Kintsu Portal

TL;DR

I led this for Simple Cortex as product and design lead, from blank schema to opening day. I was the sole human author, with Claude Code as orchestrator.

The proof I trust most. A blank schema became 15 deployed pages in 72 hours. 544 tests passed at the foundation merge. A PHI gate scans every migration and has caught zero PHI. The cockpit-first framing, the pricing-engine boundary, and the PHI-free architecture were my calls.

The cockpit ships the same message the whole build carries: a daily surface for decisions, not another admin panel full of settings.

Daily cockpit · action queue

2 points

12

1Action queue2Calculated KPIs

01 · Action queue

What needs action today sits above the numbers. Required documents to acknowledge are flagged before anything else, so the owner opens to a decision, not a dashboard.

A cockpit, not an admin panel

Admin panels show everything. That was the wrong answer.

A first-time practice owner does not need every object in the database exposed as a table. She needs to know what requires attention, what is ready, what could break before opening day, and what is unresolved that a decision could close.

Running the Simple Cortex engagement, I designed the portal as a cockpit, not a control panel. The system has real complexity: pricing logic, service taxonomy, staff workflows, AI, location controls, compliance, reconciliation. The surface stays calm. The owner should not feel the machinery unless it is asking for a decision.

The product leadership move was choosing that framing first, before a single screen was designed.

What I did

• Designed the owner experience around daily operational attention rather than raw configuration. What needs action, what is safe to act on, and what to trust are visible. Everything else is backstage.
• Built a deterministic pricing model the business could inspect, explain, and trust. Pricing, discounts, commissions, and what-if scenarios route through the engine. The AI layer can explain a margin. It cannot compute one.
• Created a multi-location architecture with role and access boundaries from day one, before the second location existed.
• Added AI only where it supports decisions without transferring authority from the operator. The assistant answers plain-English questions about the business. It reads bounded functions and explains what the engine already computed.
• Built Content Studio for in-portal marketing copy authoring: a brand-rules linter and PHI scrubber with a fully deterministic, zero-token core, then layered an AI reviewer, a brief-to-draft co-writer, and semantic library search on top as a second phase, without reworking any Phase 1 artifact.
• Hardened the Zenoti PHI firewall by replacing heuristic regex detection with a catalog-membership allow-list at the persistence boundary. The shift moved the gate from "block known-bad patterns" to "require known-good catalog rows," which is the only approach that holds against novel field names or encodings.
• Designed the employee onboarding hub with role-scoped, deny-by-construction access: staff see exactly one surface (their checklist), escalation is structurally impossible from the invite path, and the RLS deny sweep is proven by tests rather than asserted.
• Added a profitability layer covering COGS variance, a margin watchlist with a redemption log, and a monthly P&L view, plus three read-only AI tools so the assistant can answer margin and variance questions without ever computing money itself.

The decision that shaped the product was choosing which artifact would lead. The pricing engine was the impressive one: 69 services priced across tiers and roles, overrides written to immutable history, every number traceable. The obvious move was to make that grid the front door and let the owner admire the machinery. I killed that framing. The constraint that forced my hand was the PHI-free assumption I had drawn early: no appointment-level records, no guest names, aggregate operational signal only. That assumption stripped away the transactional detail a conventional admin surface would lead with, which left only aggregate signal to build from, which is exactly what a first-time owner needs on opening day. The privacy constraint did not fight the product. It produced the cockpit. So the grid moved backstage and the daily decision queue became the front door. The pricing engine was the impressive artifact. The cockpit was the right product.

What changed

The practice gained an operating surface before opening day. What began as a 72-hour sprint of 15 pages now covers roughly 17 surfaces, from the compliance sign-off the Medical Director stands behind to the month-end reconciliation that catches drift before it becomes a surprise. Scattered setup decisions became a visible system: what exists, what needs review, what is safe to act on, what to trust.

OPERATIONAL SURFACES

A tour of the surfaces.

01 / 06

←→

Insights

The page I check first. Margins, breakeven, and runway in one read, with the money-losing services named instead of buried.

• The owner replaced a folder of spreadsheets with one place she can stand behind: every service, membership, and expense lives in a system that prices and reconciles them the same way.
• She opens the day to signal instead of silence. Below-cost services, unsigned attestations, expiring credentials, and reconciliation drift surface on their own instead of waiting to be discovered.
• Questions that used to route to her now route to the system. Plain-English answers come from deterministic logic, not model-generated guesses, so the answer is the same one the books would give.
• The second location is designed to be configuration, not a rebuild. The access boundaries shipped before it existed, so a new site slots in as configuration rather than forcing a migration.
• Marketing copy now has a home inside the portal. Content Studio lints every draft against brand rules and scrubs PHI before anything saves, with all safety logic running as pure functions at zero token cost. The AI reviewer and co-writer layer on top for operators who want a second pass or a starting draft.
• Staff onboarding moved from shared documents to a structured hub: each employee sees their own checklist, managers see a progress matrix and get flagged when anyone stalls, and scope of practice lives in the system rather than a PDF.
• The profitability layer surfaces what the pricing engine implied but never showed: which services are losing money against their cost structure, how margins have moved month to month, and where discount usage is running against the cap. The AI reads the same numbers the books use and narrates them in plain English, nothing more.

The design move was subtraction. The platform does a lot. The interface makes only the right things feel urgent.

Reflection

The through-line of this build is what I chose to leave out. The strongest story is not "15 pages in 72 hours," or the 17 surfaces it has since become. It is picking the right surfaces: the owner needed operational confidence, not software theater, and the product leadership sat in what I kept backstage.

A privacy constraint can be a design engine, not a tax. The PHI-free assumption looked like a limit on what the product could show. Held early, it did the abstraction work for me. It forced aggregate signal, and aggregate signal is exactly what the cockpit needed to lead with. Next time I would reach for a hard constraint sooner rather than treat it as a cost to route around.

Some of that structure is a bet on a future that has not arrived. I modeled multi-location access boundaries before the second location existed, guessing at edges I could not yet see. It shipped clean, but it was speculative architecture, and speculative architecture is a debt until a real second site proves the shape right. I would not draw those boundaries the same way again.