Founder-in-the-loop outreach workspace at /founder/[token]/outreach

Status

DECIDED

Context

The outreach campaign infrastructure (launched 2026-04-12) seeded 739 no-website churches with AI-drafted emails but had no UI for the founder to review and approve sends. The only path to send was copy-paste from the database — not viable at even 5–10 sends per session.

Cold outreach to churches requires per-message founder judgment. These are pastoral relationships. A mis-targeted email or wrong church name in a draft damages trust irreversibly. Fully automated cold sends were never an option.

CASL compliance also requires explicit consent management — the DNC flag (churches.email_do_not_contact) must be enforced at the send layer, not just at the seeding layer. Any interface that bypassed the DNC check would be a compliance failure.

Decision

Build a founder-gated workspace at /founder/[token]/outreach (token-authenticated, founder-only) with:

Draft list with status filters (drafted/approved/scheduled/sent/replied/bounced)
Row drawer with inline subject/body editor and church-context sidebar (persona hook, research_json)
Bulk select + bulk approve/skip
DNC-enforced query helper — auto-excludes status='unsubscribed' AND churches.email_do_not_contact=true
"Create Gmail Draft" button — calls Gmail API via founder_google_tokens, writes gmail_draft_id, labels outreach-2026-04
Manual "Mark sent" button as fallback

Every outreach send requires founder approval. There is no auto-send path.

Rationale

Pastoral relationships require human judgment on every cold outreach. AI drafts the email; the founder reads, edits, approves, and sends. This is not a bottleneck — it is the product's trust model. A "set and forget" cold email system for churches would be antithetical to the ChurchWiseAI brand and a CASL liability.

Token-gating the workspace to the founder prevents any agent or automated system from sending without a human in the loop.

Consequences

Good: Every send is founder-reviewed. CASL compliance enforced in the query layer. Gmail draft flow means sends appear in the founder's Sent folder with correct threading.
Bad: Throughput is bounded by founder review time. A 5/10/20 send per day cadence is realistic; automated scale is not possible without changing the model.
Reversible? The architecture supports adding a scheduled send queue later, but the founder-approval gate is intentional and should only be removed with explicit founder sign-off.

Alternatives considered

Fully automated sends — rejected outright; CASL requires consent management, and pastoral cold outreach requires human judgment on each message.
Batch approve-all, then auto-send — rejected; even bulk approval requires the founder to have read each email. The drawer pattern enforces that reading happens before approving.

Status​

Context​

Decision​

Rationale​

Consequences​

Alternatives considered​

Links​