The platform, feature by feature
A strategy is the unit you switch on — declare it, and a real, tenant-isolated backend comes up. But the strategies are the surface. Under them sits the type system, the durable workflow engine, the presets, and the blocks that make each one real. Here is everything, exactly as it ships.
4 strategies · 8 field types · 7 workflows · 29 presets · 14 roles · one kernel
Strategies · 4
Four strategies ship today — booking, catalog, e-commerce, and forms. Each one, declared once, stands up its own API and console surfaces. On the left is the manifest you write; on the right, the live console it produces.
Appointments that can't double-book.
Reservable resources, real availability in the site's own timezone, deposits at booking. Exclusivity is enforced in Postgres, not hoped for in app code.
exclusivity: postgres gist · double-booking impossible
API it exposes
By end of day
A working scheduler your front desk can use before lunch.
A catalog and checkout, tenant-isolated.
Products with variants, a cart, and checkout that runs through the built-in payments module. Every price, order and customer stays inside the tenant boundary.
payments: idempotent intents · a retry never charges twice
API it exposes
By end of day
A storefront taking real payments by end of day.
Recurring billing with real dunning.
Plans, trials, proration and a billing cadence that retries failed charges and pauses politely. The subscription engine is part of the kernel, not a plugin you wire up.
dunning: retry(3) then pause · churn you can see coming
API it exposes
By end of day
Recurring revenue live, with churn you can see coming.
Intake that becomes a record, then acts.
A form whose submission creates a record, stores an uploaded file, and kicks off a workflow. Configuration, not a form builder bolted onto a spreadsheet.
reason: First visit, cleaning
consent:consent.pdf
on submit: create record → start workflow → store file
API it exposes
By end of day
Intake that files itself and starts the next step.
Data & records· 8
Records are typed collections that read and write across tiers atomically — no N+1 hydration. On top of the primitives, eight field types carry their own guarantees, most enforced in Postgres itself — plus timeseries, a whole-collection TimescaleDB hypertable variant. Each one below: how you declare it, an example value, and the query it unlocks.
row-level security forced · records never cross tenants
An integer amount in minor units plus an ISO-4217 currency code; ordered comparisons across differing currencies are rejected rather than silently compared.
# field type: moneyfields: invoice_total: type: money required: true allowed_currencies: [USD, EUR]{ "amount": 4999, "currency": "USD" }{ "invoice_total": { "$gte": { "amount": 5000, "currency": "USD" } } }A number canonicalized to a fixed-scale string at write time (via precision/scale), so equality and ordering are exact numeric comparisons, never float rounding or text sorting.
# field type: decimalfields: hours_logged: type: decimal precision: 8 scale: 2"6.50"{ "hours_logged": { "$gte": 6.5 } }A bounded { start, end } time span stored in a GiST-indexed extension table for overlap queries; range_subtype declares four options but only datetime and date are backed by storage.
# field type: rangefields: shift_window: type: range range_subtype: datetime{ "start": "2026-09-01T09:00:00Z", "end": "2026-09-01T17:00:00Z" }{ "shift_window": { "$overlaps": { "start": "2026-09-01T12:00:00Z", "end": "2026-09-01T13:00:00Z" } } }A fixed-length float embedding stored in a dimension-tiered, HNSW-indexed pgvector table for approximate nearest-neighbor search; this build accepts only the cosine metric of the three declared.
# field type: vectorfields: embedding: type: vector dimensions: 1536 distance_metric: cosine[0.0192, -0.0341, 0.1157, -0.0088, 0.0623]{ "embedding": { "$nearest": { "vector": [0.0201, -0.0299, 0.1088, -0.0102, 0.0587] } } }A GeoJSON point/polygon/linestring stored in a GiST-indexed PostGIS column, SRID-tagged (default 4326), for spatial containment and radius queries.
# field type: geometryfields: site_location: type: geometry geometry_type: point srid: 4326{ "lat": 40.7128, "lng": -74.006 }{ "site_location": { "$within_radius": { "center": { "lat": 40.7128, "lng": -74.006 }, "radius_meters": 5000 } } }A recurrence pattern stored as a validated RFC 5545 RRULE string (must contain FREQ=); no numeric/temporal cast exists for it, so it is compared as plain text.
# field type: intervalfields: maintenance_schedule: type: interval interval_allowed: [weekly, monthly, custom]"FREQ=WEEKLY;BYDAY=MO,WE,FR"{ "maintenance_schedule": { "$eq": "FREQ=WEEKLY;BYDAY=MO,WE,FR" } }A { languageTag: string } translation map; reads collapse it to one best-matching string for the requested language, falling back to base_language and then to any present translation.
# field type: multi_languagefields: description: type: multi_language base_language: en supported_languages: [en, es, fr]{ "en": "Quarterly safety inspection", "es": "Inspección de seguridad trimestral", "fr": "Inspection de sécurité trimestrielle" }GET /api/collections/tasks/records?lang=esAccept-Language: fr-CA, fr;q=0.9, en;q=0.5Declares a derived value via an expression string plus a persist flag; direct writes are unconditionally rejected (§8.6.8), and no expression evaluator exists yet anywhere in this build — the field is declared but not actually computed.
# field type: computedfields: line_total: type: computed expression: "quantity * unit_price" persist: true149.97Not a per-field type but a collection_type: every record routes into a dedicated, per-tenant-RLS TimescaleDB hypertable partitioned on a declared time column; columnstore compression is rejected outright to keep that isolation guarantee.
# collection_type: timeseries (not a fields: entry — see summary)name: equipment_telemetrycollection_type: timeseriesfields: device_id: type: string required: true temperature_c: type: number recorded_at: type: datetime required: truetimeseries_config: timestamp_field: recorded_at partition_interval: 1 day retention_policy: 90 days{ "time": "2026-08-27T14:00:00Z", "data": { "device_id": "chiller-04", "temperature_c": 21.4 } }{ "bucket": "1 hour", "aggregation": "avg", "value_field": "temperature_c", "range": { "start": "2026-08-26T00:00:00Z", "end": "2026-08-27T00:00:00Z" }, "group_by": "device_id", "order": "asc" }GraphQL API
A per-tenant GraphQL endpoint at POST /graphql, its schema generated from your own collections. It rides the exact same tenant-scoped, policy-enforced data layer as REST — so a nested selection compiles to one expand query, not a fetch per row.
query { segmentMemberships { nodes { id contact_id { email first_name } # a relation } totalCount }}# one tenant-scoped query — the relation is expanded, not fetched per rowdata.forTenant(ctx).query("segment_memberships", { expand: ["contact_id"], # derived from the selection set page: { limit: 100 }, # bounded — never the whole table})# + one COUNT for totalCount# relations resolve from the expanded rows — never a query per nodeMeasured — a 1,000-row page with a relation
1
database query for the whole page + its relation — the same as REST's ?expand=
1,001
what a per-node resolver would issue instead (1 + N) — the trap this avoids
~1.7 ms
GraphQL layer overhead (parse → validate → execute → redact) on top of that one query
Bounded by design
Same guarantees as REST
Workflows· 7
A declarative executor runs the steps: it parks on events, fires timers, recovers from a mid-run crash, and compensates idempotently. Every template below is a real workflow definition — its trigger, config, and full step graph — plus the event that starts it.
durable park/resume · survives a crash, resumes exactly once
Notifies the approver role of a pending request, waits for an approve/deny decision with automatic escalation on timeout, then notifies the requester of the outcome.
# kind: workflow · name: approval-gatetrigger: type: event event: approval.requestedinput_schema: required: [requester_id, request_type, request_data] properties: requester_id: string request_type: string request_data: objectconfig: approver_role: org_admin escalation_role: org_admin timeout_duration: 48hinitial_step: notify_approversteps: notify_approver: type: action on_complete: goto: await_approval # comms.send approval_requested to_role={{ config.approver_role }} data={request_type, requester} await_approval: type: approval config: required_role: "{{ config.approver_role }}" prompt: Review and approve or deny this request timeout: duration: 48h action: goto: escalate on_complete: branch: - condition: "{{ approval.status == 'approved' }}" goto: on_approved - condition: "{{ approval.status == 'denied' }}" goto: on_denied escalate: type: action on_complete: goto: await_approval # comms.send approval_escalation to_role={{ config.escalation_role }} on_approved: type: action on_complete: goto: end status: completed # comms.send request_approved to={{ input.requester_id }} on_denied: type: action on_complete: goto: end status: completed # comms.send request_denied to={{ input.requester_id }} data.reason={{ approval.reason }}{ "type": "approval.requested", "tenant_id": "tn_8841", "data": { "requester_id": "usr_8f2a1c", "request_type": "expense_report", "request_data": { "amount": 482.5, "description": "Client dinner - Q3 kickoff" } }}Escalates an unacknowledged issue through staff, then location_admin, then org_admin, notifying each level in turn until someone acknowledges or the chain times out.
# kind: workflow · name: escalation-chaintrigger: type: event event: escalation.triggeredinput_schema: required: [subject, context] properties: subject: string context: objectconfig: levels: - role: staff timeout: 30m template: escalation_level_1 - role: location_admin timeout: 2h template: escalation_level_2 - role: org_admin timeout: 24h template: escalation_level_3initial_step: notify_level_1steps: notify_level_1: type: action on_complete: goto: await_response_1 # comms.send escalation_level_1 to_role=staff await_response_1: type: wait_for_event config: event: escalation.acknowledged match: data.escalation_id: "{{ instance.id }}" timeout: duration: 30m action: goto: notify_level_2 on_complete: goto: end status: completed notify_level_2: type: action on_complete: goto: await_response_2 # comms.send escalation_level_2 to_role=location_admin await_response_2: type: wait_for_event config: event: escalation.acknowledged match: data.escalation_id: "{{ instance.id }}" timeout: duration: 2h action: goto: notify_level_3 on_complete: goto: end status: completed notify_level_3: type: action on_complete: goto: await_response_3 # comms.send escalation_level_3 to_role=org_admin await_response_3: type: wait_for_event config: event: escalation.acknowledged match: data.escalation_id: "{{ instance.id }}" timeout: duration: 24h action: goto: end status: failed on_complete: goto: end status: completed{ "type": "escalation.triggered", "tenant_id": "tn_8841", "data": { "subject": "POS terminal offline at Downtown location", "context": { "location_id": "loc_4471", "severity": "high" } }}Sends a welcome email on registration, waits for the profile form to be submitted, and nudges the user (looping the wait) if it isn't completed within the timeout.
# kind: workflow · name: onboardingtrigger: type: event event: iam.user.registeredinput_schema: required: [user_id, email] properties: user_id: string email: stringconfig: profile_form: onboarding-profile welcome_template: welcome_email nudge_template: complete_profile_nudge nudge_delay: 24hinitial_step: send_welcomesteps: send_welcome: type: action on_complete: goto: await_profile # comms.send {{ config.welcome_template }} to={{ input.user_id }} await_profile: type: wait_for_event config: event: forms.submitted match: data.form_name: "{{ config.profile_form }}" data.submitted_by: "{{ input.user_id }}" timeout: duration: 24h action: goto: send_nudge on_complete: goto: end status: completed send_nudge: type: action on_complete: goto: await_profile # comms.send {{ config.nudge_template }} to={{ input.user_id }}{ "type": "iam.user.registered", "tenant_id": "tn_8841", "data": { "user_id": "usr_9c31de", "email": "jordan@example.com" }}Puts a post into review, waits for the reviewer's approval with overdue reminders on timeout, then publishes it or routes it back to the author for revision.
# kind: workflow · name: content-publishingtrigger: type: apiinput_schema: required: [content_id, author_id] properties: content_id: string author_id: string publish_at: stringconfig: reviewer_role: org_manager approver_role: org_admin review_timeout: 72hinitial_step: submit_for_reviewsteps: submit_for_review: type: action on_complete: goto: await_review # data.update posts[{{ input.content_id }}].status=in_review; comms.send content_review_requested to_role={{ config.reviewer_role }} await_review: type: approval config: required_role: "{{ config.reviewer_role }}" prompt: Review this content for quality and accuracy timeout: duration: 72h action: goto: review_timeout on_complete: branch: - condition: "{{ approval.status == 'approved' }}" goto: publish_now - condition: "{{ approval.status == 'denied' }}" goto: revision_requested review_timeout: type: action on_complete: goto: await_review # comms.send review_overdue to_role={{ config.approver_role }} revision_requested: type: action on_complete: goto: end status: completed # data.update posts[{{ input.content_id }}].status=revision_requested; comms.send revision_requested to={{ input.author_id }} data.feedback={{ approval.reason }} publish_now: type: action on_complete: goto: end status: completed # data.update posts[{{ input.content_id }}].status=published,published_at={{ now }}; comms.send content_published to={{ input.author_id }}{ "content_id": "post_2214", "author_id": "usr_7a90f1", "publish_at": "2026-09-01T09:00:00Z"}Auto-approves and refunds requests at or under the policy threshold; otherwise routes to manual review with escalation on timeout before refunding or denying.
# kind: workflow · name: refund-requesttrigger: type: apiinput_schema: required: [customer_id, invoice_id, reason] properties: customer_id: string invoice_id: string reason: string amount: numberconfig: auto_approve_window: 24h auto_approve_max_amount: 10000 reviewer_role: location_admin review_timeout: 48hinitial_step: evaluate_policysteps: evaluate_policy: type: condition config: expression: "{{ input.amount <= config.auto_approve_max_amount }}" on_complete: branch: - condition: "{{ input.amount <= config.auto_approve_max_amount }}" goto: auto_approve - condition: "{{ true }}" goto: manual_review auto_approve: type: action on_complete: goto: end status: completed # commerce.refundPayment invoice_id={{ input.invoice_id }} amount={{ input.amount }} reason={{ input.reason }}; comms.send refund_approved to={{ input.customer_id }} manual_review: type: approval config: required_role: "{{ config.reviewer_role }}" prompt: Review refund request timeout: duration: 48h action: goto: escalate on_complete: branch: - condition: "{{ approval.status == 'approved' }}" goto: process_refund - condition: "{{ approval.status == 'denied' }}" goto: deny_refund escalate: type: action on_complete: goto: manual_review # comms.send refund_review_overdue to_role=org_admin process_refund: type: action on_complete: goto: end status: completed # commerce.refundPayment invoice_id={{ input.invoice_id }} amount={{ input.amount }} reason={{ input.reason }}; comms.send refund_approved to={{ input.customer_id }} deny_refund: type: action on_complete: goto: end status: completed # comms.send refund_denied to={{ input.customer_id }} data.reason={{ approval.reason }}{ "customer_id": "cus_5501ab", "invoice_id": "inv_88213", "reason": "Service was cancelled before the appointment", "amount": 4200}Holds a slot, invoices the customer, confirms the booking once payment is received (releasing the hold if it isn't), and thanks the customer after the appointment completes.
# kind: workflow · name: booking-with-paymenttrigger: type: apiinput_schema: required: [customer_id, service_id, slot_id] properties: customer_id: string service_id: string slot_id: string payment_strategy: stringconfig: hold_ttl: 15minitial_step: hold_slotsteps: hold_slot: type: action config: store_results_as: slot_hold on_complete: goto: create_payment # scheduler.createTemporaryHold slot_id={{ input.slot_id }} ttl=15m create_payment: type: action config: store_results_as: payment compensation: - module: scheduler method: releaseHold params: hold_id: "{{ steps.slot_hold.hold_id }}" on_complete: goto: await_payment # commerce.createInvoice amount={{ steps.slot_hold.service_price }} currency=USD metadata={booking_id, slot_id}; comms.send payment_link to={{ input.customer_id }} await_payment: type: wait_for_event config: event: commerce.payment.received match: data.metadata.booking_id: "{{ instance.id }}" timeout: duration: 15m action: goto: payment_expired on_complete: goto: confirm_booking payment_expired: type: action on_complete: goto: end status: cancelled # scheduler.releaseHold hold_id={{ steps.slot_hold.hold_id }}; comms.send payment_expired to={{ input.customer_id }} confirm_booking: type: action config: store_results_as: booking on_complete: goto: await_completion # scheduler.confirmAppointment hold_id={{ steps.slot_hold.hold_id }}; comms.send booking_confirmed to={{ input.customer_id }} await_completion: type: wait_for_event config: event: scheduler.appointment.completed match: data.appointment_id: "{{ steps.booking.appointment_id }}" on_complete: goto: post_completion # no timeout on this step — waits indefinitely for the appointment to complete post_completion: type: action on_complete: goto: end status: completed # comms.send thank_you_and_review to={{ input.customer_id }}{ "customer_id": "cus_3392fe", "service_id": "svc_haircut_classic", "slot_id": "slot_2026-09-02T14:00", "payment_strategy": "card_on_file"}Runs a field-service job end to end: authorize an assessment fee, assign a contractor, capture payment and send a quote after the report, collect a deposit once accepted, schedule and complete the work, then send the final invoice.
# kind: workflow · name: multi-stage-jobtrigger: type: apiinput_schema: required: [customer_id, category, description] properties: customer_id: string category: string description: string preferred_slots: arrayconfig: assessment_fee: 7500 deposit_percentage: 50 quote_validity_days: 14initial_step: create_assessment_requeststeps: create_assessment_request: type: action config: store_results_as: assessment on_complete: goto: await_payment_auth # scheduler.createRequest type=assessment preferred_slots={{ input.preferred_slots }}; commerce.createInvoice amount={{ config.assessment_fee }} payment_type=authorization metadata={job_id, stage=assessment} await_payment_auth: type: wait_for_event config: event: commerce.payment.authorized match: data.metadata.job_id: "{{ instance.id }}" timeout: duration: 15m action: goto: payment_timeout on_complete: goto: await_assignment payment_timeout: type: action on_complete: goto: end status: cancelled # commerce.voidInvoice invoice_id={{ steps.assessment.invoice_id }}; comms.send payment_expired to={{ input.customer_id }} await_assignment: type: approval config: required_role: location_admin prompt: Assign a contractor and confirm the assessment slot timeout: duration: 48h action: goto: escalate_assignment on_complete: goto: await_assessment_report # unconditional goto — proceeds on any approval decision, not branched on approval.status escalate_assignment: type: action on_complete: goto: await_assignment # comms.send assignment_escalation to_role=org_admin await_assessment_report: type: wait_for_event config: event: data.record.created match: data.collection: assessment_reports data.data.job_id: "{{ instance.id }}" on_complete: goto: capture_and_send_quote # no timeout on this step — waits indefinitely for the assessment report capture_and_send_quote: type: action config: store_results_as: quote compensation: - module: commerce method: refundPayment params: invoice_id: "{{ steps.assessment.invoice_id }}" reason: Workflow cancelled after capture on_complete: goto: await_quote_acceptance # commerce.capturePayment invoice_id={{ steps.assessment.invoice_id }}; comms.send quote_ready to={{ input.customer_id }} data.quote={{ event.data.data.quote }} await_quote_acceptance: type: approval config: required_user: "{{ input.customer_id }}" prompt: Review and accept the repair quote timeout: duration: 14d action: goto: quote_expired on_complete: goto: create_deposit # unconditional goto — proceeds on any approval decision, not branched on approval.status quote_expired: type: action on_complete: goto: end status: cancelled # comms.send quote_expired to={{ input.customer_id }} create_deposit: type: action config: store_results_as: deposit on_complete: goto: await_deposit # commerce.createInvoice amount={{ steps.quote.total * config.deposit_percentage / 100 }} payment_type=immediate metadata={job_id, stage=deposit} await_deposit: type: wait_for_event config: event: commerce.invoice.paid match: data.metadata.job_id: "{{ instance.id }}" data.metadata.stage: deposit timeout: duration: 72h action: goto: deposit_reminder on_complete: goto: schedule_work deposit_reminder: type: action on_complete: goto: await_deposit # comms.send payment_reminder to={{ input.customer_id }} schedule_work: type: action config: store_results_as: work on_complete: goto: await_job_completion # scheduler.createAppointment type=service; comms.send work_scheduled to={{ input.customer_id }} await_job_completion: type: wait_for_event config: event: data.record.updated match: data.collection: jobs data.changes.status.to: completed on_complete: goto: final_invoice # no timeout on this step — waits indefinitely for the job to complete final_invoice: type: action on_complete: goto: end status: completed # commerce.createInvoice amount={{ steps.quote.total * (100 - config.deposit_percentage) / 100 }} payment_type=invoice metadata={job_id, stage=final}; comms.send final_invoice to={{ input.customer_id }}{ "customer_id": "cus_7734de", "category": "plumbing", "description": "Kitchen sink leaking under the cabinet", "preferred_slots": ["2026-09-03T09:00", "2026-09-03T13:00"]}Presets· 29
A preset flips configuration: how auth works, how money is captured, which columns are masked, what fires automatically, how requests are throttled, where files live. Here is the exact config each one sets, grouped by what it tunes. Layer them under any strategy.
Tune the iam module — methods, MFA, sessions. Create nothing.
Password + magic-link login, optional TOTP, 30-day sessions, email-verified signup.
# kind: auth · module: iam · name: consumerauth_methods: [password, magic_link]mfa: available: [totp] required: falsesession: max_age: 30d refresh_interval: 7dregistration: steps: - type: email_verification expires_in: 24hpassword_policy: min_length: 8 require_uppercase: true require_number: truelogin: [password, magic_link]step-up: totp (optional)SAML/OIDC SSO with required TOTP or WebAuthn MFA, 8-hour sessions, IdP-provisioned registration and attribute mapping.
# kind: auth · module: iam · name: enterpriseauth_methods: [saml, oidc]mfa: available: [totp, webauthn] required: truesession: max_age: 8h refresh_interval: 1h refresh_on_activity: trueregistration: mode: idp_provisionedidp: auto_provision: true attribute_mapping: email: email name: displayName department: departmentlogin: [saml, oidc]step-up: totp, webauthn (required)registration: idp_provisionedAPI-key and JWT-bearer auth with no session state, prefixed/expiring keys with rate limiting, JWKS-refreshed JWT validation.
# kind: auth · module: iam · name: api-firstauth_methods: [api_key, jwt_bearer]session: enabled: falseapi_key: prefix_format: pk_{env}_ default_expiry: 365d max_keys_per_user: 10 rate_limit: max: 1000 window_seconds: 60jwt: jwks_refresh_interval: 1h allowed_issuers: [] clock_skew_seconds: 30login: [api_key, jwt_bearer]session: disabledapi_key: prefix pk_{env}_, expires 365dPassword + OAuth2 (Google/Microsoft/GitHub) login with optional TOTP/WebAuthn prompted after 3 days, captcha-gated email-verified registration.
# kind: auth · module: iam · name: hybridauth_methods: [password, oauth2]mfa: available: [totp, webauthn] required: false prompt_after: 3doauth2: providers: [google, microsoft, github]session: max_age: 14d refresh_interval: 3dregistration: steps: - type: captcha provider: hcaptcha - type: email_verification expires_in: 24hlogin: [password, oauth2]oauth2: [google, microsoft, github]step-up: totp, webauthn (prompt after 3d)Anonymous sessions (7d) that convert to password/magic-link accounts on checkout, save, or content creation, merging data on conversion.
# kind: auth · module: iam · name: anonymous-to-authenticatedauth_methods: [anonymous, password, magic_link]anonymous: session_max_age: 7d conversion_triggers: [checkout, save_item, create_content] data_merge_on_conversion: truesession: max_age: 30d refresh_interval: 7dregistration: steps: - type: email_verification expires_in: 24hlogin: [anonymous, password, magic_link]anonymous session: 7dconverts on: [checkout, save_item, create_content]Tune the payments module — capture, settlement, currency. Create nothing.
Immediate payment capture at checkout, USD.
# kind: payments · module: payments · name: pay-nowpayment_strategy: pay-nowpayment: default_type: immediatecurrency: USDstrategy: pay-nowcapture: immediatecurrency: USDAuthorize on order, manually capture later (auto-void after 7d); full refund before 24h with a 2h no-refund window.
# kind: payments · module: payments · name: authorize-then-capturepayment_strategy: authorize-then-capturepayment: default_type: authorization capture_policy: trigger: manual auto_void_after: 7d cancellation: refund_policy: full_before_24h no_refund_window: 2hcurrency: USDstrategy: authorize-then-capturecapture: manual (auto-void after 7d)cancellation: full_before_24h, no_refund_window 2hNet-14 invoicing with reminders at 3, 7, and 14 days.
# kind: payments · module: payments · name: invoice-laterpayment_strategy: invoice-laterpayment: default_type: invoice terms: net_14 reminder_cadence: [3d, 7d, 14d]currency: USDstrategy: invoice-laterterms: net_14reminders: [3d, 7d, 14d]50% immediate deposit, remaining balance invoiced on completion with 3/7/14-day reminders.
# kind: payments · module: payments · name: deposit-then-balancepayment_strategy: deposit-then-balancepayment: deposit: percentage: 50 payment_type: immediate balance: payment_type: invoice due_on: completion reminder_cadence: [3d, 7d, 14d]currency: USDstrategy: deposit-then-balancedeposit: 50% immediatebalance: invoice, due on completionRecurring billing with proration enabled.
# kind: payments · module: payments · name: subscriptionpayment_strategy: subscriptionpayment: default_type: recurring proration: truecurrency: USDstrategy: subscriptioncapture: recurringproration: trueDeferred payment triggered by an event, not immediate checkout.
# kind: payments · module: payments · name: free-then-paidpayment_strategy: free-then-paidpayment: default_type: deferred trigger: on_eventcurrency: USDstrategy: free-then-paidcapture: deferredtrigger: on_eventPer-role field-visibility profiles applied to collections by reference — expose, redact, or mask each field.
PII collections: mask contact fields (email, phone), redact government/identity fields (SSN, tax ID, DOB, addresses, IDs).
# kind: column_policy · name: pii-strictdefaults: exposefields: email: mask: type: email phone: mask: type: last4 ssn: redact tax_id: redact date_of_birth: redact address: redact full_address: redact social_security: redact drivers_license: redact passport_number: redactmask: [email, phone]redact: [ssn, tax_id, date_of_birth, address, full_address, social_security, drivers_license, passport_number]Financial collections: mask account/routing numbers to last4, redact card data, bucket balances into ranges.
# kind: column_policy · name: financialdefaults: exposefields: account_number: mask: type: last4 routing_number: mask: type: last4 card_number: redact card_cvv: redact bank_name: expose transaction_amount: expose balance: mask: type: range buckets: [1000, 5000, 10000, 50000, 100000]mask: [account_number, routing_number, balance (bucketed)]redact: [card_number, card_cvv]Health data: redact clinical fields; keep safety-critical allergies and emergency contact visible.
# kind: column_policy · name: medicaldefaults: exposefields: medical_notes: redact diagnosis: redact prescriptions: redact lab_results: redact insurance_id: mask: type: last4 insurance_provider: expose blood_type: redact allergies: expose emergency_contact: exposeredact: [medical_notes, diagnosis, prescriptions, lab_results, blood_type]mask: [insurance_id]Public profile: redact everything by default, expose only public-facing fields like name, bio, and company.
# kind: column_policy · name: public-profiledefaults: redactfields: name: expose display_name: expose avatar: expose bio: expose title: expose company: expose website: expose public_email: exposedefaults: redactexpose: [name, display_name, avatar, bio, title, company, website, public_email]Internal-only: redact every field by default with no exposed fields — hides everything from the applied role.
# kind: column_policy · name: internal-onlydefaults: redactfields: {}defaults: redactfields: {} # no overrides — everything redactedAudit-safe: view activity logs with emails/IP masked and old/new values hashed, without exposing raw request/response payloads.
# kind: column_policy · name: audit-safedefaults: exposefields: actor_email: mask: type: email target_email: mask: type: email ip_address: mask: type: first_last visible: 3 user_agent: expose request_body: redact response_body: redact old_value: mask: type: hash new_value: mask: type: hashmask: [actor_email, target_email, ip_address, old_value, new_value]redact: [request_body, response_body]PREBUILT §9 — L1 presets that map platform events to comms.send. Create nothing: the resolver returns { mappings }, which G6 wires into event subscribers (event → resolve template → comms.send).
Six core account and billing events — registration, invoice, payment, refund, password reset, suspicious login — mapped straight to comms.send templates; enabled by the email-marketing smoke test.
# kind: automations · module: comms · name: transactional-basicsmappings: - event: iam.user.registered action: comms.send template: welcome to: "{{ event.data.user_id }}" - event: commerce.invoice.created action: comms.send template: invoice_created to: "{{ event.data.customer_id }}" - event: commerce.payment.received action: comms.send template: payment_receipt to: "{{ event.data.customer_id }}" - event: commerce.refund.processed action: comms.send template: refund_confirmation to: "{{ event.data.customer_id }}" - event: iam.user.password_reset_requested action: comms.send template: password_reset to: "{{ event.data.user_id }}" - event: iam.session.suspicious action: comms.send template: suspicious_login to: "{{ event.data.user_id }}"iam.user.registered: welcomecommerce.invoice.created: invoice_createdcommerce.payment.received: payment_receiptcommerce.refund.processed: refund_confirmationiam.user.password_reset_requested: password_resetiam.session.suspicious: suspicious_loginThe scheduler booking lifecycle end to end — request, approval, confirmation, reminder (email + SMS), cancellation, reschedule — including internal notifications to location_admin and the assigned agent.
# kind: automations · module: comms · name: booking-lifecyclemappings: - event: scheduler.request.created action: comms.send template: booking_request_received to: "{{ event.data.customer_id }}" - event: scheduler.request.created action: comms.send template: new_booking_request to_role: location_admin - event: scheduler.request.approved action: comms.send template: booking_approved to: "{{ event.data.customer_id }}" - event: scheduler.appointment.confirmed action: comms.send template: booking_confirmed to: "{{ event.data.customer_id }}" - event: scheduler.appointment.confirmed action: comms.send template: new_appointment_staff to: "{{ event.data.agent_id }}" - event: scheduler.reminder.due action: comms.send template: appointment_reminder to: "{{ event.data.customer_id }}" channels: ["email", "sms"] - event: scheduler.appointment.cancelled action: comms.send template: booking_cancelled to: "{{ event.data.customer_id }}" - event: scheduler.appointment.rescheduled action: comms.send template: booking_rescheduled to: "{{ event.data.customer_id }}"scheduler.request.created: booking_request_receivedscheduler.request.approved: booking_approvedscheduler.appointment.confirmed: booking_confirmedscheduler.reminder.due: appointment_reminder # channels: [email, sms]scheduler.appointment.cancelled: booking_cancelledscheduler.appointment.rescheduled: booking_rescheduledConditional job and assessment events keyed on collection/metadata/status — job created, assessment scheduled/assigned, quote ready, deposit received, job completed, and a 24h-delayed review request.
# kind: automations · module: comms · name: job-lifecyclemappings: - event: data.record.created condition: { "data.collection": "jobs" } action: comms.send template: job_created to: "{{ event.data.data.customer_id }}" - event: scheduler.appointment.confirmed condition: { "data.metadata.type": "assessment" } action: comms.send template: assessment_scheduled to: "{{ event.data.customer_id }}" - event: scheduler.appointment.confirmed condition: { "data.metadata.type": "assessment" } action: comms.send template: assessment_assigned to: "{{ event.data.agent_id }}" - event: data.record.created condition: { "data.collection": "assessment_reports" } action: comms.send template: quote_ready to: "{{ event.data.data.customer_id }}" - event: commerce.payment.received condition: { "data.metadata.stage": "deposit" } action: comms.send template: deposit_received to: "{{ event.data.customer_id }}" - event: data.record.updated condition: { "data.collection": "jobs", "data.changes.status.to": "completed" } action: comms.send template: job_completed to: "{{ event.data.data.customer_id }}" - event: data.record.updated condition: { "data.collection": "jobs", "data.changes.status.to": "completed" } action: comms.send template: review_request to: "{{ event.data.data.customer_id }}" delay: "24h"data.record.created: job_created # collection = jobsscheduler.appointment.confirmed: assessment_scheduled # type = assessmentdata.record.created: quote_ready # collection = assessment_reportscommerce.payment.received: deposit_received # stage = depositdata.record.updated: job_completed # status → completeddata.record.updated: review_request # status → completed, delay 24hBilling exception alerts — failed payment, overdue invoice, subscription renewal (7 days before) and cancellation, plus completed merchant payouts.
# kind: automations · module: comms · name: commerce-alertsmappings: - event: commerce.payment.failed action: comms.send template: payment_failed to: "{{ event.data.customer_id }}" - event: commerce.invoice.overdue action: comms.send template: payment_overdue to: "{{ event.data.customer_id }}" - event: commerce.subscription.renewal_upcoming action: comms.send template: subscription_renewal_reminder to: "{{ event.data.customer_id }}" timing: 7d_before - event: commerce.subscription.cancelled action: comms.send template: subscription_cancelled to: "{{ event.data.customer_id }}" - event: commerce.payout.completed action: comms.send template: payout_processed to: "{{ event.data.merchant_id }}"commerce.payment.failed: payment_failedcommerce.invoice.overdue: payment_overduecommerce.subscription.renewal_upcoming: subscription_renewal_reminder # 7d_beforecommerce.subscription.cancelled: subscription_cancelledcommerce.payout.completed: payout_processedPREBUILT §10 — L1 presets tuning the core rate limiter (token buckets by global / tenant / role / endpoint). Create nothing; the resolver returns the config block.
Token-bucket limits for a customer-facing app: global and per-tenant buckets, per-role buckets for customer/staff/location_admin, and tight per-endpoint caps on auth, registration, and form submits.
# kind: rate_limiting · name: consumer-appglobal: { max_tokens: 10000, refill_rate: 1000 }per_tenant: { max_tokens: 1000, refill_rate: 100 }per_role: customer: { max_tokens: 60, refill_rate: 10 } staff: { max_tokens: 200, refill_rate: 30 } location_admin: { max_tokens: 300, refill_rate: 50 }per_endpoint: "POST /iam/auth/*": { max_tokens: 10, refill_rate: 1 } "POST /iam/register": { max_tokens: 5, refill_rate: 0.1 } "POST /forms/*/submit": { max_tokens: 20, refill_rate: 2 } "POST /data/*/query": { max_tokens: 100, refill_rate: 20 }global: 10000 tokens, refill 1000/sper_tenant: 1000 tokens, refill 100/scustomer role: 60 tokens, refill 10/sPOST /iam/register: 5 tokens, refill 0.1/sTiered per-tenant token buckets (free/starter/pro/enterprise) under a high global ceiling, with per-endpoint caps on auth, data queries, and inbound webhooks.
# kind: rate_limiting · name: api-platformglobal: { max_tokens: 50000, refill_rate: 5000 }per_tenant: tiers: free: { max_tokens: 100, refill_rate: 10 } starter: { max_tokens: 500, refill_rate: 50 } pro: { max_tokens: 2000, refill_rate: 200 } enterprise: { max_tokens: 10000, refill_rate: 1000 }per_endpoint: "POST /iam/auth/*": { max_tokens: 20, refill_rate: 2 } "POST /data/*/query": { max_tokens: 200, refill_rate: 40 } "POST /webhooks/inbound/*": { max_tokens: 500, refill_rate: 100 }global: 50000 tokens, refill 5000/sfree tier: 100 tokens, refill 10/senterprise tier: 10000 tokens, refill 1000/sPOST /webhooks/inbound/*: 500 tokens, refill 100/sGenerous global/tenant/user buckets for trusted internal use, with bulk-import and delete endpoints throttled hard.
# kind: rate_limiting · name: internal-toolglobal: { max_tokens: 20000, refill_rate: 2000 }per_tenant: { max_tokens: 5000, refill_rate: 500 }per_user: { max_tokens: 500, refill_rate: 50 }per_endpoint: "POST /data/*/bulk-import": { max_tokens: 10, refill_rate: 0.5 } "DELETE /data/*": { max_tokens: 50, refill_rate: 5 }global: 20000 tokens, refill 2000/sper_tenant: 5000 tokens, refill 500/sper_user: 500 tokens, refill 50/sPOST /data/*/bulk-import: 10 tokens, refill 0.5/sGlobal and per-tenant buckets sized for webhook volume, with separate inbound/outbound webhook endpoint limits and a tight auth cap.
# kind: rate_limiting · name: webhook-heavyglobal: { max_tokens: 20000, refill_rate: 2000 }per_tenant: { max_tokens: 2000, refill_rate: 200 }per_endpoint: "POST /webhooks/inbound/*": { max_tokens: 500, refill_rate: 100 } "POST /webhooks/outbound/*": { max_tokens: 200, refill_rate: 50 } "POST /iam/auth/*": { max_tokens: 10, refill_rate: 1 }global: 20000 tokens, refill 2000/sper_tenant: 2000 tokens, refill 200/sPOST /webhooks/inbound/*: 500 tokens, refill 100/sPOST /webhooks/outbound/*: 200 tokens, refill 50/sPREBUILT §11 — L1 presets tuning the storage module (max file size, per-tenant quota, accepted MIME types, default access level, signed-URL TTL, cleanup). Create nothing.
General user uploads: 10MB max file, 5GB per-tenant quota, image/PDF/Word types, private access, 1-hour signed URLs, 30-day retention.
# kind: storage · module: storage · name: user-contentmax_file_size: 10485760per_tenant_quota_gb: 5accepted_types: - image/jpeg - image/png - image/webp - application/pdf - application/msword - application/vnd.openxmlformats-officedocument.wordprocessingml.documentdefault_access_level: privatesigned_url_ttl: 3600cleanup: retention_days: 30 orphan_check_interval: 24hmax_file_size: 10 MB (10485760 B)quota: 5 GB / tenantaccess: private, signed URL 3600sretention: 30d, orphan check 24hLarge media uploads: 100MB max file, 50GB per-tenant quota, image/video/audio/PDF types, tenant access, 2-hour signed URLs, 90-day retention.
# kind: storage · module: storage · name: media-heavymax_file_size: 104857600per_tenant_quota_gb: 50accepted_types: - image/* - video/mp4 - video/webm - audio/mpeg - audio/wav - application/pdfdefault_access_level: tenantsigned_url_ttl: 7200cleanup: retention_days: 90 orphan_check_interval: 24hmax_file_size: 100 MB (104857600 B)quota: 50 GB / tenantaccess: tenant, signed URL 7200sretention: 90d, orphan check 24hOffice document uploads: 25MB max file, 10GB per-tenant quota, PDF/Word/Excel/CSV types, private access, 30-minute signed URLs, 1-year retention.
# kind: storage · module: storage · name: documents-onlymax_file_size: 26214400per_tenant_quota_gb: 10accepted_types: - application/pdf - application/msword - application/vnd.openxmlformats-officedocument.wordprocessingml.document - application/vnd.ms-excel - application/vnd.openxmlformats-officedocument.spreadsheetml.sheet - text/csvdefault_access_level: privatesigned_url_ttl: 1800cleanup: retention_days: 365 orphan_check_interval: 24hmax_file_size: 25 MB (26214400 B)quota: 10 GB / tenantaccess: private, signed URL 1800sretention: 365d, orphan check 24hSmall image-only uploads: 5MB max file, 1GB per-tenant quota, JPEG/PNG/WebP/SVG types, tenant access, 1-hour signed URLs, 30-day retention.
# kind: storage · module: storage · name: minimalmax_file_size: 5242880per_tenant_quota_gb: 1accepted_types: - image/jpeg - image/png - image/webp - image/svg+xmldefault_access_level: tenantsigned_url_ttl: 3600cleanup: retention_days: 30 orphan_check_interval: 24hmax_file_size: 5 MB (5242880 B)quota: 1 GB / tenantaccess: tenant, signed URL 3600sretention: 30d, orphan check 24hRBAC roles· 14
Ready-made roles spanning the platform → org → location → merchant → customer tiers. Each is a real permission set with its column policy — the exact grants below, ceiling-enforced when the applicator upserts them.
Platform superuser with unrestricted access to every resource and action across the system.
display_name: Platform Administratortenant_type: platformpermissions: - "*:*"column_policies: _default: defaults: expose fields: {}✓ *:* — every resource, every action✓ fields: {} — nothing redacted either✗ (none — the only role with no restrictions)Platform-level support staff with read-only visibility into tenants, users, and commerce data; SSNs, tax IDs, and credential hashes are redacted.
display_name: Platform Supporttenant_type: platformpermissions: - "tenant:read" - "user:read" - "appointment:read" - "commerce.invoice:read" - "commerce.payment:read" - "commerce.payout:read" - "data.*:read" - "audit:read" - "analytics:read" - "workflow.instance:read" - "form.submission:read"column_policies: _default: defaults: expose fields: password_hash: redact api_key_hash: redact users: defaults: expose fields: ssn: redact tax_id: redact✓ commerce.invoice:read✓ audit:read✗ user:updatePlatform billing staff who read and approve payouts, invoices, payments, and subscriptions across tenants.
display_name: Platform Billingtenant_type: platformpermissions: - "tenant:read" - "commerce.invoice:read" - "commerce.payment:read" - "commerce.payout:read" - "commerce.payout:approve" - "commerce.subscription:read" - "analytics:read"column_policies: _default: defaults: expose fields: medical_notes: redact password_hash: redact✓ commerce.payout:approve✓ commerce.subscription:read✗ user:readFull administrative control within an organization — manages users, roles, billing, plugins, workflows, and forms.
display_name: Organization Admintenant_type: orgpermissions: - "tenant:create" - "tenant:read" - "tenant:update" - "user:create" - "user:read" - "user:update" - "user:delete" - "role:create" - "role:read" - "role:update" - "role:delete" - "appointment:read" - "appointment:update" - "commerce.invoice:read" - "commerce.payment:read" - "commerce.payout:read" - "commerce.payout:approve" - "commerce.subscription:read" - "commerce.subscription:update" - "data.*:read" - "data.*:write" - "plugin:create" - "plugin:read" - "plugin:update" - "plugin:delete" - "workflow:read" - "workflow:manage" - "form:read" - "form:manage" - "analytics:read" - "audit:read" - "config:read" - "config:update"column_policies: _default: defaults: expose fields: {}✓ user:delete✓ role:delete✗ appointment:createOperational manager within an organization — reads/updates appointments and data, but can't manage users, roles, or billing.
display_name: Organization Managertenant_type: orgpermissions: - "tenant:read" - "user:read" - "appointment:read" - "appointment:update" - "commerce.invoice:read" - "commerce.payment:read" - "data.*:read" - "data.*:write" - "workflow.instance:read" - "form.submission:read" - "analytics:read"column_policies: _default: defaults: expose fields: payout_account: redact api_key_hash: redact✓ appointment:update✓ data.*:write✗ user:deleteRead-only viewer within an organization — sees tenants, users, appointments, and data without any write access.
display_name: Organization Viewertenant_type: orgpermissions: - "tenant:read" - "user:read" - "appointment:read" - "commerce.invoice:read" - "data.*:read" - "analytics:read"column_policies: _default: defaults: expose fields: payout_account: redact✓ commerce.invoice:read✓ analytics:read✗ data.*:writeOrganization billing role covering invoices, payments, payouts, and subscriptions; no column policy is defined for it.
display_name: Organization Billingtenant_type: orgpermissions: - "tenant:read" - "commerce.invoice:read" - "commerce.payment:read" - "commerce.payout:read" - "commerce.payout:approve" - "commerce.subscription:read" - "analytics:read"column_policies: {}✓ commerce.payout:approve✓ commerce.subscription:read✗ user:readFull administrative control at a single location — manages staff, roles, appointments, products, and payout requests.
display_name: Location Admintenant_type: locationpermissions: - "user:create" - "user:read" - "user:update" - "role:create" - "role:read" - "role:update" - "appointment:create" - "appointment:read" - "appointment:update" - "appointment:approve" - "commerce.product:create" - "commerce.product:read" - "commerce.product:update" - "commerce.invoice:read" - "commerce.payment:read" - "commerce.payout_account:create" - "commerce.payout_account:read" - "commerce.payout:request" - "data.*:read" - "data.*:write" - "plugin:read" - "workflow.instance:read" - "workflow.instance:manage" - "form:read" - "form:manage" - "analytics:read" - "config:read" - "config:update"column_policies: _default: defaults: expose fields: {}✓ appointment:approve✓ commerce.payout:request✗ user:deleteMerchant-level admin managing their own users, products, invoices, and payout account, without organization-wide reach.
display_name: Merchant Admintenant_type: merchantpermissions: - "user:create" - "user:read" - "user:update" - "role:read" - "commerce.product:create" - "commerce.product:read" - "commerce.product:update" - "commerce.invoice:read" - "commerce.payment:read" - "commerce.payout_account:create" - "commerce.payout_account:read" - "commerce.payout:request" - "data.*:read" - "data.*:write" - "form:read" - "form:manage" - "analytics:read"column_policies: _default: defaults: expose fields: {}✓ commerce.product:update✓ commerce.payout:request✗ role:createFront-line merchant staff who read products/invoices and read+write data, with payout and commission fields redacted.
display_name: Merchant Stafftenant_type: merchantpermissions: - "commerce.product:read" - "commerce.invoice:read" - "data.*:read" - "data.*:write" - "form.submission:read" - "form.submission:create"column_policies: _default: defaults: expose fields: payout_account: redact commission_rate: redact✓ commerce.invoice:read✓ data.*:write✗ commerce.product:createLocation staff handling day-to-day appointments, products, and data, with payout and commission fields redacted.
display_name: Stafftenant_type: locationpermissions: - "appointment:create" - "appointment:read" - "appointment:update" - "commerce.product:read" - "commerce.invoice:read" - "commerce.payment:read" - "data.*:read" - "data.*:write" - "workflow.instance:read" - "form.submission:read" - "form.submission:create"column_policies: _default: defaults: expose fields: payout_account: redact commission_rate: redact✓ appointment:update✓ data.*:write✗ appointment:approveA narrower variant of Staff — reads/creates appointments and data with no update rights, and redacts commission, insurance, medical, and revenue fields.
display_name: Limited Stafftenant_type: location# inherits: staffpermissions: - "appointment:read" - "appointment:create" - "commerce.product:read" - "data.*:read" - "form.submission:create"column_policies: _default: defaults: expose fields: payout_account: redact commission_rate: redact insurance_id: mask: type: last4 medical_notes: redact revenue: redact✓ appointment:create✓ data.*:read✗ data.*:writeEnd customer who books appointments, views products/invoices, and reads/writes only their own data.
display_name: Customertenant_type: locationpermissions: - "appointment:create" - "appointment:read" - "commerce.product:read" - "commerce.invoice:read" - "data.self:read" - "data.self:write" - "form.submission:create" - "storage.file:upload"column_policies: _default: defaults: expose fields: cost_price: redact margin: redact commission_rate: redact internal_notes: redact✓ data.self:read✓ storage.file:upload✗ data.*:readUnauthenticated visitor who can browse products and submit forms, with no access to non-public data.
display_name: Guesttenant_type: locationpermissions: - "commerce.product:read" - "data.public:read" - "form.submission:create"column_policies: _default: defaults: expose fields: cost_price: redact margin: redact internal_notes: redact staff_notes: redact✓ commerce.product:read✓ form.submission:create✗ appointment:createForm templates· 6
Reusable form definitions installed create-if-not-exists. Each below: its real field schema and on-submit behavior, with an example submission.
General-purpose contact inquiry form, unauthenticated, routed to the inquiries collection.
kind: formname: Contactslug: contactschema: fields: - name: name type: text label: Full Name required: true - name: email type: email label: Email required: true - name: phone type: phone label: Phone Number - name: subject type: text label: Subject required: true - name: message type: textarea label: Message required: truesubmission_config: target_collection: inquiries send_confirmation: template: contact_received to_field: email require_auth: false{ "name": "Marcia Reid", "email": "marcia.reid@example.com", "phone": "+1-876-555-0134", "subject": "Question about your services", "message": "Hi, I'd like to know more about your booking process before I sign up."}Post-service rating and review form gated behind auth, routed to the reviews collection.
kind: formname: Feedbackslug: feedbackschema: fields: - name: rating type: rating label: How would you rate your experience? required: true config: max: 5 - name: review type: textarea label: Tell us about your experience - name: categories type: multi_select label: What went well? options: - value: service label: Service Quality - value: timeliness label: Timeliness - value: communication label: Communication - value: value label: Value for Money - value: cleanliness label: Cleanliness - name: photos type: file_upload label: Photos (optional) config: max_files: 5 accepted_types: [.jpg, .png] max_size_mb: 5 - name: would_recommend type: toggle label: Would you recommend us? default_value: truesubmission_config: target_collection: reviews send_confirmation: template: thank_you_for_feedback to_field: _auth_user_email require_auth: true{ "rating": 5, "review": "The team was on time and very professional.", "categories": ["service", "timeliness", "communication"], "photos": ["https://cdn.example.com/uploads/feedback-1.jpg"], "would_recommend": true}Four-step new-user profile form (personal, preferences, documents, terms), capped at one submission per user.
kind: formname: Onboarding Profileslug: onboarding-profileschema: steps: - name: personal label: Personal Information fields: [first_name, last_name, phone, date_of_birth] - name: preferences label: Preferences fields: [communication_preference, timezone, language] - name: documents label: Documents fields: [photo, id_document] - name: terms label: Terms & Conditions fields: [terms_accepted, marketing_consent] fields: - name: first_name type: text label: First Name required: true - name: last_name type: text label: Last Name required: true - name: phone type: phone label: Phone Number - name: date_of_birth type: date label: Date of Birth - name: communication_preference type: select label: Preferred Contact Method options: - value: email label: Email - value: sms label: SMS - value: push label: Push Notification - name: timezone type: select label: Timezone config: source: system_timezones - name: language type: select label: Preferred Language options: - value: en label: English - value: es label: Spanish - value: fr label: French - name: photo type: file_upload label: Profile Photo config: max_files: 1 accepted_types: [.jpg, .png] max_size_mb: 5 - name: id_document type: file_upload label: ID Document (optional) config: max_files: 1 accepted_types: [.pdf, .jpg, .png] max_size_mb: 10 - name: terms_accepted type: checkbox label: I accept the Terms of Service required: true - name: marketing_consent type: toggle label: Receive marketing communications default_value: falsesubmission_config: target_collection: user_profiles require_auth: true max_submissions_per_user: 1{ "first_name": "Andre", "last_name": "Campbell", "phone": "+1-876-555-0198", "date_of_birth": "1990-04-12", "communication_preference": "email", "timezone": "America/Jamaica", "language": "en", "photo": "https://cdn.example.com/uploads/profile-andre.jpg", "id_document": "https://cdn.example.com/uploads/id-andre.pdf", "terms_accepted": true, "marketing_consent": false}Five-step job/vendor application with references and documents, gated by the approval-gate workflow.
kind: formname: Applicationslug: applicationschema: steps: - name: personal label: Personal Information fields: [first_name, last_name, email, phone, address] - name: qualifications label: Qualifications fields: [experience_years, certifications, specialties] - name: references label: References fields: [reference_1_name, reference_1_phone, reference_2_name, reference_2_phone] - name: documents label: Documents fields: [resume, certifications_upload, background_check_consent] - name: declaration label: Declaration fields: [declaration_accepted] fields: - name: first_name type: text label: First Name required: true - name: last_name type: text label: Last Name required: true - name: email type: email label: Email required: true - name: phone type: phone label: Phone required: true - name: address type: address label: Address required: true - name: experience_years type: number label: Years of Experience required: true - name: certifications type: multi_select label: Certifications options: [] - name: specialties type: multi_select label: Specialties options: [] - name: reference_1_name type: text label: "Reference 1 — Name" required: true - name: reference_1_phone type: phone label: "Reference 1 — Phone" required: true - name: reference_2_name type: text label: "Reference 2 — Name" - name: reference_2_phone type: phone label: "Reference 2 — Phone" - name: resume type: file_upload label: Resume / CV required: true config: max_files: 1 accepted_types: [.pdf, .doc, .docx] max_size_mb: 10 - name: certifications_upload type: file_upload label: Certification Documents config: max_files: 10 accepted_types: [.pdf, .jpg, .png] max_size_mb: 10 - name: background_check_consent type: checkbox label: I consent to a background check required: true - name: declaration_accepted type: checkbox label: I declare that all information provided is accurate required: truesubmission_config: target_collection: applications trigger_workflow: approval-gate send_confirmation: template: application_received to_field: email require_auth: false{ "first_name": "Kevon", "last_name": "Brown", "email": "kevon.brown@example.com", "phone": "+1-876-555-0177", "address": "12 Hope Road, Kingston 6", "experience_years": 4, "certifications": ["first_aid", "osha_10"], "specialties": ["electrical", "plumbing"], "reference_1_name": "Paula Grant", "reference_1_phone": "+1-876-555-0122", "reference_2_name": "Dwight Ellis", "reference_2_phone": "+1-876-555-0143", "resume": "https://cdn.example.com/uploads/kevon-resume.pdf", "certifications_upload": ["https://cdn.example.com/uploads/kevon-cert1.pdf"], "background_check_consent": true, "declaration_accepted": true}Service and provider booking request, feeding the booking-with-payment workflow.
kind: formname: Appointment Requestslug: appointment-requestschema: fields: - name: patient_name type: text label: Full Name required: true - name: email type: email label: Email Address required: true - name: phone type: phone label: Phone Number - name: service_type type: relation_picker label: Type of Service required: true config: collection: services display_field: name filter: status: active - name: preferred_provider type: relation_picker label: Preferred Provider config: collection: providers display_field: name - name: preferred_date type: date label: Preferred Date required: true validation: - rule: min_date value: "{{ now | add_days: 1 }}" - name: preferred_time type: select label: Preferred Time required: true options: - value: morning label: "Morning (9am–12pm)" - value: afternoon label: "Afternoon (12pm–5pm)" - value: evening label: "Evening (5pm–8pm)" - name: notes type: textarea label: Additional Notes - name: documents type: file_upload label: Upload Documents config: max_files: 5 accepted_types: [.pdf, .jpg, .png] max_size_mb: 10submission_config: target_collection: appointment_requests trigger_workflow: booking-with-payment send_confirmation: template: appointment_request_received to_field: email require_auth: false{ "patient_name": "Simone Clarke", "email": "simone.clarke@example.com", "phone": "+1-876-555-0165", "service_type": "svc_general_checkup", "preferred_provider": "prov_dr_henry", "preferred_date": "2026-09-02", "preferred_time": "morning", "notes": "First visit, please send intake forms in advance.", "documents": ["https://cdn.example.com/uploads/insurance-card.jpg"]}Two-step field assessment and repair-quote form for authenticated staff.
kind: formname: Assessment Reportslug: assessment-reportschema: steps: - name: findings label: Assessment Findings fields: [description, severity, photos] - name: quote label: Repair Quote fields: [line_items, estimated_hours, materials_cost, labor_cost, total, valid_until] fields: - name: description type: textarea label: Findings required: true - name: severity type: select label: Severity required: true options: - value: low label: "Low — Cosmetic" - value: medium label: "Medium — Should Repair" - value: high label: "High — Repair Urgently" - value: critical label: "Critical — Safety Hazard" - name: photos type: file_upload label: Photos config: max_files: 20 accepted_types: [.jpg, .png, .heic] - name: line_items type: textarea label: Line Items - name: estimated_hours type: number label: Estimated Hours required: true - name: materials_cost type: number label: Materials Cost ($) required: true - name: labor_cost type: number label: Labor Cost ($) required: true - name: total type: number label: Total Quote ($) required: true disabled_when: always - name: valid_until type: date label: Quote Valid Until required: true default_value: "{{ now | add_days: 14 }}"submission_config: target_collection: assessment_reports require_auth: true{ "description": "Water damage under the kitchen sink, cabinet base is soft.", "severity": "medium", "photos": ["https://cdn.example.com/uploads/sink-1.jpg", "https://cdn.example.com/uploads/sink-2.jpg"], "line_items": "Replace cabinet base, reseal pipe fittings, repaint interior", "estimated_hours": 3, "materials_cost": 120, "labor_cost": 210, "total": 330, "valid_until": "2026-09-10"}Tenant hierarchies· 6
Row-level security isolates tenants; the hierarchy decides how they nest. Pick one of these pre-shaped trees at setup — the real structure below, with a concrete example instance.
Platform → Organization → Location, three levels with per-level roles and delegation.
name: org-locationlevels: - type: platform label: Platform roles: [platform_admin, platform_support, platform_billing] delegation: allowed_roles: [platform_admin, platform_support] requires_reason: true - type: org label: Organization roles: [org_admin, org_manager, org_viewer, org_billing] delegation: allowed_roles: [org_admin] requires_reason: true - type: location label: Location roles: [location_admin, staff, staff_limited, customer, guest] delegation: allowed_roles: []platform: Acme Health org: Acme Medical Group location: Kingston ClinicPlatform → Organization → Team, the org variant for internal team structures.
name: org-teamlevels: - type: platform label: Platform roles: [platform_admin, platform_support, platform_billing] delegation: allowed_roles: [platform_admin, platform_support] requires_reason: true - type: org label: Organization roles: [org_admin, org_manager, org_viewer, org_billing] delegation: allowed_roles: [org_admin] requires_reason: true - type: team label: Team roles: [location_admin, staff, staff_limited] delegation: allowed_roles: []platform: Acme Corp org: Acme Engineering team: Platform TeamPlatform → Merchant, a flat two-level tree for multi-merchant marketplaces.
name: marketplacelevels: - type: platform label: Platform roles: [platform_admin, platform_support, platform_billing] delegation: allowed_roles: [platform_admin, platform_support] requires_reason: true - type: merchant label: Merchant roles: [merchant_admin, merchant_staff, customer] delegation: allowed_roles: []platform: Island Market merchant: Booth 4 ProducePlatform → Organization → Merchant → Customer, four levels for marketplaces with an owning org.
name: managed-marketplacelevels: - type: platform label: Platform roles: [platform_admin, platform_support, platform_billing] delegation: allowed_roles: [platform_admin, platform_support] requires_reason: true - type: org label: Organization roles: [org_admin, org_manager, org_billing] delegation: allowed_roles: [org_admin] requires_reason: true - type: merchant label: Merchant roles: [merchant_admin, merchant_staff] delegation: allowed_roles: [merchant_admin] requires_reason: false - type: customer label: Customer roles: [customer] delegation: allowed_roles: []platform: Island Market org: Island Market Holdings merchant: Booth 4 Produce customer: Jane SmithPlatform → Organization, the simplest two-level tenant tree.
name: orglevels: - type: platform label: Platform roles: [platform_admin, platform_support, platform_billing] delegation: allowed_roles: [platform_admin] requires_reason: true - type: org label: Organization roles: [org_admin, org_manager, org_viewer, org_billing] delegation: allowed_roles: [org_admin] requires_reason: trueplatform: Acme Corp org: Acme Widgets IncPlatform → Organization → Department → Team, four levels for larger departmental structures.
name: org-department-teamlevels: - type: platform label: Platform roles: [platform_admin, platform_support, platform_billing] delegation: allowed_roles: [platform_admin] requires_reason: true - type: org label: Organization roles: [org_admin, org_manager, org_billing] delegation: allowed_roles: [org_admin] requires_reason: true - type: department label: Department roles: [org_manager, org_viewer] delegation: allowed_roles: [org_manager] requires_reason: true - type: team label: Team roles: [staff, staff_limited] delegation: allowed_roles: []platform: Acme Corp org: Acme Manufacturing department: Operations team: Night ShiftApp starters· 5
Each starter is a strategy plus the presets, roles, and tenant tree that make it a real app. The exact composition below, and what it stands up in an empty workspace.
Consumer-auth booking app for medical practices: org-location hierarchy, authorize-then-capture payments.
name: medical-bookingauth_strategy: consumerhierarchy_template: org-locationmodules: [iam, tenant, comms, storage, vault, events, plugins, analytics, audit, data, workflows, observe]presets: storage: user-content payments: authorize-then-capture rate_limiting: consumer-app automations: [transactional-basics, booking-lifecycle]strategies: - name: booking params: currency: USDrole_presets: [location_admin, staff, staff_limited, customer]workflow_templates: [booking-with-payment]form_templates: [appointment-request, feedback]roles: location_admin, staff, staff_limited, customercollections: appointment_requests, reviewsworkflow: booking-with-paymentstrategy: booking (currency: USD)Consumer-auth job app for home-service businesses: org-location hierarchy, deposit-then-balance payments.
name: home-servicesauth_strategy: consumerhierarchy_template: org-locationmodules: [iam, tenant, comms, storage, vault, events, plugins, analytics, audit, data, workflows, observe]presets: storage: user-content payments: deposit-then-balance rate_limiting: consumer-app automations: [transactional-basics, job-lifecycle]strategies: - name: booking params: currency: USDrole_presets: [location_admin, staff, customer]workflow_templates: [multi-stage-job]form_templates: [assessment-report, contact, feedback]roles: location_admin, staff, customercollections: assessment_reports, inquiries, reviewsworkflow: multi-stage-jobstrategy: booking (currency: USD)Consumer-auth multi-merchant marketplace: flat marketplace hierarchy, pay-now payments, e-commerce strategy.
name: marketplaceauth_strategy: consumerhierarchy_template: marketplacemodules: [iam, tenant, comms, storage, vault, events, plugins, analytics, audit, data, workflows, observe]presets: storage: media-heavy payments: pay-now rate_limiting: consumer-app automations: [transactional-basics, commerce-alerts]strategies: - name: e-commerce params: currency: USDrole_presets: [merchant_admin, merchant_staff, customer]workflow_templates: [refund-request]form_templates: [feedback, contact]roles: merchant_admin, merchant_staff, customercollections: reviews, inquiriesworkflow: refund-requeststrategy: e-commerce (currency: USD)Hybrid-auth SaaS app: org-team hierarchy, subscription payments, catalog strategy for subscription listings.
name: saas-starterauth_strategy: hybridhierarchy_template: org-teammodules: [iam, tenant, comms, storage, vault, events, plugins, analytics, audit, data, workflows, observe]presets: storage: user-content payments: subscription rate_limiting: api-platform automations: [transactional-basics, commerce-alerts]strategies: - name: catalog params: listing_types: [subscription] currency: USDrole_presets: [org_admin, org_manager, org_viewer]workflow_templates: [onboarding]form_templates: [onboarding-profile, contact, feedback]roles: org_admin, org_manager, org_viewercollections: user_profiles, inquiries, reviewsworkflow: onboardingstrategy: catalog (listing_types: [subscription], currency: USD)Consumer-auth generic booking app: org-location hierarchy, pay-now payments, booking strategy.
name: booking-genericauth_strategy: consumerhierarchy_template: org-locationmodules: [iam, tenant, comms, storage, vault, events, plugins, analytics, audit, data, workflows, observe]presets: storage: user-content payments: pay-now rate_limiting: consumer-app automations: [transactional-basics, booking-lifecycle]strategies: - name: booking params: currency: USDrole_presets: [location_admin, staff, customer]workflow_templates: [booking-with-payment]form_templates: [appointment-request, feedback, contact]roles: location_admin, staff, customercollections: appointment_requests, reviews, inquiriesworkflow: booking-with-paymentstrategy: booking (currency: USD)Create a workspace, declare one of these, and watch a real, tenant-isolated backend come up. No rebuild, no redeploy.