One workspace. Three layers. Four roles.

At the top is the clinical record. Fourteen editable AI skills draft session notes in five formats, treatment plans in five formats, referral and discharge letters, case conceptualizations, and assessment-results letters. Every prompt is a plain-text file. Practices customize the ones they want to. Clinicians edit and sign. The version of the skill in effect is captured with every draft.

In the middle are the surfaces a practice runs on. The supervision queue with keyboard navigation. The calendar with availability blocks, self-scheduling, and waitlist routing. Billing with per-therapist rates, payment links, and Stripe autopay. The client portal with one-click sign-in links, secure messaging, document upload, and multilingual access. None of these are bolt-ons. They share one audit log, one security model, and one set of permissions.

Underneath is the substrate. Encryption at rest and in transit. An activity log on every read and write. The right-to-erasure workflow that satisfies GDPR and PIPEDA without breaking HIPAA's six-year retention. A multilingual portal with a live translation system. The PIN-locked offline vault for clinicians whose practice doesn't always have wifi. These layers don't have surfaces of their own. They're the things the surfaces depend on.

Four first-class roles share all of it: therapist, supervisor, practice administrator, and client. Each has its own permissions and its own navigation. A dual-role therapist-admin (the way most group-practice owners actually work) gets two themes and one identity, audit-logged accordingly.