Executive Summary
OA Dashboard Architecture
One System. One Login. Role-Based Access.
The OA dashboard ecosystem is a single unified application at server.outsourceaccess.com. One D1 database, one login, and role-based visibility. Clients, employees, and admins all log into the same URL. What they see is determined entirely by their user role and permissions.
No separate subdomains. No separate databases. No separate codebases. Just one system, one source of truth, and role-scoped views.
Single Entry Point
server.outsourceaccess.com
Every user (client, employee, admin) logs in at the same URL. The system detects their role and renders the appropriate dashboard view automatically.
One D1 Database
oa-client-dashboards-db
All data (users, roles, client dashboards, employee data, settings) lives in one unified Cloudflare D1 database. Role-based queries scope what each user can access.
Role-Based Views
6 distinct roles
Client Owner, Account Manager, Operations Manager, Team Leader, Virtual Assistant, and CEO/Admin. Each role sees exactly what they need, nothing more.
Core Architecture Principles
Single Unified Database
One D1 database houses all data. Role-based middleware scopes every query so users only see data they're authorized for. No cross-role data leaks are structurally possible.
One D1 database houses all data. Role-based middleware scopes every query so users only see data they're authorized for. No cross-role data leaks are structurally possible.
Role-Based Access Control
Authentication determines who you are. Your role determines what you see. Server-side enforcement on every request with identity from session tokens, never from browser parameters.
Authentication determines who you are. Your role determines what you see. Server-side enforcement on every request with identity from session tokens, never from browser parameters.
One URL, One Login
Everyone goes to server.outsourceaccess.com. No separate subdomains to manage, no separate codebases to maintain. Simpler for users, simpler to build, simpler to secure.
Everyone goes to server.outsourceaccess.com. No separate subdomains to manage, no separate codebases to maintain. Simpler for users, simpler to build, simpler to secure.
Tenant-Scoped Client Data
Client companies are scoped by
Client companies are scoped by
company_id on every table. Middleware injects the filter on every query. Cross-client data leaks are structurally impossible.Cloudflare-Native Infrastructure
Cloudflare Pages for frontend, D1 for database, Workers for API logic. No local servers, no tunnels. 100% cloud-native on OA's Cloudflare account.
Cloudflare Pages for frontend, D1 for database, Workers for API logic. No local servers, no tunnels. 100% cloud-native on OA's Cloudflare account.
Cloudflare Project
CF Pages Project:
oa-serverProduction URL: server.outsourceaccess.com
Pages.dev URL: oa-server.pages.dev
D1 Database:
oa-client-dashboards-db (ID: c2d686fc-9347-4afa-a45f-6f5957a6e353)CF Account: OA Team (
79bf9918da35fa3f7d3a0bca83c0d0be)
Related Resources
5-Persona Demo — Interactive demo showing login as CEO, Director, OM, TL, or Client.
Architecture Decision Doc — Original four-brain consensus analysis.
System Architecture
Visual Architecture Diagram
Users (All Roles)
server.outsourceaccess.com
Single login for all users: Clients, AMs, OMs, TLs, VAs, CEO
Role detected at login → appropriate dashboard rendered
▼ Session + Role ▼
Application Layer (Cloudflare Pages + Functions)
OA Server (oa-server)
Cloudflare Pages project with Functions API
Role-based middleware scopes every request
▼ D1 Binding ▼
Data Layer (Cloudflare D1)
oa-client-dashboards-db
Single unified database
Users, roles, companies, dashboards, HR, payroll, performance
Role-scoped queries enforce data isolation
▲ API Integrations ▲
External Data Sources
HubSpot CRM
Client records
Time Doctor
VA tracking
CSAT Surveys
Satisfaction
Zoho Recruit
Hiring
Stripe
Billing
How It Works
1. User visits server.outsourceaccess.com and logs in with email/password.
2. Server authenticates the user and retrieves their role (Client Owner, AM, OM, TL, VA, or Admin) from the D1 database.
3. Role-based middleware scopes all subsequent queries. A Client Owner only sees their own company data. A TL only sees their assigned VAs. An AM only sees their assigned clients.
4. Dashboard renders the appropriate view for that role. Same URL, same codebase, different experience based on who you are.
Unified System
Role-Based Access
One Login, Six Views
Every user logs into server.outsourceaccess.com. Their role determines their entire experience: navigation, data access, actions, and dashboard layout. The server enforces this on every request.
Client Owner
Business owner / client company
- VA performance dashboards (Time Doctor data)
- Satisfaction history and CSAT scores
- Industry research and strategic advisory docs
- Billing and invoice history
- Owner feedback and change requests
- Resources, guides, OA Playbook access
Account Manager (AM)
Client-facing strategic advisory
- Client portfolio overview with health scores
- CSAT trends and satisfaction alerts
- Client feedback and action items
- Strategic advisory document access
- Upsell/cross-sell opportunity tracking
Operations Manager (OM)
Oversees TLs and client ops
- Team performance dashboards
- TL accountability tracking
- Client escalation queue
- Resource allocation and capacity
- Quality assurance metrics
Team Leader (TL)
Manages VAs directly
- VA assignment management
- Daily check-in tracking
- Time Doctor summaries per VA
- Weekly update submission forms
- Performance coaching notes
Virtual Assistant (VA)
Day-to-day task execution
- Daily task assignments
- Time tracking integration
- Client-specific SOPs and playbooks
- Communication logs
- Training resources
CEO / Admin (Brad)
Full visibility across all roles
- Company-wide KPI dashboard
- Revenue and retention metrics
- Employee performance rankings
- Client health overview
- Payroll and financial summaries
- User management, role assignment, content publishing
Permission Matrix
| Role | Can See | Can Edit | Scope |
|---|---|---|---|
| Client Owner | Own company VA perf, CSAT, billing, resources | Feedback, settings | Own company only |
| Account Manager | Assigned clients' data, CSAT, strategic docs | Client notes, advisory docs | Assigned clients |
| Operations Manager | All TLs under them, team metrics, escalations | Team assignments, escalation responses | Own team hierarchy |
| Team Leader | Assigned VAs, time tracking, daily check-ins | VA notes, weekly updates | Assigned VAs only |
| Virtual Assistant | Own tasks, time logs, SOPs | Task status, time entries | Own data only |
| CEO / Admin | Everything across all data | Everything (user creation, role changes, content push) | Full system access |
Unified System
Dashboard Modules
Each module is a functional area within the unified system. Modules are visible or hidden based on the user's role.
VA Performance
Visible to: Client, AM, OM, TL, CEO
Hours logged, tasks completed, productivity metrics from Time Doctor. Visual charts and trends.
Satisfaction (CSAT)
Visible to: Client, AM, CEO
CSAT scores over time, feedback history, trend analysis. Proactive alerts if scores dip.
Industry Research
Visible to: Client, AM, CEO
Sterling-generated industry intelligence, competitor insights, and strategic advisory documents.
Billing & Invoicing
Visible to: Client, CEO
Current plan, payment history, invoice downloads. Stripe integration.
Team Management
Visible to: OM, TL, CEO
VA assignments, check-ins, coaching notes, weekly updates, capacity planning.
HR & Payroll
Visible to: CEO only
Payroll summaries, benefits data, HR records, team structure. CEO/admin-only access.
Admin Controls
Visible to: CEO only
User creation, role assignment, company onboarding, content publishing, system settings.
Resources & Guides
Visible to: All roles
OA Playbook access, onboarding guides, best practices, training resources, SOPs.
Infrastructure
Data Sources & Integrations
Every data source that feeds into the unified dashboard system and which roles consume it.
Cloudflare D1 (Primary)
The single source of truth. Users, roles, companies, dashboard configurations, settings, and all application data. Database:
oa-client-dashboards-db.All Roles
HubSpot CRM
Master client records, contacts, deal stages, company properties, engagement history. Account ID: 40014162.
ClientEmployeeAdmin
Time Doctor
VA time tracking, productivity metrics, task logs. 306 users. Company ID: XbgGwywYQgAcv3jl.
ClientEmployee
CSAT Surveys
Client satisfaction scores, feedback forms, trend data. Triggered periodically and after milestones.
ClientAM
Stripe / Billing
Invoice generation, payment processing, subscription management. Live keys in Keychain.
ClientAdmin
Zoho Recruit
Hiring pipeline, candidate tracking, VA recruitment workflow. Org ID 884118196.
HRAdmin
Infrastructure
Authentication & Permissions
Authentication Is Not Authorization
The login system handles authentication (who are you?). The role-based middleware handles authorization (what can you see?). Server-side enforcement on every request, with identity derived from secure session tokens.
Current Auth System
Method: Email/password with PBKDF2 hashing + server-side session tokens
Session: Secure HTTP-only cookies with session ID mapped to user record in D1
Role Storage:
role field on the users table in D1 (client_owner, am, om, tl, va, admin)Tenant Scoping: Client users have a
company_id linked to their account. Every query is automatically filtered.Verification: Every API request verifies the session token server-side. Identity is extracted from the database, never from browser parameters.
Role-Scoped Middleware
// Every request goes through role middleware
async function roleMiddleware(request, env) {
const session = await getSession(request, env.DB);
if (!session) return redirect('/login');
// Attach role and scope to the request context
request.user = {
id: session.user_id,
role: session.role,
company_id: session.company_id,
};
// Render the dashboard for this role
return renderDashboard(request.user.role);
}
async function roleMiddleware(request, env) {
const session = await getSession(request, env.DB);
if (!session) return redirect('/login');
// Attach role and scope to the request context
request.user = {
id: session.user_id,
role: session.role,
company_id: session.company_id,
};
// Render the dashboard for this role
return renderDashboard(request.user.role);
}
Infrastructure
User Onboarding Flows
New Client Onboarding
1
Admin Creates Client Company
Brad (or admin) creates a new company record in the D1 database with company name, industry, plan tier, and assigned AM.
↓
2
Admin Creates Client User
Creates a user account with role "client_owner" and links it to the company_id. Sets initial password.
↓
3
Client Logs In
Client visits server.outsourceaccess.com, logs in with their credentials. System detects role "client_owner" and renders the client dashboard.
↓
4
Scoped Data Access
All queries are automatically filtered by company_id. Client only sees their own VA performance, CSAT scores, billing, and resources.
New Employee Onboarding
1
Admin Creates Employee Record
Creates user in D1 with name, role (am, om, tl, va), reporting structure, and start date.
↓
2
Role Determines View
Employee's role is set in the database. This controls what navigation, data, and actions they see when they log in.
↓
3
Employee Logs In
Same URL: server.outsourceaccess.com. System detects their role and renders AM view, OM view, TL view, or VA view accordingly.
Master Index
All Live Dashboards
Every dashboard Sterling has built for the OA ecosystem. Click any link to open.
Client Dashboards (6 Live)
| Dashboard | Client | Status | Link |
|---|---|---|---|
| SSVA Dashboard | Support Services of Virginia | Live | Open |
| FiveTraks Dashboard | FiveTraks / Yardsy | Live | Open |
| Henri's Bakery Dashboard | Henri's Bakery | Live | Open |
| Dreamland BBQ Dashboard | Dreamland BBQ | Live | Open |
| Greenlight Cyber Dashboard | Greenlight Cyber | Live | Open |
| CapCon Commercial Dashboard | CapCon Commercial | Live | Open |
| Palco Enterprises (Original Design) | Palco Enterprises | Reference | Open |
| Acme Roofing Demo (Public-Facing) | Acme Roofing | Demo | Open |
6 live dashboards at client-dashboards-live.pages.dev + Palco original design reference + Acme public demo
Internal Client Dashboards (OA-Facing)
| Dashboard | Type | Status | Link |
|---|---|---|---|
| Palco (Hybrid Design Template) | Internal Client Dashboard | Finalized | Open |
Palco Hybrid = Design Template
Brad's finalized hybrid design. Will be replicated for all client-facing internal dashboards.
Team Leader & Manager Dashboards
| Dashboard | User | Status | Link |
|---|---|---|---|
| TL Performance Dashboard | Mary Ann Palacio (16 clients) | Live | Open |
Executive & Leadership Dashboards
| Dashboard | Audience | Status | Link |
|---|---|---|---|
| CEO Business Intelligence | Brad Stevens | Live | Open |
| CEO Financial Dashboard | Brad Stevens | Live | Open |
| OA Constraints Engine | Leadership | Live | Open |
| OA Ecosystem Map | Strategic planning | Live | Open |
Server Admin & Demos
| Dashboard | Purpose | Status | Link |
|---|---|---|---|
| OA Server (Admin Panel) | User management, org tree, client management | Demo | Open |
| OA Server (Login) | Unified login page | Live | Open |
| 5-Persona Demo | Login as CEO, Director, OM, TL, or Client | Live | Open |
| Acme Roofing Demo | Static single-client mockup (/Acme) | Demo | Open |
| This Architecture Page | Master dashboard architecture map | Live | Open |
Industry Vertical Dashboards
| Vertical | Industry | Status | Link |
|---|---|---|---|
| Pest Control | Pest Control Services | Live | Open |
| Lawn Care | Lawn & Landscape | Live | Open |
| Real Estate | Real Estate | Live | Open |
| Workiz | Workiz Platform Users | Live | Open |
| Restaurant | Restaurant / Food Service | Live | Open |
| Lawn Care Prospects | Prospect landing pages | Live | Open |
Other Sterling-Built Dashboards
| Dashboard | Purpose | Status | Link |
|---|---|---|---|
| Brad's Command Center | ADHD task management | Live | Open |
| Sterling Pipeline | Sterling's active task tracking | Live | Open |
| Post-Call Dashboards | Call follow-up tracking | Live | Open |
| AI Agent Architecture | Sterling agent build plan | Live | Open |
| Network Mining | B2B prospecting strategy | Live | Open |
| Dashboard Manager | Drag-and-drop dashboard ordering | Live | Open |
Org Chart View
Live Dashboards (Org View)
Hierarchical map of all dashboards by audience. Click any card to open.
Client Dashboards (6 Live + 2 Reference)
SSVA
client-dashboards-live.pages.dev/ssva/
Support Services of Virginia
FiveTraks
client-dashboards-live.pages.dev/fivetraks/
FiveTraks / Yardsy
Henri's Bakery
client-dashboards-live.pages.dev/henris-bakery/
Henri's
Dreamland BBQ
client-dashboards-live.pages.dev/dreamland-bbq/
Dreamland
Greenlight Cyber
client-dashboards-live.pages.dev/greenlight-cyber/
Greenlight
CapCon Commercial
client-dashboards-live.pages.dev/capcon-commercial/
CapCon
Palco Enterprises
palco-client-dashboard.pages.dev
Original Design Reference
Acme Roofing Demo
oa-client-dashboard-demo-public.pages.dev
Public-Facing Demo
Internal & Leadership Dashboards
Role-Based Login Demo (10 Personas)
Each role has its own shareable URL. Click any card to see that role's exact dashboard view.
Executive Leadership
Service Delivery Leadership
Head of Service Delivery
#sdhead
Jessica Galvin · 12 modules
Account Manager
#am
Sample AM · 11 modules
Operations Manager
#om
Mars · 12 modules
Department Heads
Frontline Roles
External
Industry Vertical Dashboards
Current State
All URLs & Status
Production (outsourceaccess.com)
| URL | DNS | Status | Purpose |
|---|---|---|---|
server.outsourceaccess.com | Active | Live | Unified dashboard system (all roles) |
Cloudflare Pages (OA Account)
| URL | Status | Purpose |
|---|---|---|
oa-server.pages.dev | Live | Main unified dashboard project (login + dashboard + admin) |
client-dashboards-live.pages.dev | Live | 6 client dashboard pages (SSVA, FiveTraks, Henri's, Dreamland, Greenlight, CapCon) |
oa-dashboard-architecture.pages.dev | Live | This page (master architecture map) |
oa-dashboard-manager.pages.dev | Live | Dashboard drag-and-drop manager |
oa-portal-demo.pages.dev | Live | 10-persona interactive role demo (use #role hash for direct links) |
| Direct role URLs: #ceo · #president · #sdhead · #am · #om · #director · #finance · #tl · #va · #client | ||
Cloudflare Pages (Brad's Personal Account)
| URL | Status | Purpose |
|---|---|---|
oa-portal-architecture.pages.dev | Reference | Original four-brain architecture decision document |
oa-ceo-dashboard.pages.dev | Live | CEO business intelligence dashboard |
ceo-financial-dashboard.pages.dev | Live | CEO financial dashboard |
oa-client-dashboard-demo-public.pages.dev/Acme | Demo | Single-client demo page (/Acme) |
oa-ecosystem.pages.dev | Live | Strategic planning tool (not part of dashboard system) |
oa-constraints-engine.pages.dev | Live | OA Constraints Engine |
Cloudflare Account Note
Dashboard infrastructure (oa-server, client-dashboards-live, oa-dashboard-architecture) lives on the OA Team account (79bf9918...). Standalone dashboards and research pages live on Brad's personal account (f80e8ac3...).
Assessment
Gap Analysis: Current vs Target
Medium
Dynamic Role-Based Views Not Yet Built
The unified login at server.outsourceaccess.com exists with basic auth. The full role-based view rendering (different dashboards per role) still needs to be built. Currently the admin and demo views work, but the role-switching and scoped data queries need completion.
Medium
Hardcoded Demo Data
Some dashboard views still have hardcoded demo data. Needs to be replaced with dynamic data from D1 based on authenticated user's role and company_id.
Enhancement
External Data Integrations Not Connected
HubSpot, Time Doctor, CSAT, and Stripe are not yet syncing data into D1. Workers Cron jobs need to be set up for scheduled data pulls.
Enhancement
Client Dashboard Integration
The 6 live client dashboards at client-dashboards-live.pages.dev are standalone static pages. They need to be integrated into the unified system so client owners can access them through their login at server.outsourceaccess.com.
Implementation
Build Roadmap
Sequenced build plan for the unified dashboard system. Each phase is independently deployable.
✓
Foundation: Auth + Database + DNS
COMPLETE
☑ D1 database created (oa-client-dashboards-db)
☑ Login system with PBKDF2 hashing
☑ server.outsourceaccess.com CNAME active
☑ CF Pages project (oa-server) deployed
2
Role-Based View Rendering
Estimated: ~30 min Sterling build
☐ Build role detection on login (client_owner, am, om, tl, va, admin)
☐ Render different navigation and dashboard layout per role
☐ Implement tenant-scoped middleware for client data
☐ Replace hardcoded demo data with dynamic D1 queries
3
Client Dashboard Integration
Estimated: ~20 min Sterling build
☐ Integrate 6 client dashboards into the unified login flow
☐ Client owners see their company's dashboard after login
☐ Admin can preview any client's dashboard view
4
Data Integrations
Estimated: ~20 min per integration
☐ HubSpot sync (client records, contacts)
☐ Time Doctor sync (VA productivity)
☐ CSAT integration (satisfaction scores)
☐ Stripe integration (billing, invoicing)
Sterling Build Time vs Human Build Time
Total estimated Sterling build: ~2 hours across all remaining phases. Human developer equivalent: $25-40K and 4-8 weeks.