents (enforced via retention_days = 2555).
- Governing law: England and Wales.
Section 09 -- Critical Path [D]
| # | Item [D] | Depends On | Duration [D] | Blocker Risk [D] |
|---|---|---|---|---|
| 1 | Pipeline graphs designed + seeded | -- | Complete | Low |
| 2 | Entity class schemas defined | #1 | Complete | Low |
| 3 | ChameleonV2 form variants (4 roles) | ChameleonV2 v2.1.0 | In development | MEDIUM -- blocking |
| 4 | Atlas OCR integration (passport, medical, clearances) | Atlas engine | Available | MEDIUM -- integration testing |
| 5 | 17 compliance rules in Wormwood | #2 | Rule design complete | LOW |
| 6 | HR gate + RBAC | #3 | Architecture designed | MEDIUM |
| 7 | Government API integration (MoHRE, eMigrate, POLO) | #1 | Mock available | HIGH -- external dependency |
| 8 | Navigation menu fix (Andy feedback) | #1 | Pending | LOW |
Milestones [D]
| Milestone | Reached When | Target Date |
|---|---|---|
| M1: Pipeline operational | 9-step pipeline runs end-to-end with test data | Q2 2026 |
| M2: Demo ready | ChameleonV2 forms render, compliance rules fire, HR gate works | Q3 2026 |
| M3: Government API integration | At least MoHRE live endpoint tested | Q3 2026 |
Section 10 -- What Is Needed [M]
| # | Item [M] | From [M] | Blocking [M] | Status [M] |
|---|---|---|---|---|
| 1 | ChameleonV2 form renderer (4 role variants) | UV (ChameleonV2 team) | Yes | In Development |
| 2 | Atlas OCR engine (4 document types) | UV (Atlas team) | Yes | Available (integration pending) |
| 3 | Government API specifications (MoHRE, eMigrate, POLO) | Nesto Group | Yes | Pending |
| 4 | Andy navigation feedback implementation | UV | No | Pending |
| 5 | UAE data residency infrastructure | UV (DevOps) | Yes | Planned |
| 6 | Andy/Nesto Group sign-off on demo | Nesto Group | No | Pending |
Section 11 -- Acceptance Criteria [M/D]
Definition of Done [D]
| Criterion [D] | Verified By [D] |
|---|---|
| 9-step pipeline runs end-to-end with test worker data | Pipeline execution test |
| 4 ChameleonV2 form variants render per role | Browser test per role |
| 17 compliance rules fire and produce correct pass/fail | Per-rule unit test |
| HR gate pauses pipeline and resumes on decision | Integration test |
| Government API forwarding returns reference IDs | Mock API test (live deferred) |
| All 5 entity classes stored in deltaPrism with audit | Entity store query verification |
| Document retention enforced (2555 days for documents) | Configuration check |
Success Metrics (30/60/90 days) [M]
| Metric [M] | Target [M] | Measured By [D] |
|---|---|---|
| Worker onboarding time (end-to-end excluding HR gate) | < 15 minutes | Pipeline execution timer |
| Compliance validation accuracy | 100% (all 17 rules correct) | Test suite |
| Government forwarding success rate | > 95% | ForwardResult status tracking |
| HR gate SLA compliance | > 90% decisions within 1 business day | SLA timer vs decision timestamp |
Section 12 -- Risks [D]
| # | Risk [D] | Likelihood [D] | Impact [D] | Mitigation [D] |
|---|---|---|---|---|
| R1 | Government API specifications unavailable or changing | M | H | Mock APIs for demo. Live integration deferred to post-sign-off. |
| R2 | Atlas OCR accuracy below 0.85 for non-Latin scripts (Arabic names) | M | M | Fallback to manual review for low-confidence extractions. |
| R3 | UAE data residency requirement blocks standard Docker deployment | L | H | Plan UAE region infrastructure before production. |
| R4 | Andy/Nesto Group feedback delays demo timeline | M | M | Build demo-ready state independently. Schedule feedback round. |
| R5 | POLO/eMigrate API downtime during live onboarding | M | H | Queue + retry. Store ForwardResult with error status. Government Liaison manual fallback. |
Open Questions [M]
| # | Question [M] | Impacts [D] | Resolution [M] |
|---|---|---|---|
| Q1 | Exact MoHRE API endpoint and authentication method? | Government forwarding integration | Awaiting Nesto Group |
| Q2 | eMigrate API specification (India)? | Indian worker forwarding | Awaiting Nesto Group |
| Q3 | POLO/FEIMS API specification (Philippines)? | Filipino worker forwarding | Awaiting Nesto Group |
| Q4 | Worker self-service portal: mobile-first or desktop? | ChameleonV2 form design | Awaiting Andy feedback |
Section 13 -- Cooperator Brief [D]
| Field | Value |
|---|---|
| Scope [D] | 9-step worker onboarding pipeline with 4 ChameleonV2 form variants, 17 compliance rules, Atlas OCR integration, HR approval gate, and 3 government API forwarding endpoints. |
| Stack [D] | Nexus Core, ChameleonV2 v2.1.0, deltaPrism v1.2.0, Wormwood v1.4.4, Atlas OCR, Docker. |
| Timeline [D] | M1 (pipeline operational): Q2 2026. M2 (demo ready): Q3 2026. M3 (government API live): Q3 2026. |
| Dependencies [D] | ChameleonV2 form renderer, Atlas OCR engine, Government API specs from Nesto Group. |
| Interfaces [D] | Receives: worker data via ChameleonV2 forms, document uploads. Delivers: compliance results, government reference IDs, audit trail. |
| Quality Bar [D] | 17 compliance rules with per-rule unit tests. End-to-end pipeline test with test worker data. Browser test for all 4 form variants. |
| Handover [D] | Pipeline seed scripts, entity schemas, compliance rule definitions, ChameleonV2 form schemas, government API integration specs, test data fixtures. |
Pipeline Manifest
nesto-nav-menu
Navigation sidebar for Nesto org. 4 items: Dashboard, Worker Onboarding, Queue, Audit.
nesto-worker-onboarding
Worker intake form pipeline. Nodes: FormNode (10-field form), ValidateNode (basic validation), StoreNode (deltaPrism), NotifyNode (email + SMS).
nesto-worker-journey
Full 9-step worker journey pipeline. Nodes: EventTrigger, ValidateNode (17 rules), RouterSwitch (nationality routing), HttpForward x3 (MoHRE, eMigrate, POLO), ComplianceCheck x3.
Version History
| Version | Date | Changes |
|---|---|---|
| UC1-NESTO-v2.0 | 2026-05-07 | UCT-3.1 .md source created from KB + Use Cases Detailed. Full 13-section structure. |