Granola Reference ArchitectureSAFE

Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: granola-reference-architecture
description: 'Enterprise reference architecture for meeting management with Granola.

  Use when designing org-wide meeting workflows, planning integration topology,

  or architecting meeting-to-action pipelines across departments.

  Trigger: "granola architecture", "granola enterprise design",

  "granola system design", "meeting system architecture".

  '
allowed-tools: Read, Write, Edit
version: 1.13.0
license: MIT
author: Jeremy Longshore <[email protected]>
tags:
- saas
- granola
- architecture
- enterprise
compatibility: Designed for Claude Code
---
# Granola Reference Architecture

## Overview

Enterprise reference architecture for deploying Granola as the meeting intelligence platform across an organization. Covers the core capture pipeline, Zapier middleware routing, multi-workspace topology, security layers, and integration patterns for Slack, Notion, CRM, and task management.

## Prerequisites

- Granola Enterprise plan ($35+/user/month)
- Zapier Professional or higher (for multi-step Zaps and Paths)
- Destination systems provisioned (Slack, Notion, CRM, Linear/Jira)
- IT architecture review completed

## Instructions

### Step 1 — Core Pipeline Architecture

```
┌─────────────────────────────────────────────────────────┐
│                    MEETING PLATFORMS                      │
│  Zoom  |  Google Meet  |  Microsoft Teams  |  Slack Huddle│
└──────────────────────┬──────────────────────────────────┘
                       │ System audio capture (no bot)
                       ▼
┌─────────────────────────────────────────────────────────┐
│                    GRANOLA PLATFORM                       │
│                                                          │
│  ┌──────────┐  ┌──────────────┐  ┌─────────────────┐   │
│  │ Audio    │→ │ Transcription │→ │ AI Enhancement  │   │
│  │ Capture  │  │ (GPT-4o/     │  │ (Notes + Trans- │   │
│  │ (local)  │  │  Claude)     │  │  cript merge)   │   │
│  └──────────┘  └──────────────┘  └────────┬────────┘   │
│                                            │             │
│  ┌────────────────┐  ┌──────────────────┐  │            │
│  │ People &       │  │ Folders          │  │            │
│  │ Companies      │  │ (routing rules)  │←─┘            │
│  │ (built-in CRM) │  └────────┬─────────┘              │
│  └────────────────┘           │                         │
└───────────────────────────────┼─────────────────────────┘
                                │
            ┌───────────────────┼───────────────────┐
            │           ZAPIER MIDDLEWARE            │
            │                                       │
            │  ┌─────────┐  ┌─────────┐  ┌──────┐ │
            │  │ Filter  │→ │ Route   │→ │ Act  │ │
            │  │ (type/  │  │ (paths  │  │      │ │
            │  │ attendee)│  │ /rules) │  │      │ │
            │  └─────────┘  └─────────┘  └──────┘ │
            └──────┬──────────┬──────────┬─────────┘
                   │          │          │
        ┌──────────┴──┐ ┌────┴────┐ ┌───┴────────┐
        │ COMMUNICATE │ │ ARCHIVE │ │ ACT        │
        │ Slack       │ │ Notion  │ │ Linear/Jira│
        │ Email       │ │ Drive   │ │ Asana      │
        │ Teams       │ │ GCS/S3  │ │ HubSpot    │
        └─────────────┘ └─────────┘ └────────────┘
```

### Step 2 — Folder-Based Routing Topology

Design folder structure to drive automated routing:

| Folder | Trigger Type | Destinations | Permissions |
|--------|-------------|-------------|-------------|
| `Sales / Discovery` | Auto | Slack #sales + HubSpot Deal + Follow-up Email | Sales team |
| `Sales / Demo` | Auto | Slack #sales + HubSpot Contact | Sales team |
| `Engineering / Sprint` | Auto | Slack #eng + Linear tasks + Notion wiki | Engineering |
| `Engineering / Architecture` | Auto | Slack #eng-arch + Notion ADR database | Senior engineers |
| `Product / Customer Feedback` | Auto | Slack #product + Notion feedback DB | Product team |
| `Leadership / All-Hands` | Auto | Slack #general + Google Drive archive | All |
| `Leadership / Board` | Manual only | Private Notion, no Slack | Executives only |
| `HR / Interviews` | Manual share | Greenhouse scorecard | Hiring managers |
| `HR / 1-on-1s` | None | Private, no automation | Individual |

### Step 3 — Multi-Workspace Topology

```
Organization (Enterprise)
├── Engineering Workspace
│   ├── Folders: Sprint, Architecture, Standup, Retro
│   ├── Integrations: Linear, Notion, Slack #engineering
│   └── Retention: 2 years notes, 90 days transcripts
│
├── Sales Workspace
│   ├── Folders: Discovery, Demo, Pipeline Review
│   ├── Integrations: HubSpot, Slack #sales, Gmail
│   └── Retention: 1 year notes, 90 days transcripts
│
├── Product Workspace
│   ├── Folders: Customer Feedback, Design Review, PRD
│   ├── Integrations: Notion, Linear, Slack #product
│   └── Retention: 2 years notes, 90 days transcripts
│
├── HR Workspace (Confidential)
│   ├── Folders: Interviews, 1-on-1s, Performance
│   ├── Integrations: Greenhouse (via Zapier)
│   ├── Retention: 30 days notes, 7 days transcripts
│   └── Restrictions: No external sharing, MFA required
│
└── Executive Workspace (Confidential)
    ├── Folders: Board, Strategy, M&A
    ├── Integrations: Private Notion only
    ├── Retention: Custom (legal hold capable)
    └── Restrictions: IP allowlist, 4-hour session timeout
```

### Step 4 — Security Architecture

```
Authentication Layer:
  SSO (Okta/Azure AD) → SCIM provisioning → JIT workspace assignment

Data Protection:
  In Transit: TLS 1.3 (all API calls)
  At Rest: AES-256 (server-side storage)
  Local: FileVault/BitLocker (cache-v3.json encryption)

Access Control:
  Org Owner → Workspace Admin → Team Lead → Member → Viewer → Guest
  ↓
  SSO groups mapped to Granola roles per workspace

Data Classification:
  Confidential: HR, Legal, Board (restricted sharing, short retention)
  Internal: Engineering, Product (team sharing, standard retention)
  External-Facing: Sales, Cus

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.