Case study · Access control · Regulated onboarding
Controlled Access System for Minors
Allowing minors into an online platform is a legal and operational control problem. A system that enforces rules by design, without human intervention, at scale.
816+ users processed
Zero manual onboarding steps. Every user progressed through the same gates, same sequence, same validation.
100% legal enforcement
Access control works through system logic, not human memory. Policy is executable, not aspirational.
Multi-tool synchronization
Four external systems stay in sync via a single source of truth. No contradictions. One state to trust.
The Real Problem
Minors accessing the platform without completing legal requirements ends with compliance violation
At low volume, manual processes worked. At scale, they break down.
Legal compliance risk
Parental consent enforcement. Data protection. Every step had to be auditable and non-negotiable.
Scale without people
No manual review capacity. The system had to enforce rules on its own, processing 816+ users consistently.
Core constraint
How do you enforce policy at scale without human intervention, when every mistake ends with legal liability?
System design
From linear flow to state-driven access control
Each step is not a task to execute. Each step is a condition that must be verified. Only when a condition is satisfied does the system permit progression.
The redesign shifted ownership from people—who forget, leave, interpret differently—to system logic, which enforces consistently at any volume.
Users move through explicit states. Access is only granted when every required state is completed. If any step fails, the user stops there until the condition is resolved.
Before — linear task flow
If validation fails, consent still gets sent. No clarity on readiness.
After — state-driven access control
No condition verified → no progression. No exceptions.
How it works
Six explicit states, one source of truth
Airtable becomes the operational backbone. All other tools (ActiveCampaign, PandaDoc, Skool) read state from Airtable and write confirmation back. One authority. No contradictions.
User progression flow
Registered
Form submitted with tutor and minor data. Stored in Airtable, awaiting validation.
Opt-In Confirmed
Email confirmed and response received. User qualifies for consent request.
Qualified
Age validated as 13–17. Parental consent form generated and sent.
Pending Signature
Consent form with tutor. System waits for signature completion via PandaDoc.
Signed
Parental consent signed and confirmed. Platform access can now be granted.
Invited
All prior states complete. Access created in Skool. User ready to begin.
Architecture decisions
Why it was built this way
Airtable as backbone
Single source of truth for all user states. All external systems read and write to Airtable. Prevents data drift.
Removed manual review
Manual validation doesn't scale. The system enforces conditions automatically through rules, not human judgment.
Double opt-in as filter
Early filtering reduces downstream load. Users who aren't serious drop before consuming resources like consent requests.
Zero document storage
Only identification numbers collected. Reduces legal exposure. PandaDoc handles secure signature management.
Results
What this delivered
Users processed without manual intervention
Manual onboarding steps required
Legal requirements enforced by system
Compliance by design
Access controlled by system logic, not human memory. Policy becomes executable logic.
Operational scalability
No additional human capacity needed as volume increased. Logic scales, people don't need to.
Cost efficiency
Early filtering eliminated unnecessary consent requests and platform invitations. Lower cost per valid user.
Honest assessment
Known limitations
The system enforces technical access control, not behavioral rules inside the platform. Once someone's invited, what they do in Skool is outside this system's responsibility.
Building this required trade-offs: scalability over identity assurance, automation over flexibility. Those trades were made consciously and they paid off.
What could break
System relies on Airtable, ActiveCampaign, PandaDoc, Skool. If one fails, users get stuck.
Age validated by field only, not document verification. Lower assurance, but higher completion rate.
Stuck users need manual intervention. No retry layer or dead letter channel yet.
Next phase
To increase reliability and assurance
Transferable pattern
State-driven access works beyond user onboarding
This architecture isn't specific to minors. It applies wherever policy-driven decisions need to happen at scale.
Knowledge access tiers
User level → tier → content recommendations → scope.
Team enablement
Employee level → training readiness → material access → certification gate.
Feature rollout
Customer plan → feature state → feature access.
Support routing
Ticket type + user tier + urgency → correct team + right knowledge article.
Takeaway
Translating legal requirements into explicit, enforceable, auditable systems.
Identified this as an access control problem, not a workflow automation problem.
Architected a state machine that scales without human intervention.
Took regulatory requirements and made them executable logic.
Kept four external systems synchronized around one source of truth.
Made conscious decisions about assurance vs. friction, automation vs. flexibility.
Designed for failure modes and recovery strategies upfront.