What Avyon OS is
Avyon OS is the system Avyon runs on. Eight bounded contexts share one deployment and no database tables — a context reaches another through an event or its owning API, never a cross-schema join — which is what lets a module be extracted later without unpicking the rest. Multi-tenancy is enforced by row-level security in the database rather than by a filter somebody has to remember to add.
15 BUILT SCREENS ACROSS 2 AREAS
What it is made of
Role Dashboards
A distinct view per role — CFO, COO, CISO, Head of Delivery — each reading the contexts it owns.
Margin Control
Margin by project, department, service line and cost centre, against a floor that cannot be silently crossed.
Revenue
Revenue by service line, held against the contract that produced it.
Delivery
Engagements, sprint boards, incidents and the client-facing status derived from them.
Client & Employee Portals
Separate surfaces for a client and for staff, on the same contexts and the same tenant boundary.
How it fits together
Eight contexts, one deployment, no shared tables.
- 01 TENANTIdentityTenant and role resolved from the signed token; never from a URL or a body.
- 02 DOMAINContextsCommercial, delivery, finance, workforce, governance, intelligence and AI, each owning its schema.
- 03 BRIDGEEventsCross-context work travels as an event or an owning-module call. No cross-schema joins.
- 04 PROJECTRead modelsDashboard views composed across contexts through ports, owning no schema of their own.
- 05 SURFACEPortalsClient, employee and admin surfaces over the same boundary.
What is enforced, and where
Isolation is not a query filter
Row-level security runs in the database, so a missed WHERE clause cannot leak a tenant.
Financial mutations are idempotent
Idempotency keys are required on financial endpoints, so a retried request cannot double-post.
Migrations are forward-only
Schema changes move in one direction and are applied as the owner, never by the application role.
Modules stay extractable
No cross-module database access and no direct service injection for mutations, which is what keeps a context separable later.
Who this is for
Chief Operating Officer
Runs delivery across several disconnected tools and reconciles them by hand.
Chief Financial Officer
Learns a project crossed its margin floor after the quarter closed.
Head of Delivery
Has no shared view of engagement health that a client could also be shown.
Questions about Avyon OS
Is this a product or a starting point for a build?
Both, honestly. It runs as the system Avyon operates on. For another organisation it is the foundation an engagement extends, rather than something bought off a shelf and switched on.
Why a monolith rather than services?
Because the boundaries are enforced in code — separate schemas, events between contexts, no cross-module database access — a context can be extracted when there is a reason to. Distributing first buys the operational cost before the benefit.
How is tenant data separated?
Row-level security in PostgreSQL, with the tenant taken from the JWT. The application role cannot read across the boundary even if a query forgets to filter.