The spine under every product
Federated products. Shared identity, consent, evidence and entitlements. Not a monolith, and not a pile of integrations.
How the estate is shaped
One company, one boundary
An estate is one company — one identity, one audit trail, one invoice. A person in two companies has two identities. That is intentional.
Products stay independent
Each product keeps its own app, data and release. They share facts through versioned records, not a shared database.
Entitlements project out
Products enforce locally from a projection. They never call the bill in the hot path. Last-known-good holds if the spine is briefly unreachable.
Usage and evidence flow back
Sends, consent changes and assurance events return as records. Coach and billing read those records. Nothing important exists only in a log file.
The primitives
Account system
Central sign-in. Teams, roles, invitations, MFA, audit. Products consume a projection of membership. Identity changes happen once, on Accounts.
Consent ledger
Contact owns consent. Events are ordered. Consumers keep a read-model and fail closed. Revokes push immediately; grants may lag. A stale grant is treated as dangerous — check live or do not send.
One send door
Connect takes “deliver this to this identity.” Safety, consent, sender resolution, provider dispatch, receipts and inbound capture all sit on that path. Engage decides what to say. Contact decides who. Connect moves the message and keeps the evidence.
Append-only evidence
The comms ledger does not update or delete rows. Status changes are new evidence. Usage is read from the same ledger.
Agents as principals
principal_type: agent | human on the send path. Keys, sandbox, production graduation, MCP and /llms.txt are how an agent arrives. The human stays responsible for going live.
What this is not
- Not a second messaging network (that is kudosity.com)
- Not a marketing-cloud monolith
- Not seat-priced collaboration
- Not “bring your own keys” as the default product
- Not a side door for agents around consent