// Module 05 — Command Center + RBAC

One console runs everything — and every privileged action is on the record. One dashboard runs everything — and every important action is written down.

The Command Center is the single operating console for the whole platform, white-labeled down to the admin screen itself. Three server-enforced roles gate every privileged action, an append-only audit trail records who did what, and a cross-surface Dispatch board tells your team exactly what needs attention — across chat, phone, and the outbound queue — before it becomes a problem. Six console surfaces live here: the AI Website Editor, Email Ingestion, Smart Alerts, the Unified CRM, the Platform Core, and the Dispatch board.

The Command Center is the one dashboard for running the whole platform, carrying your brand all the way down to the admin screen itself. Three roles control who can do what, a permanent record shows who did what and when, and a Dispatch board tells your team exactly what needs attention — across chat, phone, and the outbound queue — before it turns into a problem. Six console areas live here: the AI Website Editor, Email Ingestion, Smart Alerts, the Unified CRM, the Platform Core, and the Dispatch board.

← Back to the product overview

// Roles & accountability

Three roles, enforced on the server — not hidden in the UI. Three roles, enforced by the system itself — not just hidden in the screen.

Access control is enforced on every endpoint, server-side. Hiding a button is not security; LINAsystems gates the action itself. Three cumulative roles decide what each operator can do, and what they cannot reach simply is not reachable for them — not just invisible.

Every action is checked by the system itself, not just by what buttons happen to be visible. Hiding a button isn't real security — LINAsystems blocks the action itself, underneath the screen. Three roles, each one adding more access than the last, decide what each staff member can do. What they're not allowed to do, they truly can't do — it's not just hidden from view.

Viewer — read-only across the surfaces their plan includes. Viewers can monitor conversations, knowledge, and the Action Center, but cannot change content, settings, or credentials.
Viewer — can look but not touch, across whatever your plan includes. Viewers can watch conversations, the knowledge library, and the Action Center, but can't change content, settings, or passwords/keys.
Editor — everything except the account and credential surfaces. Editors run day-to-day operations: correcting answers, managing knowledge, working the CRM, handling alerts and escalations.
Editor — can do everything except manage accounts and passwords/keys. Editors handle the daily work: fixing wrong answers, managing the knowledge library, working in the customer database, and handling alerts and hand-offs to a person.
Admin — full control, including account, billing, credentials, and the model-override chain. Admin is the only role that can touch secrets and entitlements.
Admin — full control, including accounts, billing, passwords/keys, and which AI model is used. Admin is the only role that can touch secrets and decide what each plan unlocks.
Append-only audit trail — every privileged action is written to a record that cannot be edited or deleted. Sensitive PII access is itself gated and audit-logged.
A permanent activity log — every important action gets written down in a record that can't be edited or erased. Looking up someone's private information is itself controlled and logged.
Secure sessions — operators sign in against short-lived, secure session cookies, so a stale or stolen tab does not become a standing door.
Secure logins — staff sign in with logins that expire on their own, so an old or stolen browser tab doesn't stay open as a way in.
Login alerts — login events fire subscribable notifications, so your team sees a sign-in the moment it happens, not in a log review weeks later.
Login alerts — your team can get notified the moment someone logs in, instead of finding out weeks later while reviewing old records.

// Module entitlements

You see only what your plan bought — and the boundary is real. You only see what your plan pays for — and that line is real, not just for show.

Module entitlements are enforced the same way roles are: on the server. A module your plan does not include returns an HTTP 403, not a quietly hidden button you might still poke at. The console you log into is exactly the console you bought — Command Center + RBAC and the Platform Core are part of the core of every plan, while phone, CRM, email ingestion, the Website Editor, and the staff AI snap on as modules your plan includes. Add a module and the surface appears; nothing is half-wired or pretend-disabled.

Which modules you can use is enforced the same way roles are: by the system itself, underneath the screen. A module your plan doesn't include is blocked with an error, not just a hidden button you could still click. The dashboard you log into is exactly what you paid for — Command Center + RBAC and the Platform Core come with every plan, while phone, the customer database, email handling, the Website Editor, and the staff AI tool turn on as modules included in your plan. Add a module and it shows up working — nothing is half-built or pretend-locked.

// The other console surfaces

Five more modules live inside the same console. Five more tools live inside the same dashboard.

The Command Center is not just RBAC and an audit trail — it is where the rest of the operational stack is run. Each surface below is a full module in its own right, available by edition and plan.

The Command Center isn't just roles and an activity log — it's where the rest of your day-to-day work happens. Each tool below is a full module on its own, available depending on your edition and plan.

AI Website Editor

Edit your live public homepage by typing plain-English instructions. The AI emits precise structured DOM and CSS edits applied server-side with a one-shot self-heal if a selector misses, plus live preview. Saves are protected so a bad edit rolls back to the clean baseline — redesign without a developer.

Edit your live public homepage just by typing plain-English instructions. The AI makes precise, exact edits to the page, checked and applied behind the scenes, with one automatic retry if something doesn't line up — plus a live preview so you see the change before it's final. Saved versions are protected, so a bad edit can always be rolled back to the clean starting point. You can redesign the page without hiring a developer.

The AI Website Editor module ($149/mo) — included in the Business Growth bundle and every Full Stack plan; available as a standalone module on any plan.

Email Ingestion

Routes inbound staff email through Microsoft Power Automate / Outlook 365 sync and inbound receiving, classifies blasts versus threads, canonicalizes staff addresses, and auto-promotes marketing blasts into knowledge while threaded conversations pass through a human review queue before publishing. Notes marked internal or do-not-touch are excluded end to end.

Pulls in your staff's email automatically, through Microsoft Power Automate / Outlook 365 syncing and direct inbound receiving. It sorts mass mailings from one-on-one conversation threads, cleans up staff email addresses, and automatically adds mass mailings to the knowledge library — while one-on-one threads go through a human review step first, before anything gets published. Notes marked internal or do-not-touch are kept out of this everywhere, with no exceptions.

Available as the Email Ingestion module ($99/mo) — included in the Growth and Full Stack bundles.

Smart Alerts

Operator-subscribable notifications across email and optional Telegram push, with configurable recipients, quiet hours, and custom triggers. Alerts fire on escalations, login events, deploys, and knowledge and health events. Delivery is best-effort — a Telegram outage never breaks a live request.

Staff can subscribe to alerts sent by email and, if you choose, by Telegram push notification — with control over who gets them, quiet hours, and which events trigger one. Alerts go out for hand-offs to a person, logins, software updates, and knowledge or system-health events. Delivery is best-effort — if Telegram happens to be down, it never breaks anything else that's running live.

Both editions, every plan — part of the core (listed as "Notifications").

Unified CRM

A single contact database that merges chat, phone, and email interactions into one record per person, auto-deduplicated by email then phone then session. One-click CSV export (contact exports gated and audit-logged), aggregated first/last-seen and session counts, and permanent per-person erase that scrubs PII across all channels. Sensitive PII is redacted by default in admin views.

One contact database that combines chat, phone, and email into a single record per person, automatically removing duplicates by matching email, then phone, then session. You can export contacts to a spreadsheet with one click (exports are controlled and logged), see when each person first and last showed up and how many sessions they've had, and permanently erase a person's private information across every channel if asked. Sensitive personal information is hidden by default in admin views.

Available as the CRM module ($149/mo) — included in the Growth and Full Stack bundles. Campaign = Supporters CRM; Business = Customer CRM.

Platform Core — live model switching, Public API & Webhooks Platform Core — switch AI models live, plus a Public API and Webhooks

The shared foundation every plan includes: a config and credentials registry, the immutable prompt safety floor, crash-safe atomic state writes, rate limiting, and the model-override chain that lets an admin switch the live LLM (Google Gemini or OpenAI) from the dashboard with no redeploy. Secrets live in a managed secret store and are never displayed, logged, or returned by the API. Also includes a read-only Public API v1 (API-key gated, rate-limited per key, default-off) and an outbound webhooks system that fires authenticated POST events to any URL you configure when specified platform events occur — enabling integrations with your CRM, ticketing, or analytics tools without a custom build.

The shared foundation every plan includes: a settings and password/key registry, a fixed set of safety rules the AI can't be talked out of, safe and reliable data saving, traffic limits to prevent overload, and the ability for an admin to switch the live AI model (Google Gemini or OpenAI) right from the dashboard with no software update needed. Secrets are kept in a secure, managed vault and are never shown, logged, or sent back out by the system. It also includes a read-only Public API v1 (locked behind a key, rate-limited, off by default) and an outbound webhooks system that sends a verified notification to any web address you set up whenever certain events happen — letting you connect your own customer database, ticketing, or analytics tools without custom-building anything.

Both editions, every plan — part of the core. Public API and webhooks require explicit enablement.

// Dispatch board & Priority Action Center

One view of everything that needs a human — across every surface. One screen that shows everything that needs a person's attention — across every tool.

Operators should not have to hunt for problems across four separate panels. The Dispatch board is a cross-surface rollup of open work, and the Priority Action Center surfaces the things that quietly degrade an AI operation if left alone — together in one place, refreshed on every login.

Your staff shouldn't have to dig through four separate screens to find problems. The Dispatch board pulls open work from everywhere into one list, and the Priority Action Center flags the small issues that quietly hurt an AI system if nobody fixes them — both refreshed every time someone logs in.

Dispatch boardAggregates open work from every surface: review-queue triage, phone callbacks, at-risk supporters flagged by the intent layer, and messages awaiting send-queue approval. A single count — not four separate panels — so your team knows the workload the moment they log in. Each source is fail-safe: a broken source contributes zero, never breaks the board.Pulls open work together from everywhere: items waiting for review, phone calls to return, people who seem at risk of leaving flagged by the system, and messages waiting for approval before they're sent. One single number — not four separate screens — so your team knows the workload the moment they log in. If one source breaks, it just contributes nothing; it never breaks the whole board.

Missing credentialsFlags an LLM key, phone credential, or email integration that is absent or not yet wired, so a surface never silently fails for your visitors.Flags it when an AI key, phone setup, or email connection is missing or not finished, so a tool never quietly fails on your visitors without anyone noticing.

Stale knowledgeSurfaces knowledge that has drifted or not refreshed, so the assistant is grounded in current facts rather than yesterday's answer.Points out information that's gone out of date or hasn't been refreshed, so the assistant answers with today's facts instead of yesterday's.

Flagged repliesRaises answers and escalations that need a human eye, routing the uncertain or sensitive moments to your team instead of letting them pass.Surfaces answers and hand-offs that need a person to look at them, sending unclear or sensitive moments to your team instead of letting them slide by.

Tied to alertsThe same events that appear in the Action Center and Dispatch board can fire Smart Alerts over email and optional Telegram, so attention items reach your team even when no one is logged in.The same events shown in the Action Center and Dispatch board can also send Smart Alerts by email and, if you choose, Telegram — so urgent items reach your team even when nobody's logged in.

// Why it holds up

Built to be trusted with your name. Built so you can trust it with your name on it.

The Command Center is built on a platform running in production — the same engine running in a real, live operation, not a prototype — and the whole system is backed by 2,600+ tests passing, run before every deployment. Role enforcement, entitlement boundaries, and the audit trail are the parts you most need to be true under pressure, so they are enforced in code rather than assumed in the interface. For the full picture of isolation, secrets handling, and the safety floor, see our security page. Live in days, not weeks.

The Command Center runs on a platform that's already live in real use — the same system running a real operation, not a prototype — and the whole thing is backed by 2,600+ automated tests that run before every update. Role enforcement, plan boundaries, and the activity log are exactly the parts that need to hold up under pressure, so they're built into the code itself, not just assumed to work because the screen looks right. For the full picture on isolation, how secrets are handled, and the safety rules, see our security page. You can be live in days, not weeks.

Read how we handle security and isolation →

// Live demo

See it answering real questions right now Watch it answer real questions, right now

The live demo runs the exact system that ships to customers — try it as a campaign or as a business.

This demo is the exact same system real customers get — try it set up as a campaign or as a business.

Request a Demo See the campaign demo → See the business demo →