The parts a general CRM gets dangerously wrong.

A rotating six-digit code per household with lockout, and the pickup list checked as well as the code. A custody denial cannot be clicked through — the override exists for "grandma is not on the list yet", never against a court order.

Surfaced where the check-in happens, when it matters, rather than buried on a record nobody opens on a Sunday morning.

Background checks, clearances and restrictions are modelled separately, because a restriction has to be able to beat a clearance. Expiry is derived rather than stored, so nothing is "current" because a field went stale.

Two unrelated adults. A married couple alone does not satisfy the policy, and the system knows that.

Gifts land on the household rather than the individual, tagged to a designated fund carrying its restriction and general-ledger account.

Household gifts deduplicated, the tax year sliced in your own timezone so a late-December gift stays in December, quid-pro-quo deducted, non-cash described but never valued, and the IRS §170(f)(8) wording included. Issued in January for a human to review, never auto-emailed unread.

Cash and cheque batches will not close while there is a variance, with no override. That is the entire point of counting the plate twice.

Grade is derived from a birthdate and your school-year settings, with your district cutoff and your promotion date as separate dates — because they are. Held back or homeschooled is an explicit override with the reason recorded.

Staff, pastoral and clergy-only, enforced in the engine rather than hidden in the interface. There is no "admin sees everything" branch.

Import households, individuals and contributions with a dry run and a fund-mapping step first. Every imported row is ledgered, so a rollback removes exactly what came in and nothing that arrived meanwhile.