Valkera — The Four Planes

What the patchwork actually costs

The premise everything else rests on

It isn't money and it isn't tool sprawl. It is that the depot system doesn't know what the invoice system knows. A business running fifteen tools holds fifteen private definitions of "customer" and cannot ask a single question that crosses them.

So the scarce resource is coherence, not compute. That was unattainable before — integration meant bespoke plumbing for every pair of tools, and it rotted faster than it was built. Continuous, model-maintained mapping is the actual unlock. Not "chat builds you an app": the business gets one shared brain, and the apps become views onto it.

The section drawing

Drawn by permanence, not by sequence

Identity

People, their assistants and voice, organisations, and grants — one permission vocabulary over every object in the house.

Cannot be retrofittedDecades

Meaning

The org model — customers, sites, assets, jobs, documents, money — plus memory: decisions, procedures, accumulated context.

Migrates painfullyDecades

Action

Rooms, workflows, agents, environments. Where software is built, run and replaced. Rebuild freely.

Disposable by designMonths–years

Record

Versions, retention, and the ledger — every action attributed, human or AI, with what was known at the time.

Cannot be retrofittedForever

Compute

Containers, hosts, placement, scale. Invisible to the customer — and, ideally, to us.

ImplementationDays

foundation — build it right once mutable — expect to replace it substrate — should never surface

The inversion this forces

Today each project owns its own database — a development sibling and a production sibling. The project owns the data.

That is backwards for a business platform. A business will rebuild its jobs board three times; it will never rebuild who its customers are. So: the org owns the data, and rooms borrow it.

Concretely — entities the business itself recognises live once, at org level. A room may hold private tables for its own mechanics, but it may not own a second definition of "customer". Shared spine, room-local extensions.

Where environments exist

Room kind × stage

The blank cells carry the argument: only built software has more than one instance. There is no draft of a file store and no staging for a connector. Production is a property of one cell — which is exactly why encoding it as a name suffix had to break.

Room kind	Work	Staging	Live	Agent may run
Built app	workbench + dev db	serve + staging db optional	serve + prod db	work: always live: opt-in
Hosted service	—	—	the service, always live	acts as a person, never resident
Connected tool	—	—	the connection	acts as the person, within their access
Org data	—	—	always live, versioned	reads by grant, never scans

One grant vocabulary

Principal × object × mode

If instances get bespoke access and files get bespoke access, the patchwork has been rebuilt inside our own walls. The same primitive covers every object, and it is simultaneously the permission system and the agent's leash.

Principal	May hold grants over	Modes	Rule
Person	room, instance, folder, file, conversation	view → edit → download	the baseline
Team	same	same	membership, not a second model
Agent	same, inherited per action	never exceeds its principal	holds no permissions of its own; never locks
Anonymous trigger	only what is explicitly opened	view at most	strictly less than signed-in

What changes because the actor is a machine

Three things that would have been designed differently before

The reason for a production split has inverted

Staging existed because releases were rare and expensive — a release-calendar problem. Changes are now constant and written by an autonomous actor, so the boundary is no longer "tested versus untested". It is blast radius. That is why an agent in production must be opt-in per instance, and why its fixes have to re-enter through source control rather than living only on the box.

The assistant is a principal, not a feature

It appears in the access model as a row, inheriting per action, with an anonymously-triggered agent granted strictly less than a signed-in one. An agent that a stranger can task, and that can read the file space, converts a spam problem into an exfiltration path. Nobody would have modelled that before; now it is the first thing to model.

The business becomes addressable

With meaning, record and grants in place, an instruction like "each quarter, chase unbilled depot jobs where the compliance document is missing" crosses three rooms, acts as a named person within their access, and leaves a trail. This is the part a better chat interface cannot copy — it rests on the org's accumulated meaning, not on the model.

What a proper business demands

The requirements startups skip

Continuity. The business must survive us. Export is real and rehearsed, not a checkbox — a patchwork escapee has been burned before and will ask.
People churn. Staff leave. Revocation must be complete and provable, across every room and every connected tool.
Multiple entities. A trading company, a trust, a property portfolio — the same humans, separate orgs, hard walls where it matters.
Retention. Seven years, in a form an accountant accepts.
Non-technical administration. An office manager grants access without calling us. If access requires us, this is a consultancy, not a platform.

What this means for the work in front of us

Consequences, immediate

Production containers stay urgent and are unaffected — they sit in the Action plane, and the build defect blocking them is real either way.

The piece to watch is the per-project production database. Making it a permanent fixture cuts against the inversion above, so it should stay thin — a room's private tables, not the business's records. Then the org spine can arrive later without unpicking it.

And the ordering follows from the drawing rather than from preference: grants and the ledger are foundations, so they are built once and early. Rooms, environments and containers are meant to be replaced, so they should be cheap to throw away — including the ones we are about to build.