Agency Ops

With every API route touching client data, money or staff records, one forgotten check is all it takes to leak something. So permissions are not written route by route. A single policy defines who can do what, and the same policy is used by the server middleware, the client-side route guards and the navigation that decides what each person even sees.

Global features are the easy place to leak data, so they are built around the policy too. Search and the calendar pull from many domains, so each data provider declares the permission area it belongs to, and aggregation only queries what the current user is allowed to read.

Clients sign in to the portal through magic links. Tokens are stored only as hashes and work once. A portal session is scoped to exactly one client, so every query is bound to that client before it runs.

When a client asks for something that belongs to another client, the API returns 404, not 403, so the response doesn’t even confirm that the resource exists. Integration tests try to cross that boundary deliberately to prove it holds.

Money is stored as integer cents throughout, so totals, tax and payments never drift through floating-point rounding. Workflows that touch several records, such as turning a quote into an invoice or moving tasks, run inside database transactions, so a failure leaves nothing half-written.

Stripe webhooks verify their signatures and are idempotent, so a retried event never records a payment twice. Recurring invoices are drafted and reminders sent by scheduled jobs, which keeps billing running without anyone having to remember it.