<!-- Derived Markdown alternate of architecture.md; canonical repository sources and registered evidence retain authority. -->


# Technical architecture

<blockquote class="governing-question"><p>What hardware, software and connectivity are needed to issue and manage NHS smartcards reliably?</p></blockquote>

## Separate the three functions

| Function | What it establishes | What it does not establish |
|---|---|---|
| Authentication | The operator can sign in to an enabled service. | The target card can be issued or printed. |
| Card management | The authorised operation can update the target card. | The printed face is correct. |
| Physical personalisation | The card is processed by the printer and its reader. | The complete future application journey is supported. |

CIM is the management application. Smartcard Connect is packaged with Credential Management; the modern stack still includes Credential Management. Treating it as exclusively legacy software would omit a current dependency. [SRC-005](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-005)

## Logical dependency view

```mermaid
flowchart TB
  accTitle: Smartcard issuance dependencies
  accDescr: Local readers and the printer connect to the workstation. The workstation needs online identity services and an authorised card management workflow.
  devices["Readers and printer"] --> workstation["RA workstation"]
  workstation --> identity["Online identity services"]
  identity --> workflow["Authorised CIM workflow"]
```

This is a dependency diagram. It does not specify packet order, token storage, internal national services or a single browser-to-middleware sequence. The physical device path and the network path both need acceptance evidence.

## Deployment options

| Option | Design consideration | Required evidence |
|---|---|---|
| Managed workstation on an existing HSCN network | Inventory applications that still need the connection. | Modern and residual legacy paths tested separately. |
| Managed workstation using internet egress | Candidate baseline for a new installation. | Complete issue-and-print test through the actual gateway. |
| Dedicated managed RA workstation | Useful where shared desktops complicate hardware access. | Ownership, software maintenance and RA operating controls established. |
| Virtual desktop | Assess the exact supported stack and redirection path. | The [virtual desktop checks](https://nhs-smartcard-printing-wiki.pages.dev/virtual-desktops/index.md), including concurrent sessions. |

These are local design options, not additional NHS support categories. Use the [network boundary](https://nhs-smartcard-printing-wiki.pages.dev/connectivity/index.md), [workstation baseline](https://nhs-smartcard-printing-wiki.pages.dev/workstation/index.md) and [acceptance checklist](https://nhs-smartcard-printing-wiki.pages.dev/acceptance/index.md) to choose between them.