There is a specific kind of humility that comes from running 7 industry persona tenants against a live production environment and watching your authz matrix test every single role check. This week, our work on AdminOS and JarvisOS was less about shipping shiny new buttons and more about nailing the unglamorous plumbing that keeps real businesses running.
Catching What the Database Drops
Let’s start with the database layer. In our API routes, we had a silent vulnerability: 46 distinct endpoints could potentially leak raw Postgres error strings back to the client if a query malformed or a constraint failed. That is a security risk and a terrible user experience. We audited every single one of those 46 routes, routing exceptions through a unified validation layer that returns graceful, type-safe responses.
Next came the hard delete problem. When building rapidly, it is easy to write a quick DELETE FROM query. But in enterprise systems, especially when managing finance books, client records, and POPIA compliance registers, deleting data is a cardinal sin. We hunted down six legacy hard-delete methods and refactored them into soft deletes, ensuring our audit gates remain unbroken.
The SAST Calendar Sweep
One of the most insidious bugs we tackled this week involved dates. Compliance countdowns and licence expirations were drifting by an hour or two because of server-client timezone mismatches between 00:00 and 02:00. We implemented an app-wide SAST (South African Standard Time) sweep.
We rebuilt our SA statutory calendar on SARS-verified dates that roll forward monthly. Persona provisioners now use this TypeScript calendar, ensuring that when an SME back-office agent checks a tax deadline or a sequence broadcast date, the calendar matches the physical reality of the business owner sitting across the screen.
Making WhatsApp and Sequences Work
Finally, we tackled the reach and messaging engine. POPIA section 69 requires explicit, verifiable consent for broadcasts and sequences. We wired up POPIA s69 consent checks directly into our broadcast enrolment pipelines. Combined with Meta Tech Provider coexistence plans and clean template execution, WhatsApp, NPS, and n8n automations finally click together without silent failures.
When totals stop silently at 1,000 rows because of pagination oversights, you fix the pagination. When permissions need validation down to the method level, you write the matrix. That is what building real systems looks like.
Top comments (0)