The problem we're solving
Today, the retailer's contracts live in a shared SharePoint folder. Permissions there broke down long ago — inheritance was overridden site by site until, in practice, everyone can open everything: a UK rep can read a US customer's confidential pricing, and nobody can prove who looked at what. Nothing watches renewal dates or price-increase clauses, so contracts quietly auto-renew on stale terms and entitled increases go untaken.
- Confidential pricing — visible to all
- Other regions' contracts — open
- Who viewed what — not tracked
- Renewal deadlines — unwatched
- You see a contract because its account is in your Salesforce book
- Restricted agreements need an explicit grant — even for read-all roles
- Every view, download and edit is logged
- Notice deadlines & price adjustments are tracked and alerted
The whole product is one idea: access follows the Salesforce relationship. A person sees the contracts for the accounts they own or sit on the team for — nothing more — and that rule is enforced in one place, on every single query.
Alice, a US rep, signs in
Alice Chen is a RELEX account executive; she owns roughly a dozen customer accounts in Salesforce. When she opens her contract list, the system quietly joins her login to her Salesforce user, resolves the accounts in her book, and shows only those contracts — 94 of the 1,032 in the system. She never sees a control that hints the other 938 exist.
| Title | Account | Type | Status | Notice deadline | Value |
|---|---|---|---|---|---|
| Greenfield Grocers — Master Supply Agreement 2026 | Greenfield Grocers | msa | active | 2026-11-04 | $480,000 |
| MetroMart Stores — Master Services Agreement | MetroMart Stores | msa | active | 2027-03-04 | $1,250,000 |
| MetroMart Stores — SOW: In-Store Analytics Rollout | MetroMart Stores | sow | active | 2026-08-13 · 7d | $60,000 |
| MetroMart Stores — Amendment No. 1 (Volume Rebate) | MetroMart Stores | amendment | active | 2027-03-04 | $150,000 |
| RheinWare GmbH — Supply & Logistics Agreement | RheinWare GmbH | msa | active | 2027-09-20 | €410,000 |
| RheinWare GmbH — Renewal Addendum 2026 | RheinWare GmbH | renewal | active | 2028-06-01 | €90,000 |
A slice of Alice's 94-contract book. The other 938 contracts — every colleague's accounts — are absent, not just hidden behind a filter.
Alice owns RheinWare, a German account — the retailer is multinational, so values carry their own currency (USD, EUR, GBP) and are never mixed together.
The same door, six different views
This is the heart of it. Every person opens the exact same page — and the system shows each of them a different, correct slice. A rep sees their book; their manager sees the union of the reps they manage; legal, finance and executives see the whole portfolio — except restricted agreements, which stay locked even to read-all roles until access is explicitly granted.
- BritMart (UK) — owner
- EuroFresh (FR) — owner
- RheinWare — on the account team
- Alice's Greenfield / MetroMart
- Everything Alice sees
- + everything Ben sees
- Restricted addendum — still locked
- Accounts outside her team
- All accounts, all regions
- Restricted addendum — granted to Finn
- Owns the price-increase pipeline
- Sees & edits everything, restricted included
- Runs the migration review queue
- Whole portfolio, read-only
- Restricted addendum — hidden (no grant)
- Greenfield Confidential Pricing Addendum
- Hidden even from Alice, who owns the account
- Only legal + explicitly granted users
A restricted contract is hidden even from the rep who owns the account and even from executives. Confidentiality overrides the ordinary book-of-business rule — only legal, or someone explicitly granted, can open it. That's how a sensitive pricing addendum stays sensitive.
Opening a contract
Alice clicks into the MetroMart Master Services Agreement. She sees the structured record — parties, dates, renewal terms, value — the version history of the PDF, its amendment chain, and any notes. The PDF itself is streamed through an authenticated gate: even the file's web address is useless to anyone not allowed to see the contract.
Contract details
Files & chain
Amendment chain
Notes
Files live outside the web root and are served only through a permission check. Ask for a file you're not allowed to see and the answer is an indistinguishable "not found" — the system never even confirms the document exists.
The renewal that won't slip through
Most tools alert you when a contract expires — by then it's too late, because an auto-renewing contract already rolled over when the cancellation window closed. Contract Manager tracks the date that actually matters: the notice deadline — expiry minus the notice period — and warns on a 90 / 60 / 30 / 7-day ladder, escalating to managers and legal if nobody acts.
| When | What | Contract | Fires in |
|---|---|---|---|
| 2026-08-13 | notice deadline | MetroMart — SOW: In-Store Analytics Rollout | 7 days |
| 2026-08-13 | price adjustment | MetroMart — Master Services Agreement | 7 days |
| 2026-09-05 | expiration | BritMart — Mutual NDA (no renewal) | 30 days |
| 2026-11-04 | notice deadline | Greenfield — Master Supply Agreement 2026 | 90 days |
| 2026-08-06 | annual review | EuroFresh — Distribution Agreement (evergreen) | today |
Generated by the nightly alert engine from the real contract dates — idempotent, so re-running never double-sends.
The MetroMart SOW auto-renews. Its 30-day cancellation window closes on Aug 13 — not when it expires. Alice gets seven days' warning to decide, instead of discovering next year that it renewed on last year's rate.
Finding money left on the table
Finn, in finance, opens the price-increase pipeline. Many contracts allow an annual CPI-linked increase — but tracking dozens of clauses with different dates by hand means increases quietly get missed. The pipeline surfaces every contract whose adjustment date has passed with no increase applied: entitled money nobody has claimed.
| Opportunity | Account | Index | Adjustment due | Cap | Current value | |
|---|---|---|---|---|---|---|
| Greenfield Grocers — Master Supply Agreement 2026 | Greenfield Grocers | CPI | 2026-07-27 · overdue | 5% | $480,000 | Notify |
One opportunity in the demo set — a real query: adjustment date ≤ today, and no notified/applied/skipped increase on record.
Finn moves each opportunity through Notify → Apply. On apply, the system records the percentage and old→new value, updates the contract, and rolls the next adjustment date forward a year — so the clock restarts automatically and the same money is never missed twice.
Migrating the old files — with AI doing the typing
The thousands of PDFs in SharePoint don't have structured data — just documents. Rather than have legal hand-key every field, the system reads each PDF and uses AI to extract the metadata into a review queue. Legal sees the document and the proposed fields side by side, with a confidence score on each. They confirm or correct — nothing goes live without a human — and approve.
Source document
MASTER SERVICES AGREEMENT
Extracted — confirm or correct
Real AI output from the demo data. Amber scores (< 0.6) flag fields the reviewer should check first.
The suggested Salesforce account is pre-selected, high-confidence fields are pre-filled, and low-confidence ones are highlighted amber. Legal's judgement is the gate — a contract only becomes active when a person approves it.
The dashboard, and the paper trail
Everyone lands on a dashboard scoped to their slice: what's expiring, what needs a decision, and the portfolio totals — kept per currency, never summed across. And behind it all, legal has a complete audit log: every view, download, edit and approval, by whom and when — the record SharePoint never kept.
Portfolio value — grouped by currency (never mixed)
| When | Who | Action | Contract | IP |
|---|---|---|---|---|
| 2026-08-06 09:14 | alice.chen | contract.view | MetroMart — MSA | 10.2.14.5 |
| 2026-08-06 09:15 | alice.chen | file.download | MetroMart — MSA v2 | 10.2.14.5 |
| 2026-08-06 10:02 | finn.morgan | price.notified | Greenfield — MSA 2026 | 10.2.7.9 |
| 2026-08-06 11:38 | dana.legal | review.approve | MetroMart — SOW (migrated) | 10.2.3.1 |
| 2026-08-06 11:40 | ben.okafor | file.denied | — (not permitted) | 10.9.1.2 |
The last line matters: Ben tried to open a file he isn't permitted to see, and the system logged the denial. Nothing happens to a contract without a name and a timestamp attached to it.
Verifying it — "view as" any user
"How do I know a rep can't see the wrong contracts?" Dana, in legal, doesn't take it on faith. From the admin screen she picks any person and enters view-only impersonation — the whole application re-renders as exactly what that user sees. A persistent banner makes the mode unmistakable, and while it's active every edit, approval and price action is disabled: she can look, but nothing can happen under someone else's name. Starting and stopping are both written to the audit log.
| Title | Account | Type | Status | Value |
|---|---|---|---|---|
| Greenfield Grocers — Master Subscription Agreement 2024 | Greenfield Grocers | msa | active | $480,000 |
| MetroMart Stores — Order Form: Demand Forecasting | MetroMart Stores | renewal | active | $1,250,000 |
| RheinWare GmbH — Order Form: Replenishment | RheinWare GmbH | sow | active | €410,000 |
| …91 more — exactly Alice's book, nothing else | ||||
Dana sees precisely what Alice sees — 94 contracts, not the full 1,032 — because the scoping is driven by Alice's identity, not Dana's read-all role. The amber bar and disabled actions are always on while viewing.
Impersonation is for seeing, never acting. The system re-checks the real admin's own privilege on every request — a copied or tampered session can't grant it — and blocks every write, so the audit trail can never show Alice doing something Dana actually did. It's the cleanest way to confirm the access model is behaving, and to support a user by seeing exactly what they see.