DIY playbook
Build a Company OS
yourself.
The high-level playbook we follow on every build: the key steps in each phase, and the traps to avoid. This is the short version.
Phase 01
Map your company
Know what you have before you build anything.
Key steps
- 1.1List every system your team uses, what's in it, and who owns it.
- 1.2Write down the questions people ask most, and where the answers live today.
- 1.3Map your key workflows step by step, including the exceptions.
- 1.4Pick three first use cases with a clear payoff.
- 1.5Decide how you'll measure success before you start.
What you'll have at the endA system inventory, a workflow map and three scoped use cases.
Watch out for
- Starting with the tools, not the questions. The questions decide the design.
- Skipping the exceptions. That's where most of the real work hides.
System inventory
| System | What's in it | Owner | Sync |
|---|---|---|---|
| Gmail | Customer email | Ops | Webhook |
| HubSpot | Deals, contacts | Sales | API · 5 min |
| QuickBooks | Invoices, payments | Finance | Nightly |
| Google Drive | Contracts, SOPs | Everyone | Change feed |
| Slack | Decisions, threads | Everyone | Events |
First three use cases
1Answer customer questions, with sourcesSupport
2Write the Monday leadership reportLeadership
3Match invoices to paymentsFinance
Phase 02
Design the knowledge graph
Decide what your company is made of, and how it connects.
Key steps
- 2.1Define your core object types: customers, people, deals, projects, documents, decisions.
- 2.2Give every object a stable ID, and decide how duplicates get merged.
- 2.3Define the links between objects, and what each link means.
- 2.4Decide what history you keep: every change, or only the latest.
- 2.5Write down which actions are allowed on each object, and by whom.
What you'll have at the endA schema of object types, fields, links and allowed actions.
Watch out for
- Modeling your org chart instead of your work.
- No plan for duplicates. “Acme”, “Acme Inc” and “ACME Corp” will all show up.
Swipe to see the whole schema.
Stable IDsMerge duplicatesKeep historyAllowed actions
Phase 03
Connect your tools
Get data flowing in, and permission to act back out.
Key steps
- 3.1Set up secure access for each system: OAuth or a service account, never a personal password.
- 3.2Choose how each source syncs: webhooks, polling or change feeds.
- 3.3Backfill history carefully, and respect each system's rate limits.
- 3.4Map every field to your graph, and log what didn't match.
- 3.5Monitor every connector, so a broken sync can't go quiet.
What you'll have at the endLive, monitored connectors with a field map for each system.
Watch out for
- Tokens that expire on a Friday night and fail silently.
- Two systems both claiming to be the source of truth for the same field.
SourceAuthSyncMapMergeGraph
Field map · HubSpot deal5 of 42 fields
dealnameDeal.name
amountDeal.value
dealstageDeal.stage
closedateDeal.close_date
companylink to Customer
SyncingLast sync 2 min ago · 1,204 records · 3 unmatched
Want the full breakdown?
This is the short version. Get the full architecture map and our 100+ step build checklist, free.
Phase 04
Make your documents searchable
Turn files into answers you can check.
Key steps
- 4.1Pull in files, email and recordings, and keep them in sync.
- 4.2Extract the text: parse PDFs, run OCR on scans, transcribe audio.
- 4.3Split documents into chunks that keep their meaning and their page numbers.
- 4.4Index each chunk twice, by keywords and by meaning, then add a re-ranker.
- 4.5Carry permissions onto every chunk, and link chunks to graph objects.
What you'll have at the endA search index where every answer has a source and a page.
Watch out for
- Chunks that cut a table or a clause in half.
- Search that finds a document the person asking isn't allowed to see.
IngestExtractChunkEmbedIndexLink
Chunk 18 of 42Contract v4.pdf · page 4
“…the Customer receives 10% off in year two, provided the renewal is signed by June 30…”
Linked toDeal: Renewal 2026 · Customer: Acme CorpWho can see itSales, FinanceIndexed byKeywords + meaningUpdatedWhen the file changes
Phase 05
Lock down security
Everyone, people and agents, sees only what they should.
Key steps
- 5.1Connect single sign-on, and map people to roles.
- 5.2Label your data by sensitivity: public, internal, confidential, restricted.
- 5.3Enforce permissions at every layer: graph, search, tools and answers.
- 5.4Mask private data before it reaches any AI model.
- 5.5Log every question, answer and action in an audit trail.
What you'll have at the endRole and label rules, enforced everywhere, with a full audit log.
Watch out for
- Permissions checked in the app, but not in the search results.
- API keys pasted into prompts or config files.
Roles × data labels
| Role | Public | Internal | Confidential | Restricted |
|---|---|---|---|---|
| Everyone | ||||
| Sales | ||||
| Finance | ||||
| Agents |
policy: restricted-finance
label: Restricted
people: Finance, Leadership
agents: read only# never export
mask: bank numbers, SSNs
audit: every access logged
Phase 06
Build automations
Let routine work run itself, safely.
Key steps
- 6.1Pick a trigger for each job: a schedule, an event or an API call.
- 6.2Make every step safe to run twice, so a retry can't pay an invoice twice.
- 6.3Add retries, a dead-letter queue and alerts for anything that fails.
- 6.4Put an approval step in front of anything that moves money or emails customers.
- 6.5Log each run with its inputs, outputs and result.
What you'll have at the endAutomations that retry safely, ask before big actions, and report every run.
Watch out for
- An automation that sends the same email 400 times after a retry storm.
- Failures that land in a log nobody reads.
automation: match-incoming-invoices
trigger: email to [email protected]
steps:
1 extract the invoice fields
2 match the purchase order
3 if over $10,000 → ask a finance lead
4 create the bill in QuickBooks
safe to retry: key = invoice number
on failure: retry 3× → alert #finance-ops
Recent runs
09:14INV-2231Matched and posteddone
09:20INV-2232Over $10,000waiting
09:31INV-2233Supplier API downretry 2/3
Want the full breakdown?
Every step, decision and check we use on a real build, sent straight to your inbox.
Phase 07
Add your first agent
One role, done well, before you add more.
Key steps
- 7.1Pick one role with clear rules and a clear finish line.
- 7.2Give it only the tools it needs, each with the narrowest permission.
- 7.3Build a test set of real cases, with the right answer for each.
- 7.4Run it in shadow mode first: it suggests, people decide.
- 7.5Set spending caps, and route easy tasks to cheaper models.
What you'll have at the endOne agent with scoped tools, a passing test set and a budget.
Watch out for
- Launching without a test set, then arguing about whether it's any good.
- Giving an agent write access “just for now”.
Rollout ladder
1
Shadow
Suggests. People decide.
2
Supervised
Drafts. People approve each one.
3
Trusted
Acts on low-risk tasks.
4
Scaled
More roles, same rules.
agent: collections-assistant
role: follow up on unpaid invoices
tools: invoices.read · email.draft · crm.note
rules: never promise discounts
escalate anything over 90 days
tests: 60 real cases# pass bar 95%
budget: $15 a day# cheap model first
Phase 08
Run it in production
Keep it correct, fast and affordable, every week.
Key steps
- 8.1Trace every run: each step, each model call, each cost.
- 8.2Re-run your tests on every change to prompts, tools or models.
- 8.3Version everything, and practice rolling back.
- 8.4Set alerts for cost spikes, slow answers and falling quality.
- 8.5Review what people corrected, and feed it back into the tests.
What you'll have at the endA system someone owns, with alerts, rollbacks and a weekly review.
Watch out for
- A model update that quietly changes answers across the company.
- Nobody owning the system after launch.
Production checklist
Traces on every runDone
Tests run on every changeDone
Rollback practicedDone
Cost alert at $50 a dayDone
Weekly review of correctionsDone
Backups restored and testedDone
Model upgrade planIn progress
Alert: answer quality fell 4% after a model update. Rolled back to v2.3 while the tests are fixed.
What it takes
The team you'll need.
A Company OS touches every part of the stack. Plan for these skills, in-house or hired.
Data engineering
Connectors, sync, data quality and history.
Search & retrieval
Chunking, indexing, ranking and relevance tests.
LLM engineering
Prompts, agents, evals and model routing.
Integrations
APIs, auth, webhooks and rate limits for every tool.
Security & identity
Single sign-on, permissions, audit and data masking.
DevOps & on-call
Hosting, monitoring, backups and incident response.
Product & design
Apps and dashboards people actually use.
Decisions you'll make along the way
Where does the graph live?
A relational database with links, or a dedicated graph database.
How does search work?
Keywords plus vectors, with a re-ranker on top.
What runs the workflows?
A durable queue with schedules, retries and dead letters.
Which models, and when?
One gateway in front of several providers, routed by task.
How do you know it's right?
A test set per use case, graded on every change.
Cloud or on-premise?
Your cloud account, a managed service, or your own hardware.
Free
Want the full breakdown?
This page is the short version. The full breakdown is what we'd hand an engineering team on day one.
- The full architecture map, with every component labeled
- Our 100+ step build checklist, phase by phase
- The decision guide: what to choose, and when
- Security, testing and go-live checklists
Need help?
Talk to an engineer.
Stuck on a phase, or want a second opinion? Tell us where you are. We'll help with the hard parts, or build it with you.