Short write‑ups of problems we hit running a real commerce operation and what we changed in the code because of them. No product announcements; just the reasoning.
We read only the Gmail inbox, on purpose, and real customers were getting lost in Gmail spam. We now read the spam folder too. Rules clear most of it, a System One model sorts the rest for about four cents a month, anybody who has bought from us gets straight through, and nothing out of spam gets to open a file on its own.
Staff access in aiku is granted by job position — "dispatch clerk in the Spanish warehouse", "customer‑service supervisor for the UK shop" — not by ticking permissions. Positions expand to roles, roles to permissions, all scoped to the group, organisation, shop or warehouse they name. Why we chose that, how a permission is checked in the same place for the UI, the API and the MCP server, the "team id" that makes it all silently false if forgotten, and the things we refuse to do with an admin flag.