When the system says nothing, users assume the worst
Diagnosing a trust problem caused by silent integration failures in a mission-critical legal case management system.
ROLESr. Product Designer
TEAM1 UX Researcher, 1 PM,
4 developers
TIMELINE
3 months
Context
SAJ Ministérios Públicos is a Softplan system designed for case and procedure management within Brazilian Public Prosecutor's Offices (Ministérios Públicos). It centralizes all activities into a single platform, using automation to reduce bureaucratic tasks and increase productivity.
Key features include: deadline and notification tracking, task delegation, statistics and reporting, integration with justice courts (including electoral courts, SEEU, and PJe), digital case folders, AI-powered automatic recording and transcription of hearings, and automated publication in the Official Gazette.
The solution is web-based, meaning it works on any operating system or browser. Security is layered across four levels: passwords, profile-based access limits, digital signatures, and full traceability.
Design Approach
SAJ MP is not a complex application by accident. According to NNGroup's framework by Kate Kaplan, complexity in specialized-domain applications manifests across five layers: integration, information, intention, environment, and institution.
SAJ MP carries all five. It connects to multiple external court systems, like SEEU, PJe, and electoral courts. It handles large volumes of case data across distinct user roles. It supports workflows that are nonlinear and shaped by legal obligations, not by a path a designer can predict. It operates under deadline pressure, in institutional environments governed by procedural rules that predate any software decision.
That diagnosis shapes how I work.
In the Understand phase, studying the user is not enough. The work itself, how legal procedures flow, how decisions move between prosecutors, advisors, and clerks, has to be understood before any interface decision is made.
In the Explore phase, constraints are not obstacles. Legal compliance, data confidentiality, and mandatory system integrations define what a viable solution looks like. Co-creation with domain experts is how I pressure-test direction early.
In the Materialize phase, traditional usability testing falls short. The measure is not whether a user completes a task. It is whether the interface supports the reasoning behind a high-stakes procedural decision.
Problem
SAJ Online integrates with PJE, SEEU, and EPROC to handle petitioning, case file access, and receipt of intimations. When these integrations failed, nothing in the interface said so. The system just stopped working.
SUPPORT WITHOUT VISIBILITY
N1 teams received complaints via WhatsApp and had to run manual diagnostics, often discovering the problem at the same time as the user, or after.
MISATTRIBUTED BLAME
Even when the failure originated in the court system, SAJ absorbed the blame. Users had no information to conclude otherwise.
Users would try an action, it would fail. They would try again, it would fail again. Without any indication of what was happening, the most available explanation was that SAJ was broken.
LEGAL DEADLINES AT RISK
Petitioning concentrated the most risk. A failed petition tied to a legal deadline has direct operational and legal consequences.
SILENT FAILURE LOOP
The SAJ monitoring service for remittance could fail in the background, impacting the flow without the user noticing immediately.
Voices from research
“The user tries one action, it doesn’t work. Then they try another, and that fails too. Sometimes the N1 support team learns about the issue at the same time as the user, or even later.”
Support Team Lead, N1 (front-line support team responsible for triage and resolving simpler issues, often working directly inside prosecutor’s offices)“SAJ takes the blame, even without clear evidence that the root cause is internal.”
N2 Analyst (specialized technical support team activated when issues cannot be resolved by the first support layer)
“The user complains, N1 tests, N2 investigates, and N3 (I’m here, product team) prioritizes, all without clear visibility for the people on the front line.”
Research Synthesis
“When the user realizes the issue is on the court’s side, they understand the situation better and stop blaming SAJ.”
N3 Team (engineering and product team responsible for deeper technical intervention and product-level decisions)What I changed
I triangulated user interviews with Nielsen's heuristics for complex systems. The core violation was Heuristic 1: Visibility of System Status. The system had no mechanism to communicate integration health before or during user action.
Based on this, we defined product and interface criteria for a real-time instability panel.
-
![]()
Status by function, not by system
Instead of "PJE offline," the interface shows which actions are affected when affected: petitioning, case file access, intimation receipt. Users care about what they can and cannot do, not which server is down.
-
![]()
Color-coded indicators per integration
Green, yellow, red per integration with automatic updates. No manual refresh required. Panel state visible before user action, not triggered by failure. -
![]()
Language that assigns responsibility without jargon
Proposed message: "Detectamos instabilidade no serviço junto ao TJ, nossa equipe já está atuando." This tells the user the problem is not in SAJ, and that someone is already handling it. -
![]()
Panel visible on the dashboard by default
Available before the user attempts an action, so decisions about workflow can be made proactively. Not triggered by failure after the fact.
What improved
Post-launch metrics to be defined and measured after implementation.
But we expect:
Reduction of 80% of the volume of integration-related support tickets per week
User-reported perception of system reliability via CSAT open text
Reduction of time from failure event to user awareness (with vs. without panel)
Key learnings
Making failure attribution explicit is a trust intervention
When users know the problem is outside SAJ, they stop blaming SAJ. That is not a small outcome in a regulated environment where institutional trust is operationally necessary.
The language of system status matters as much as the status itself
A technically accurate message ("PJE unavailable") places the burden of interpretation on the user. A contextually clear message removes that burden and also signals that someone is already acting.
In regulated environments, uncertainty is not neutral
It generates support work, erodes trust, and disrupts workflows that have legal consequences. Designing for certainty is as important as designing for efficiency.