Workflows that carry a submission from draft to done
Draw the states your work moves through and who may move it. Each transition can notify people, generate documents, call your systems and create related records — and every record shows where it is, what can happen next, and why the rest cannot.
The builder
Drawn, not listed
A workflow is a picture of where a record can go. The builder shows it as one — and says, under the picture, what would stop it working before the server has to.
-
A picture, not a list
States are boxes laid out by how many moves it takes to reach them; moves are arrows carrying their button text. Select either and the rail beside the picture edits it.
-
Four quick starts
Review and approve, Ticket, Application, To do — complete workflows you rename, not blank pages. Type a state’s name and its id is derived; nothing to misspell.
-
Guards on the arrow
Who may take a move, the condition it needs, the fields that must be filled first — each edited with pickers and marked on the arrow with a lock, a funnel or a checklist.
-
Actions on the state
What happens on entering and leaving, with the control each kind deserves: a field and a value or formula, a person by name, a template by name, recipients as chips.
-
Checked before you publish
Dead ends, states nothing leads to, two identical buttons, a deadline with nowhere to go — listed under the picture in plain words, one click from the spot.
-
A colour per state
Six colours, chosen once, shown everywhere the state appears: the diagram, the record’s title, the submissions table and the counted state filters above it. Rejected reads as red before anyone reads the word.
Effects
What a transition can do
Moving a record is rarely the whole job. Attach effects to a state and the rest happens with the move — reliably ordered, never able to undo the move that triggered them.
-
Send a notification
Templated email to the assignee, the owner, the creator, any email field on the form or a list field of addresses — ticked, not typed.
-
Generate a document
A PDF from your template, merged with the submission’s values.
-
Request a signature
Each signer gets their own link to a frozen, fingerprinted document; the signed copy carries a certificate, and a later move can require everyone to have signed.
-
Call a webhook
Notify your own systems — restricted to hosts an operator has allow-listed.
-
Send to Zapier
Hand the submission to thousands of other tools without writing an integration.
-
Create a linked submission
Spawn a related record in another form, with the relationship kept.
-
Assign and set fields
Route the work to a person — it appears in their My Work queue, one list of everything assigned to them across every form — and stamp values the next step depends on.
Default deny
Safe is the default, not an option
A transition that names no required privilege still requires one — the platform's default. The easiest thing a workflow author can do is also the safe thing, which is exactly how permission systems should be built.
On the record
Where it is, and why the rest is withheld
A record shows its state in the author's colour, a strip of every state with the current one lit, and the moves the reader may take as buttons. Moves that exist but were withheld are listed with the reason — the privilege, the fields to complete, or that the condition does not hold — without ever showing the condition. A move into a final state asks first, because nothing moves out of one afterwards.
Deadlines
States carry a clock, and the clock takes the transition
Give Review a 48-hour deadline firing Escalate, and a record that stalls stops being invisible: the platform takes the transition a person would have clicked — same conditions, same notifications, same generated documents — and the audit entry says the deadline did it. The one check it does not make is the caller's privilege, because a deadline has no caller: authorisation happened when someone with form:write published that one named transition. Chained deadlines compose: escalation can arm the next state's clock.
Honest by construction
Attempted once, and written down either way
A deadline fires once per stay in a state. If its transition's own condition refuses — the record changed under it — the refusal is recorded in the audit log rather than retried forever, and a person moving the record first simply disarms the clock. Deadlines apply to records created after you publish them; existing records keep the definition they were filled against.
Audited
Every move leaves a record
Who moved what, when, from which state to which — appended to an audit log that neither users nor the application can rewrite. When a decision is questioned months later, the trail is simply there.
Questions
Workflows, plainly
Who can move a submission between states?
Only someone holding the privilege the transition requires. A transition that names no privilege still requires the default transition privilege — leaving the field out is the safe choice, not an open door.
Why is a button missing from a record?
The record says. Moves that exist from its state but were withheld are listed under the state strip with the reason — the privilege needed, the fields to complete first, or that the move’s condition does not hold. The condition itself is never shown, so a record is not an oracle for the rule behind it.
What happens if an effect fails — say, the mail server is down?
The move stands and the failed effect is logged and retried where it can be. Effects that leave the platform run after the transition commits, so an unreachable webhook can never announce a move that then rolled back.
Can a workflow create other records?
Yes. A transition can create a linked submission in another form — a claim spawning a payout request, a ticket spawning a task — and the link between them is kept.
Can a transition depend on payment?
Yes. Payment status is recorded on the submission, so a transition can require payment to have succeeded before it can be taken.
Can a workflow collect an e-signature?
Yes. A “Request a signature” action emails each signer their own link to review and sign a frozen copy of the document, records the evidence — who, when, from where, over which exact bytes — and appends a certificate page to the signed PDF. A later transition can require everyone asked to have signed.
Model your process, not a compromise
States, transitions and effects are configuration — draw them in the browser and change them as your process changes.
No card required.