Letting a church turn its services into a podcast sounds simple: give the
staff an account and a place to upload. The hard part is a single question hiding inside
it — how do you know the person is really from that church? Get it wrong and you
hand a congregation's public voice to a stranger.
Most login systems only have to answer "are you who you say you are?" Ours has to answer
a harder one: "do you have the authority to speak for this specific organization?"
— often when neither the person nor the church exists in our records yet. That
turns a checkbox into a small trust problem, and trust problems are where the loopholes
live.
The gauntlet
A would-be manager passes through a series of gates. Each one narrows "anyone
with an email" down to "someone this church would actually recognize."
open to anyone
Create an accountEmail + password, or Google. We ask nothing about a
church here — no affiliation, no role. An account is just an identity.
↓
the real question
Prove you belong to a churchAn account grants nothing over any church. To
manage one, you have to demonstrate you actually represent it.
↓ two ways to prove it ↓
automatic
Verify the church's email domainA one-time code goes to an address the
church itself controls. Receiving it proves affiliation without us storing anything
sensitive.
reviewed by a human
Or request manual approvalFor churches with no usable email, a person
reviews the request — not an automated rule that can be gamed.
↓
least privilege
First verifier becomes the ownerThey can then invite colleagues at limited
roles. Nobody gets more access than the job needs, and no single account quietly
accumulates control.
The parts that aren't obvious
The people you want aren't in the system. Church staff aren't
users until the day they show up. You can't pre-load a list of "authorized people" —
there is no list. The system has to let a total stranger prove, on the spot, that they
belong to an organization it may know almost nothing about.
The church might not be in the system either. Plenty of churches
aren't in our directory yet. So "claim your church" has to gracefully become "add your
church, then prove you run it" — without letting someone conjure a fake church and instantly
own it. Creating a record and earning authority over it are kept as two separate steps.
A wish isn't a credential. People can mark a "home church" as a
personal preference — the way you'd follow a team. That must grant zero management
power. Conflating "this is my church" with "I run this church" is exactly the kind of quiet
privilege-creep that lets the wrong person in, so the two are deliberately never the same
thing.
Closing the modern loopholes
Once you're deciding who controls what, you inherit every well-known way those
decisions get abused. We close them by design, not by hoping.
verify control, not claims
Proof, not paperwork
Access hinges on demonstrating control of something the real church has — not on
filling in a form that anyone could fill in.
single-purpose approvals
Locked-down links
Approval and invite links do exactly one thing, expire, and can't be replayed or
repurposed — so a stray link can't become a skeleton key.
no self-serve power
No one promotes themselves
Elevated access is never something an account can grant itself; the sensitive paths
require a separate, out-of-band authority.
outbound safety
Links can't be turned on us
When a user hands us a URL, we treat it as untrusted — it can't be used to probe our
own network, and off-limits sources are refused up front.
reversible by default
Hide, don't destroy
Moderation and removal are reversible and leave a trail. Mistakes can be undone;
nothing quietly disappears for good.
humans on the edges
People decide the gray areas
The ambiguous cases route to a person instead of a brittle rule — because that's
where automated systems get tricked.
least privilege
Only as much as the job needs
Roles are scoped tightly, sessions are scoped tightly, and a church can never be left
without an owner by accident.
quiet by design
Fails closed
When something is uncertain, the safe default is less access, not more. The
system would rather ask again than let the wrong person through.
None of this is visible when it works. A pastor uploads a
Sunday service and, a few hours later, it's a searchable podcast episode — and the only
people who could have done that are the ones who actually should.