Kasi Labs
All blog posts

Workflow apps

How to build a custom CRM around your workflow

Map the records, states, permissions and exceptions behind a custom CRM workflow, then test a private working version without writing code.

6 min read
A modular customer workflow maquette with connected ivory records and a yellow path

A custom CRM is worth building when the valuable part of your work happens after “contact created” or “deal won.” If staff still coordinate onboarding, evidence, delivery, approvals, renewals, or exceptions in spreadsheets and messages, the missing piece may be a workflow app around the customer record—not another collection of CRM fields.

Do not replace a useful CRM on instinct. First decide among three options:

OptionBest fitWarning signFirst test
Configure the CRMThe process follows standard sales, marketing, or service stagesStaff have not tried built-in configuration or need trainingConfigure one stage and run five real cases
Add a workflow layerThe CRM should remain the customer system of record, but a bounded operational process does not fitPeople will need to enter the same data twiceMap ownership and the hand-off before building
Replace the bounded processThe process depends on distinct records, states, permissions, evidence, and exceptionsNobody owns migration or ongoing changesRebuild and test one job, not the whole CRM

Microsoft’s own business-process guidance recognises that organisations customise processes to match how they work. It also distinguishes collaborative processes from prescriptive tasks and supports business actions such as route, escalate, schedule, and approve. Those are useful clues: the problem is often not the contact database. It is the operating logic around it. Microsoft business process flows, custom process actions, choosing a process experience.

01

Start with one customer case, not a feature list

Take a real case from beginning to end. Record what triggered the work, which records people touched, who made each decision, what evidence they needed, and where the case went when something was missing.

A useful specification card contains:

  • the trigger that starts the work;
  • the customer, engagement, request, or other records involved;
  • every meaningful state;
  • the person responsible in each state;
  • evidence required before the next move;
  • common exceptions;
  • information that must be restricted;
  • the event that proves the job is complete.

This is enough to begin with KasiLabs. You describe the actual job in plain words. KasiLabs turns it into a plan you can read, then a private working version your team can test. You do not need to translate your operation into database or software terminology first.

02

Model the work after the sale

Consider a consultancy that manages recurring client renewals. A standard CRM may hold Organisation, Contact, Deal, and Activity. The operational layer might need:

  • Engagement: what service the client receives and who owns it;
  • Deliverable: what must be completed before renewal;
  • Evidence request: what is missing, who must provide it, and by when;
  • Renewal: due date, commercial status, and dependencies;
  • Decision: who reviewed the evidence and the result;
  • Owner: the person accountable for the next action.

The renewal could move through due, evidence requested, ready for review, approved, returned, and closed. A client can provide evidence. A consultant can prepare the case. A reviewer can approve or return it. An owner can manage access and the release. Those rules are clearer than a shared “renewal status” field everyone can edit.

This is an illustrative workflow, not a prebuilt KasiLabs CRM. Your records and states should come from your work.

03

Make ownership visible in the interface

Many CRM workarounds exist because a stage name describes the case but does not tell anyone what to do. “Onboarding” can conceal six different conditions: waiting for the client, waiting for an internal review, blocked by missing evidence, ready for approval, returned for correction, or complete.

For every state, write one accountable owner and one next action. If ownership can change, record the reassignment instead of replacing the old name without explanation. If a deadline passes, decide whether the app should flag, reassign, escalate, or simply report it. Do not automate an escalation policy the business has never agreed.

A useful role queue answers three questions without opening every customer record:

  • What needs my action now?
  • What am I waiting for, and from whom?
  • Which cases have exceeded an agreed deadline or returned for correction?

That is the practical difference between a database that stores customer information and workflow software that helps people complete customer work.

04

Treat permissions as workflow rules

A custom interface is not enough if every signed-in person can see or change every record. Define permissions in business terms:

  • Which client can see this engagement?
  • Can a consultant prepare a decision but not approve it?
  • Can a reviewer see commercial fields?
  • Who can reopen a closed case?
  • Who can export records or change access?

OWASP recommends least privilege, denying access by default, validating permissions on every request, logging appropriate access activity, and testing authorisation logic. A hidden button is not an access control. OWASP Authorization Cheat Sheet.

KasiLabs is designed around controlled access and release decisions. Workspace owners choose who can use an app and what they can do. Your private test should still include a wrong-role attempt: ask one user to open or change a record belonging to another role or client. A failed boundary is a stop sign, not a cosmetic bug.

05

Test the awkward cases before migration

Run at least five cases in the private working version:

  1. An ordinary case that follows the happy path.
  2. An incomplete case that must not advance.
  3. A wrong-role access attempt.
  4. A rejection followed by corrected evidence and resubmission.
  5. A change that needs to be reversed to the previous working version.

KasiLabs keeps the working copy separate until someone with the right role approves the exact release. Earlier versions remain available if the team needs to step back. That gives an operations team a controlled path that does not replace the live process after a polished demo.

06

Decide what remains in the existing CRM

If the CRM remains the system of record, name the boundary explicitly. For example:

  • CRM owns organisation and primary-contact records.
  • The workflow app owns renewal evidence, review state, and decision history.
  • A named owner resolves mismatches.
  • The team tests how records are created, updated, duplicated, and retired.

Do not promise automatic synchronisation until it has been designed and tested. Another app creates integration and maintenance cost. A narrow, owned boundary is the price of the flexibility.

Before release, write a small handover record: the operational owner, source-of-truth systems, access approver, support contact, current release, known limitations, and the next review date. A custom CRM layer should remain understandable when the person who first described it is unavailable.

07

When KasiLabs is the right fit

Choose KasiLabs when the people who know the process cannot write a technical brief, the workflow has meaningful roles and exceptions, and the team wants to try a private version before approving a release. KasiLabs gives the operator a direct route from “this is how the work happens” to tailored working software with access, spending, release, and version controls.

Keep a conventional CRM when standard sales, marketing, or service workflows cover the job. Fix training and data quality before commissioning software. Use traditional development when complex integrations, architecture, or regulatory requirements exceed the verified KasiLabs scope.

If your CRM keeps pushing one important workflow into spreadsheets and messages, describe that workflow in KasiLabs. Start with one real case. Test the ordinary path, the wrong-role attempt, and the exception in private before anything goes live.

08

Ready when you are

Bring one task your team already knows well.

Describe your workflow