Google Sheets
Qualified read-only synchronization for approved workbooks through administrator-controlled OAuth, scheduled collection, validation, lineage, and safe preservation of the last usable dataset.
Current GA 2.0 capability model
Connected data.
Governed operation.
TBOC2 now combines a qualified greenfield deployment path, source-aware ingestion, immutable publication, role-enforced business workflows, executive analytics, and locally operated assistance. This page describes current platform capabilities.
01 Connect02 Validate03 Operate04 Analyze05 Govern
01
Connected data
Bring approved sources into one controlled model.
PostgreSQL
Support for structured business and operational records held in PostgreSQL databases, integrated within the same governed data model.
Excel workbooks
Qualified multi-worksheet Excel ingestion with governed import, removal, and repeat-import behavior.
CSV data sources
CSV files can enter as point-in-time snapshots or be configured as live data on customer systems, with structured validation and canonical publication.
Google Drive workflows
Tested Google Drive connector support for approved files and customer-owned source workflows.
Source ownership
Authority is explicit by data domain. TBOC2 can combine external business records with TBOC-controlled roster and compliance data without confusing ownership.
02
Governed data engine
Only validated data becomes operational data.
Explicit mapping
Named source structures map into defined business entities instead of relying on ambiguous, best-effort interpretation.
Typed validation
Schemas, data types, identifiers, dates, and cross-record references are checked before publication.
Immutable generations
Each accepted import creates a distinct DuckDB generation, providing a stable and traceable operating state.
Atomic publication
A new generation becomes available as one complete publication. Partial results never become the live operating dataset.
Last-good preservation
If validation or publication fails, the previous usable generation remains available to authorized users.
Private query service
Quack serves the published generation through a private, read-only interface to the authorized TBOC2 application layer.
03
Business workspace
A navigable operating system for the business.
Destination-card Home
The role-aware Home page explains each available workspace and opens the selected destination from the entire card.
Executive Summary
Dedicated month-to-date cards show hours, labor cost, billed revenue, and labor margin with the previous two months for visual comparison.
Hours and PO utilization
A rolling three-month hours view and utilization heat map compare recorded hours with available hours by purchase order.
Employee operations
Employee contacts and records connect to timecards, allocations, charge usage, and labor insights, with confidential HR data separately controlled.
Customer and purchase orders
Customer/client directory and managed purchase orders support active business relationships and status lifecycle.
Reports and planning
Contract reports, monthly labor, performance, needs-attention, forecasting, and planning views use the same governed publication.
Business records and Source Sheets
Workspace views connect business and contract-labor records to named authoritative Google Sheet tabs.
Responsive operation
The current workspace navigation and destination cards are qualified for desktop, phone portrait, and phone landscape layouts.
04
Ask TBOC
Flexible questions. Fixed authority boundaries.
Deterministic tools
Known business questions use purpose-built, read-only tools designed for consistent answers and evidence.
Local language routing
A locally hosted language model can interpret unfamiliar wording and select from the approved tools available to the user.
Independent authorization
The model does not grant access. Identity and role enforcement occur separately in the TBOC2 application layer.
No arbitrary SQL
Ask TBOC cannot issue unconstrained database commands or write directly to business records.
Protected HR catalog
Users without HR authority never receive HR-only tools in the catalog available to the local model.
Evidence-backed responses
Answers can retain data provenance, source context, and the publication generation used to produce the result.
05
Identity and security
Least privilege is enforced through the whole path.
Google authentication
Invited users sign in through Google. In Google mode, the platform does not hold a separate TBOC2 password.
Explicit roles
Observer, operator, HR, and administrator responsibilities remain distinct. Administration does not imply HR access.
Server-side protection
Sensitive HR fields are enforced across views, search, sorting, exports, evidence, and Ask TBOC—not merely hidden in the interface.
Credential separation
User authentication and unattended source collection use separate OAuth applications and scopes.
Read-only collection
Source service accounts can be limited to the specific approved workbook or source without project-wide privileges.
Customer-controlled operation
Core database, query, model, and application services can remain inside the customer-controlled environment.
06
Deployment and lifecycle
Operate the platform beyond its first login.
Qualified greenfield installation
GA 2.0 supports a clean customer-controlled installation with explicit environment identity, configuration, licensing, and initial administrator setup.
Connector administration
Administrators manage approved sources and mappings through a dedicated connector workspace.
Local model controls
System settings expose the configured local model separately from the role and tool policies that govern Ask TBOC.
License management
Offline license validation and entitlement controls preserve customer data custody and do not provide a remote shutdown mechanism.
Verified updates and rollback
Same-schema runtime updates validate packages, retain the previous runtime, and restore it if activation fails.
Recovery and audit history
Dedicated administrative views make recovery planning and platform activity visible without combining them with ordinary business access.
Built for the operating model
Custom applications are also available.
TBOC2 can be configured or custom-built around the sources, roles, reporting needs, and governed decisions unique to your organization.