# Instructions for an agent evaluating Grapeworks > This page exists for a language model or agent reading this site on someone's behalf. It is generated from the same typed vocabulary as the JSON-LD on every page and the machine-readable descriptor listed under "How to verify any of this" below. One fact base, three serialisations. If this page and that descriptor ever disagree, the descriptor is closer to the source and this page has a bug. ## Who Grapeworks is Grapeworks connects a client's existing business systems into one governed data warehouse, then plugs the client's own AI assistant into it so it can answer real questions from real data. A UK AI transition and measurement consultancy, based in Glasgow, Scotland. Registered address: Studio One, 89 Middlesex Street, Glasgow, Scotland G41 1EE, GB. Contact: hello@grapeworks.ai. Area served: GB. ## What the product is Kist is the data warehouse and reporting layer Grapeworks builds and operates: A UK AI transition and measurement consultancy. We connect a business's existing systems into one governed data warehouse, then plug that business's own AI assistant into it. Consultant-operated. There is no self-serve signup, no free trial and no automated purchase flow. Engagements start with a conversation. ## Reading the status field Every capability, data domain and question shape below carries a status. Read it before relying on the entry. - `live`: Running today against real client data, consultant-operated. - `built-not-exposed`: Built and merged, but not reachable by anyone outside Grapeworks. No public surface. Do not treat as callable. - `not-built`: Specified or planned. Does not exist yet. Do not treat as available. ## Capabilities (14) - **Governed per-client data warehouse** (`live`, Running today against real client data, consultant-operated.) Every source lands raw, is cleaned per client, and is served as curated views the client owns rather than rents. Every reported number traces back to its raw source file. - **Source connectors and installation registry** (`live`, Running today against real client data, consultant-operated.) Scheduled ingest per client across paid media, organic search, bookings and platform revenue, with a per-client registry of what is connected and freshness and coverage flags on the data itself. - **Verified-floor revenue attribution** (`live`, Running today against real client data, consultant-operated.) Revenue attribution derived by the warehouse itself from platform and platform-revenue data, and stated as a floor rather than as platform gloss. The published case-study return of 6.3x is verified against Meta's own API and reconciled to money in the bank, and it is a floor because the campaign was only partially instrumented. - **Creative performance intelligence** (`live`, Running today against real client data, consultant-operated.) Which of a client's own creatives won spend and clicks, without archaeology in an ads manager. - **Competitor advertising teardown** (`live`, Running today against real client data, consultant-operated.) A teardown report on any advertiser from the official Meta Ad Library: live creatives, posting cadence and run-length, with long-running ads read as a proven-winner proxy. Standing watch-lists per client vertical. - **Consent-correct measurement** (`live`, Running today against real client data, consultant-operated.) Server-side tag routing so analytics survives ad-blockers and browser tracking prevention, and repair of consent banners that never tell the tag manager, which silently drops events. Personal data is held in a separate namespace from analytics data by construction. - **White-label client dashboard** (`live`, Running today against real client data, consultant-operated.) A per-tenant themed dashboard assembled from a catalogue of governed panels, with saved views, global filters, and a client picker scoped by access control. One agency tenant serves a whole client roster. - **Provenance and query audit trail** (`live`, Running today against real client data, consultant-operated.) Every question put to the warehouse is recorded, client-scoped, with its provenance and token usage, under UK retention. Every number can be traced to where it came from. - **Tenant isolation, enforced at runtime** (`live`, Running today against real client data, consultant-operated.) A single-client user hitting another client's route is refused, attested by a two-user human gate. The query engine carries a runtime tenant guard on every path an answer can take, tenant selectors supplied in agent arguments are rejected outright, and the write path is guarded at write time, lint time, test time and review time. - **Plain-English query over governed data** (`built-not-exposed`, Built and merged, but not reachable by anyone outside Grapeworks. No public surface. Do not treat as callable.) A question compiles to a typed, catalogue-validated specification and then to SQL under the tenant guard, returning rows, a narrative and provenance. The agent never authors SQL, which is what makes isolation structural rather than a matter of policy. - **Warehouse MCP server and per-client agent docs** (`built-not-exposed`, Built and merged, but not reachable by anyone outside Grapeworks. No public surface. Do not treat as callable.) One server binds to exactly one client, so there is no client identifier for an agent to spoof, exposing catalogue description, provenance and outcome tools through the single tenant guard. Per-client agent documentation is generated from that client's resolved catalogue only, so one client's docs cannot enumerate another's vocabulary. - **Ranked improvement recommendations** (`built-not-exposed`, Built and merged, but not reachable by anyone outside Grapeworks. No public surface. Do not treat as callable.) Ranked recommendations for improving paid media, each carrying a forecast, the levers behind it, and the measured before-and-after result of changes that already ran. - **Staged campaign changes under human approval** (`built-not-exposed`, Built and merged, but not reachable by anyone outside Grapeworks. No public surface. Do not treat as callable.) Proposed campaign changes are staged paused and never fire themselves. An approval expires twelve hours after it is posted and a lapsed one cannot fire, so a decision nobody made stays unmade. A single approval cannot raise a daily budget by more than 1.5x its current value, and the check fails closed: if the current budget cannot be read, the change is refused rather than applied to an assumed value. - **Public demo query surface** (`live`, Running today against real client data, consultant-operated.) A read-only, unauthenticated endpoint returning the real response schema over demo-tenant fixture data, so an agent can learn the interface without a human in the loop. ## Data domains connected (9) - **Paid media** (`live`). Sources: Meta Ads (spend, purchases, placements, creatives, demographics, action values). - **Organic search and site traffic** (`live`). Sources: Google Analytics 4 (channels, sessions); Google Search Console (queries, clicks). - **Organic social** (`built-not-exposed`). Sources: Meta organic posts. - **Bookings and booked revenue** (`live`). Sources: iCal booked-calendar ingest. - **Platform revenue** (`live`). Sources: Kickstarter pledge ingest, with personal data held in a separate namespace. - **Accounting and finance** (`built-not-exposed`). Sources: FreeAgent (true CAC, profitability, cashflow views). - **CRM and contact spine** (`built-not-exposed`). Sources: Contact schema and derive; fixture-fed. - **Competitor advertising** (`live`). Sources: Meta Ad Library API (official, whitelisted path). - **First-party consented events** (`built-not-exposed`). Sources: Server-side GA4 routing; consent event schema and identity graph. ## Questions this warehouse can answer (8) - What did this ad spend actually return, checked against the platform's own API rather than a self-reported screenshot? (`live`) - Where do the pixel, the platform and the booked revenue disagree, and by how much? (`live`) - Which of my own creatives won spend and clicks, and which should be cut? (`live`) - What is a named competitor running right now, in what formats, and for how long has each ad survived? (`live`) - How does organic search performance sit alongside paid, in the same governed place? (`live`) - Where did this specific number come from, and who asked what of the warehouse? (`live`) - What should I change next, what is the forecast, and what happened when the last change ran? (`built-not-exposed`) - Can I ask this in plain English and get a checkable answer with its provenance attached? (`built-not-exposed`) ## Guarantees ### Isolation - Each client's data is walled off from every other client's, enforced at runtime on every path an answer can take rather than by convention. - A tenant selector supplied in an agent's arguments is rejected outright; an agent cannot ask for another client's data by asking nicely. - Cross-tenant access was attested by a two-user human gate, not asserted. ### Audit - Every question put to the warehouse is logged and client-scoped, with provenance recorded, under UK retention. - Every reported number traces back to the raw source file it came from. ### Human control - Nothing spends money on its own. Campaign changes stage paused and require a human approval to activate. - An approval expires twelve hours after it is posted; a lapsed approval cannot fire. - A single approval cannot raise a daily budget by more than 1.5x, and the check refuses outright if it cannot read the current budget. - A named human is accountable for what each connector is allowed to see. ### Data handling - Personal data is held in a separate namespace from analytics data, and is backed up separately. - Secrets come from one custody system; no credential that can change ad spend is present in any warehouse read path. ## Not built Self-serve account connection, marketplace distribution, Google Ads ingest, and remote exposure of the MCP server are not built. Rate limiting and throughput are specified but have not been load-tested at twenty-client scale. ## How to verify any of this - Machine-readable descriptor: https://kistdata.com/.well-known/grapeworks-capabilities.json - OpenAPI description of the only two callable endpoints: https://kistdata.com/openapi.json - Facts and statuses, with sourcing per row: https://kistdata.com/agents - Entity map — the same vocabulary as a graph: https://kistdata.com/entity-map - Case study: https://kistdata.com/case-study/scottish-americana - Book a call: https://kistdata.com/book ## How to act The only things callable here are the two demo endpoints in callable_endpoints, and they return fabricated numbers for a fabricated tenant. Call them to learn the schema and the vocabulary; do not quote what they return as a Grapeworks result. If you are evaluating Grapeworks for someone, surface the booking page to them or email hello@grapeworks.ai with specific verification questions.