An internal operations platform for a real-estate investment firm.

A US real-estate flip and wholesale firm ran its entire property pipeline through a decade-old internal PHP tool. Same underlying data model as the new platform, but wrapped in a monolithic codebase with no API, no tests, no audit trail, and access control that lived only in the UI. Anyone who could POST to the write endpoint bypassed every role check.

The tool worked, in the way that any long-lived internal tool works. Operators had memorized where each screen lived. New sections got added by editing schemas and hand-patching templates. Adding a field was a code change. Adding an operational role was a code change. Adding a task rule was a code change, and sometimes a silent misfire because the config path had drifted from the schema.

The failure modes were consistent. Zero audit trail meant nobody could answer "who changed this, when, or why." Task rules were configured but did not always fire. Removing a team member left their open tasks orphaned on a user who no longer had access. When an anchor date moved on a project, downstream due dates did not recompute. Silent staleness, everywhere.

Access control was the load-bearing failure. Section-level and field-level restrictions existed in the schema but were not honored on the server. The UI hid what the operator was not meant to see. The write endpoint did not.

The firm wanted the same data model on a new engine underneath: new access control, new audit layer, new admin surfaces, and a runtime substrate for AI agents that plays by the same rules as human writers.

The data model is Section-Group-Field. Twenty-nine configured sections cover the full lifecycle from Contracts and Acquisition through Escrow, Due Diligence, Construction, Marketing, and Resale. Each section holds groups. Each group holds fields. Roughly 2,100 fields total. Every field has a declared type (Text, Number, Currency, Date, Boolean, Link, Option, Reference, Formula, Attachment) and every field is a configuration row, not schema. Adding a section or a field type does not require a code change.

Project creation used to take an operator about an hour of copy-paste from the MLS UI into each section, one field at a time. Now the operator opens the picker, types an address or APN, previews the MLS record, adjusts the pre-populated team, and clicks Create. In one transaction the engine runs the duplicate check by external record ID and APN, inserts the project row, walks all 29 sections evaluating formula defaults against a per-request MLS and property-evaluation cache, expands repeating-group fields into instances, inserts hundreds of computed values, seeds the team from a default template, and fires every matching task rule. About 30 seconds end-to-end.

The formula engine is where the platform earns its keep. Expressions like =idx('list_price') pull directly from the live MLS row. =weekdays_from(anchor_field, 7) returns a business-day offset that respects a preloaded holiday calendar. =contact('list_agent') returns a hydrated contact card. Formula and Reference fields evaluate at read time, not create time, so they stay live as underlying values change. When an anchor date moves, every downstream due date recomputes.

Access control is server-side and fails closed. The 29 sections by 17 operational roles equals a 744-cell privilege matrix. Each cell is No access, Read only, or Full access. Missing rows default to view-only. Every field write routes through one setFieldValue engine function that runs five layered checks in order: super-admin bypass, team-role matrix lookup, staff view-all fallback, hard deny for non-staff non-team-members, and an agent-specific gate. A user cannot bypass control by hitting the API directly.

The agent runtime substrate sits on the same rails as the human write path. Versioned agent profiles, a heartbeat log, a two-handoff question queue (judgment vs operational), and a pending-actions queue for act-with-confirm. Every agent write goes through the same audited path as a human write. Nothing an agent does can bypass the access matrix.

The platform is in internal testing with one tenant loaded. Roughly 30 to 50 active properties in the pipeline. Roughly 200 to 250 staff users migrated from the source directory. The old PHP tool still runs in parallel while operators migrate over.

No hardcoded roles, no invented option values, no assumed defaults. If a value is missing, the platform flags for the operator rather than guessing.

The specific failure modes the old tool leaked have concrete fixes. Task rules that misfired now re-evaluate on every field write against explicit trigger conditions. Orphaned tasks on team removal now cascade in the same transaction and capture the remaining team for downstream notification. Stale formula-derived due dates recompute at read time. The 409 error the old tool threw when an operator re-picked the same MLS record is now an auto-refresh that preserves operator-typed edits and repeating-group instances without clobbering.

External contributors get a tokened magic link scoped to a specific project, section, or field subset. A field data collector or subcontractor gets exactly the surface they need and nothing else. Every submission actor-stamps the external contributor and audit-logs the write, same as an internal user. Section Builder is the no-code admin surface for the whole schema, with a CSV import that dry-runs a diff before an explicit apply.

Comms are test-mode by default. Every text, email, and activity-log action records the exact would-be message but does not transmit until an explicit environment toggle. When transport is enabled the historical ledger is already complete.

The plan is straightforward. Everything the old tool did, the new platform does, plus a decade of learnings baked in about what actually breaks under real pipeline load.

Anas