Architecture north star

GRACE — the intelligence layer that understands, oversees, and orchestrates the church’s digital operations.

GRACE is the governed operational intelligence of the church. The CRM, portal, wallets, agents, APIs, virtual campus, and infrastructure are the environment it coordinates — not the product center.

Every capability below is marked Live, Partial, or Later. We would rather tell you exactly where the product is than let a diagram imply more than it should.

Systems observed into GRACE Approved actions out through governance

And GRACE shows its work. Answers are scoped to the asker’s authority, consequential actions stop at a named human who is recorded by name, and the audit trail they land on is append-only at the database — updates and deletes are blocked by trigger, not by convention. Permissions, approval, and audit are not wrapped around the product; they are the product.
The loop closes with controlled playbook improvement — later, not built. The direction: measure outcomes against church-defined criteria — helpfulness, accuracy, policy compliance, effort, ministry impact — and return only reviewed, versioned, tenant-safe improvements to an approved playbook library. No playbook library, versioning system, or outcomes-scoring loop exists in the product today. Said here plainly, not implied by the diagram.

GRACE does measure engagement — attendance, giving, serving — and will tell staff who has gone quiet. That is the job. What it will never do is infer or score anyone’s spiritual state, diagnose, or claim pastoral authority. Crisis language is caught by a deterministic check that runs before any model call, never by a model’s judgement. The line, and what sits on each side of it, is written down in our AI boundaries policy.

1 · GRACE seesLiveData, member activity, workflows, authorized financial metrics, programs, communications, permissions, infrastructure, and system state.
2 · GRACE understandsPartialThis church’s structure, people, policies, objectives, institutional knowledge, permissions, and operating context. No single shared church context object yet.
3 · GRACE proposesPartialOptions, not autonomy — today, one proposed action awaiting a decision, not a compared set of draft plans. There is no playbook-selection mechanism yet.
4 · People decideLiveA named, accountable human approves, edits, delegates, or rejects every consequential proposal through the Decision Queue and Approval Centre.
5 · GRACE actsLiveThrough approved tools and specialized agents. Consequential actions stop at a named human. Exceptions a church switches on deliberately: scheduled emails (birthday and anniversary greetings, giving thank-yous, a five-message new-member series) and a nightly pass that creates staff follow-up tasks.
GRACE shows its workLiveAnswers scoped to the asker’s authority, the deciding human recorded by name, and an audit trail that is append-only at the database — updates and deletes blocked by trigger.
Controlled playbook improvementLaterThe loop closes by measuring outcomes against church-defined criteria and returning reviewed, versioned improvements to an approved playbook library. No playbook library or outcomes-scoring loop exists today.

Three interfaces · one intelligence

Interface 01
Live

CRM Workspace

The conventional staff and operational surface. People, care, Sunday prep, giving, and workflows — the same intelligence, in the language of the church office.

Interface 02
Partial

Virtual Campus

A visual spatial view of the operating environment. Rooms and ministries as a lens over live state — not a second system of record. Today it navigates and shows real agent status; it carries no facilities or occupancy data.

Interface 03
Partial

Ask GRACE

Natural language over the same state. For staff, it reads only what your role can already see and drafts changes you press Execute on. Members get a separate assistant, scoped to their own record. Routing proposals through the Decision Queue and Approval Centre is the next slice — not current behaviour.

Not three products. Three ways people meet the same operational intelligence.

Governed operating environment

CRM and staff workspace Live
Member portal and accounts Partial
Communications Live
Specialized agents — 5 of 16 built, read-only scanners Partial
Hierarchy, programs, workflows Partial
Virtual campus — spatial lens over the CRM Partial
Databases and APIs Live
Cloud infrastructure Live
Impact Card and wallet — demo / simulated, requires a card agreement Later
Future physical systems Later
Live in the current product Partial connected, not complete Later governed environment and roadmap

Outer systems are GRACE’s governed operational environment — not a claim that every capability is already live. Impact Card remains demo/simulated for beta and needs a card agreement before it is real. Physical systems and self-hosted infrastructure stay on the long-term path. Consequential actions stop at a named human. The exceptions are disclosed rather than buried: a church can switch on scheduled emails (birthday and anniversary greetings, giving thank-yous, and a five-message new-member welcome series), and a nightly pass creates staff follow-up tasks. Outbound SMS to members is always human-initiated; the one automated SMS is a crisis alert to on-call staff, which is deliberate.