Client-facing (AHRI)

AHRI Operating Model (DRAFT for the joint workshop)

The one-pager behind next-action #4 on ahri-build-on-agend-overview.html: who builds what, who operates what, how support flows. Status: DRAFT — Agend-internal until reviewed, then tabled with AHRI · 2026-07-07

Who does what

	AHRI builds & owns	Agend operates & owns	Decided together
Website	WordPress theme, hosting, custom pages & tools built on the API, their own feature data (keyed by Agend contact IDs)	Widget library code, integration plugin updates	Pilot scope
Platform	Their API keys (issuance, rotation, revocation via dashboard), webhook consumers	Gateway, hub, Upbeat sync, uptime, security, docs	Write-phase priority order (phases 3/4 can swap)
Membership core	— (until phases retire it)	Proprietary plugins on AHRI's site: monthly releases continue unchanged through every phase	Retirement sign-off per phase, side-by-side proven first
Data	Anything they store in their own systems	Canonical member record, field-ownership rules, conflict queue operation	Which profile fields are member-editable (phase 1 gate)

Support flow

AHRI-built code → AHRI's responsibility (their devs/agency). Agend supports the contract, not their implementation.
API behaves contrary to /v1/docs → Agend ticket; include the request ID (every call is audit-logged, so we can trace any request end-to-end).
Existing member journeys (join/renew/pay) → current support channel, unchanged.
Escalation — named contact each side; monthly platform check-in during the phased rollout.

Key & environment policy

Keys are scoped (crm.contacts.browse style); browser-exposed keys are browse-only + origin-locked (CORS allowlist per key). ag_test_ for development, ag_live_ for production.
Agend may throttle or suspend a key that threatens platform stability, with notice except in emergencies.

Change management (the platform contract, v0)

/v1 is versioned; breaking changes only via a new version with a published deprecation window (proposed: 6 months — to confirm).
Changelog + advance notice channel for API changes; widgets/plugin follow semantic versioning.
SLA targets: to be tabled (uptime %, support response tiers).
Data portability: AHRI can export its data — including any custom-object data it defines — via the API at any time; no exit penalty, no export fee.

Hard boundaries

No direct Upbeat/Dynamics access for AHRI-built code — everything through the API.
No modification of Agend-supplied plugins; customisation happens beside them (API + widgets), not inside them.
Agend does not host or operate AHRI's WordPress environment; the support matrix (PHP/WP/dependency versions) defines what Agend-supplied plugins are warranted against.

Open before signature

Deprecation window + SLA numbers
Phase order confirmation (or 3↔4 swap)
Phase-1 member-editable field list
AHRI plugin ownership question (see agend-pro code-protection-bridge-runbook.md)
Custom objects preview — whether "model your own programs" (mentoring, awards, SIGs) joins the pilot scope; likely lands before write phases 2–3 (custom-objects-build-plan.md)