Ownership redesign at
Tinkoff Bank
A year-long migration from legacy Siebel to a secure in-house CRM.
Role: Product Designer / Constraints: SLA stability, RBAC, auditability
Role: Product Designer / Constraints: SLA stability, RBAC, auditability
02 The brief
The bank needed three things at once
No blockers
Staff had to fully leave Siebel, with nothing missing on day one.
Hold the metrics
SLA, resolution time and CSAT had to stay at least level through rollout.
Security by role
No open access to customer data. Agents see only what their role and channel require.
A task in the shipped system: owner,
two due dates, queue, and the reason it is blocked
03 My role & team
My role
I joined as Product Designer and owned the interaction model and system logic end to end: from AS-IS research through the shipped baseline and pilot rollout.
What I owned
The task lifecycle and its states, the permission model, the decision tables behind every blocked action, and the interface from lo-fi to hi-fi. Discovery was mine as well, incl shadowing, interviews, the blueprint. The team: Engineering, designers, QA, technologists, a PM. As UX lead I set one goal: ship a task, move the next group of agents, hold the metrics.
How I worked with the team
I partnered with engineering to turn task states into backend validation, and with security to shape the least-privilege model without slowing frontline.
Decision tables became our main reference. If someone had a different idea of how a case should route, we opened the table.
Main metrics agreed before design
Who the system touched, and which of them could block a decision
04 Users
Four service lines in one shared system
The lines differ in volume, permissions and tolerance for handoffs. Copying legacy screens across all of them would slow frontline, overload premium and break back-office security. So each line got its own workflow over shared objects — case, task, queue — with strict permission boundaries.
Frontline
Short, high-volume cases, lower permissions. Success is a fast, accurate answer during the call.
Premium / Private
Complex cases where ownership continuity matters. Success is reliable follow-up and SLA held.
Back Office
Regulated operations through controlled procedures. Highest permissions, traceable outcome.
QA / Monitoring
Read-only review. Success is findings that turn into a measurable fix.
Comparison matrix, permission corridor
and the personas behind them
05 The problem
The insight
The brief was a migration. Move 350 people off Siebel, don't drop the SLA. The obvious plan was to rebuild the old screens in the new system.
That didn't work. In Siebel agents could see most of the customer data, and follow-ups lived in their own notes and chats. The new CRM runs on least privilege — you see what your role needs, nothing else. The old workaround had nowhere to go.
≈15%
of complex cases had work happening where the system could not see it.
AS-IS blueprint: I watched the off-system follow-ups, mapped where ownership got lost at handoffs and shift changes, and turned each breakdown into a requirement.
What we couldn't do
Rebuild Siebel's screens. Least privilege removed the open access the old workflow ran on.
What we did instead
Made follow-up a task the system owns: owner, due date, state, audit log.
What it took
A task lifecycle, role-aware permissions, and decision tables that UI, backend and QA all read.
Least privilege, treated as a UX problem
rather than a backend setting
06 What I decided to build
What I decided to build
A follow-up is a record: owner, queue, state, due date, audit log. Frontline, back office and QA work on the same record and see different parts of it.
Deferred Task lifecycleTasks move between states — in progress, deferred, in queue, overdue. Routing depends on how much SLA time is left.
ExplainabilityIf the system blocks an action, it shows the reason and what the agent can do instead.
Decision tablesThe rules live in one place. UI, backend and QA read the same table.
Early sketch: separating Task Mode from Ready Mode, the state the agent switches into.
Early sketch: separating Task Mode from Ready Mode, the state the agent switches into.
Three things I expected
07 Designing the system
Designing the system
I turned the lifecycle into interface flows and tested the agent experience before any visual polish. The guardrails came from real failure modes: when an action is blocked, the UI explains why and offers a safe next step. Handoffs are logged — who, where, why.
Task Mode is stateful. Actions depend on role, task state, verification, and timing.
Rules I set upfront
> 20 min
Follow-up
1 business day
Late
All in one policy source: UI, backend, QA
States the UI has to explain
Each one is a point where the system stops the agent. Every state names its reason and its safe next step. Each card: what the agent sees, what they can do, what goes into the audit log.
08 The interface
The interface
I tested the mechanics in lo-fi before designing anything, then built Task Mode into the operator's real workspace. Sorted by SLA risk, not creation time: status is calculated by rules, so an overdue task auto-prioritises and surfaces at the top.
Lo-fi frames with the annotations I tested against
Auto-assigned tasks, state-aware actions, auditable routing. The confirmation had to say what happens next, or agents kept a note anyway.
09 Rolling it out
Rolling it out
I moved 350+ agents in waves and ran the migration myself. Small groups onto the new CRM first, then I watched the logs to see who was actually working there, and only then blocked their Siebel account.
Measured only after Siebel access was gone
How I picked the order of the waves: what each team needed on day one, and where the SLA risk was.
10 Pilot & feedback
What broke in pilot
I took the shipped baseline into pilot waves and tested it with task-based sessions and focus groups. Three edge cases we'd missed:
21:30
A task assigned after 21:30 re-queues to the next shift, with a logged transfer.
+5s
A delay and a softer tone give agents a prep window before the call connects.
−65%
Time to submit feedback: 87s in calm periods, 3:20 at peak. Feedback that became real work counted toward your KPI.
The rebuilt feedback form and the triage board behind it
11 Outcomes
Results
It started as a CRM migration.
Most of the work turned out to be about follow-up.
The agent workspace after migration.
Screens are public reference views, redacted
What the hypotheses showed
Results come from agents already fully migrated off Siebel, compared against the pre-migration baseline for the same service lines. The resolution-time figure reflects selected complex cases where centralised docs and less cross-team waiting had the clearest effect.
12 Reflection
Reflection
What I lovedSitting between teams that didn't talk to each other much. A lot of the work was getting people to say what they actually needed.