Gemelli Biz Academy

Build, sell, and deliver practical workplace training

Welcome to Gemelli Biz Academy

Create free, paid, and private training courses from your ideas, policies, outlines, websites, transcripts, open-license materials, or licensed source material. This MVP keeps the workflow simple and compliance-minded.

Course quality guardrails

Learning objectives required
Quiz alignment check
Copyright-safe source modes
Free, paid, private, or subscription access
Audio, video, slide timing, and voiceover cleanup plan
Voice identity, accent, language, and consent controls
Course categories, collections, tags, and searchable lesson library
Quiz, completion tracking, and certificate readiness
Theme colors, cover images, charts/graphs, per-module visuals, and alt text
Workspaces, invitations, role assignment, and learner course assignment planning
Production hosting, database, storage, API, payment, and security architecture plan
GitHub-ready starter structure, API stubs, environment checklist, and launch QA plan
Database-backed course builder, draft workflow, and local-storage migration plan
Secure AI course generation route with structured output, source guardrails, and database save flow
Source & Media Library for uploaded documents, images, audio, video, chart data, rights status, and AI-use permission

Training materials

New here? Start with the Help & Training Center

The Help Center includes quick-start video placeholders, script starters, setup checklists, and guided walkthroughs for building, editing, publishing, and tracking courses.

Recent work

Recent Courses

Owner workspace

Manage Your Academy

Private method protected: Detailed course-building methodology should live behind admin access or internal documentation, not on a public-facing dashboard.

Review drafts before publishing.
Keep source permissions documented.
Confirm pricing and visibility before launch.

Platform controls

Admin Dashboard & User Roles

Control-first design: Creators should be able to build quickly, but only approved users should publish paid, private, client, or compliance-sensitive courses. This screen separates owner controls, creator permissions, learner access, and review status.

Role governance

Role & Permission Matrix

Quality control

Publish Checklist

Approval workflow

Publishing Review Queue

Reporting

Basic Reporting Dashboard

People and access layer

Workspaces, Users & Invitations

Workspace-first access: Use workspaces to separate Gemelli-owned courses, creator accounts, client/company training libraries, and learner assignments. This prevents private client courses from mixing into the wrong catalog.

Create or manage

Workspace Setup

Workspace name Workspace type Primary owner Subscription plan Default course visibility Workspace status Workspace notes

Invite users

User Invitation

Users by Workspace

Course access

Assign Courses to Learners

Assignment tracking

Workspace Course Assignments

Step 1

Course Basics

Course title Subject Target audience Course category Learning collection Search tags Course level Estimated length

Step 2

Access & Pricing

Access type Price Visibility Access duration

Step 3

Source Intake & Guardrails

Copyright-safe design: Choose both the source type and how you have permission to use it. The default mode creates original course content from your topic and goals instead of copying or replacing third-party content.

Primary source type Usage / permission mode Source title or page/video name Author / creator / owner Edition / version / date Source URL Attribution or license note Risk level

Source notes, transcript excerpt, or course goals

Step 4

Audio, Video & Slide Timing

Sync-safe design: Uploaded audio should be attached to individual slides or lesson segments, not treated as one long file. The app should generate a timing table so slides, captions, narration, and optional face-camera video stay aligned.

Narration method Slide/audio sync method Presenter camera option Caption/transcript option Preferred lesson player Media production status

Audio/video notes

Step 5

Visuals & Training Images

Visual-safe design: Training can use AI-suggested images, uploaded images, stock images, screenshots, or no images. Every visual should have a usage-rights note and alt text for accessibility.

Visual source preference Visual style Cover image URL or file note Image rights status

Visual direction notes

Step 6

Outputs

Lesson content Quiz Facilitator notes Learner handout Slide outline Certificate language

Manage content

Course Library

Detailed build workspace

Content Editor

Editing path: Use this workspace to edit modules, lesson text, slide outlines, quiz questions, and slide timing after the course draft is created.

Media production workspace

Script, Voiceover & Audio Cleanup Studio

Production-safe design: Generate editable narration scripts, simulate AI voiceover creation, document uploaded audio files, and review filler-word cleanup suggestions before publishing.

Representation + localization workspace

Voice Identity & Language Studio

Consent-first design: Plan custom voice profiles, culturally responsive voice options, accent preferences, language translation, captions, and AI-audio disclosures before publishing narrated courses.

Student experience

Learner Course Player & Categorized Library

Organization-first design: Courses, videos, and lessons are grouped by category, collection, tags, and media type so learners do not have to hunt through a chaotic video library.

Find by subject

Searchable Lesson & Video Directory

Training visuals

Visual Media Studio

Image control: Use this workspace to choose cover images, plan AI image prompts, upload or reference approved images, document rights, and add alt text so training visuals are organized and accessible.

Data visualization workspace

Chart & Graph Studio

Approval-first chart design: AI can suggest charts and teaching points, but the creator approves the data, labels, chart type, accessibility summary, and alt text before publishing.

SaaS readiness

Creator Subscription Planning

Recommended model: Start with creators paying a monthly subscription to build and host courses. Add marketplace payouts later only after the course builder, learner player, support process, and billing controls are stable.

Plan 1

Starter plan name Monthly price Course limit AI credits / month

Plan 2

Pro plan name Monthly price Course limit AI credits / month

Plan 3

Agency plan name Monthly price Course limit AI credits / month

Retention audit

Churn-Risk Readiness Checklist

User support

Help & Training Center

Visual learner support: Add short task-based videos, scripts, checklists, and guided walkthroughs so creators can build their first course without needing one-on-one help.

Production build bridge

v13 Architecture, Hosting & Database Plan

Recommended stack Cloudflare + Supabase + Stripe + OpenAI

Hosting decision: keep using Cloudflare Pages for the prototype and front-end delivery, then add Cloudflare Pages Functions or Workers for secure API routes. Use Supabase for the relational database, login, and row-level security. Use Stripe for payments and subscriptions. Use Cloudflare R2 or Supabase Storage for media files.

Current prototype

Static front end

HTML, CSS, and JavaScript run in the browser. Course records are stored locally for demonstration only.

Production app

Full-stack SaaS

Login, workspaces, course data, AI generation, payments, media, certificates, and reporting need backend services.

Security rule

No secrets in browser

OpenAI, Stripe, and service keys must live in environment variables on server-side functions or workers.

Recommended stack

Production Components

Layer	Recommendation	Why it fits Gemelli Biz Academy
Frontend hosting	Cloudflare Pages	Fast static delivery, simple deployment, preview builds, and a familiar platform for you.
Server/API layer	Cloudflare Pages Functions or Workers	Keeps API keys private and handles AI generation, Stripe webhooks, file processing, and permissions.
Database/Auth	Supabase Postgres + Supabase Auth	Strong fit for courses, modules, learners, workspaces, subscriptions, reports, and role-based access.
Media storage	Cloudflare R2 or Supabase Storage	Stores images, audio, video, certificates, transcripts, and exports without putting files in the browser.
Payments	Stripe Billing first; Stripe Connect later	Billing supports your creator subscriptions; Connect can come later if creators sell courses through the platform.
AI	OpenAI API through server routes	Generates courses, scripts, quizzes, alt text, chart explanations, translations, and support responses.

Database blueprint

Core Tables to Build First

Workspace and user tables:

profiles
workspaces
workspace_members
invitations
subscriptions

Course and learner tables:

courses, modules, lessons, slides
quizzes, quiz_questions, quiz_attempts
course_assignments, learner_progress
certificates, media_assets, ai_generation_logs

Access control principle: every course, learner, media asset, and report should belong to a workspace. Users should only see records tied to a workspace where they have a valid role.

API map

Secure Server Routes

Route family	Purpose	Examples
AI generation	Create course assets safely from approved source modes.	/api/ai/generate-course, /api/ai/generate-quiz, /api/ai/generate-script
Media	Upload, store, transcribe, caption, and clean audio/video/image files.	/api/media/upload, /api/media/transcribe, /api/media/cleanup
Payments	Create subscription checkouts and process billing events.	/api/billing/create-checkout, /api/webhooks/stripe
Publishing	Validate readiness checklist and move courses from draft to published.	/api/courses/:id/review, /api/courses/:id/publish
Reports	Return learner progress, quiz scores, completion exports, and certificates.	/api/reports/completions, /api/certificates/generate

Production checklist

Build Sequence After v13

1
Move from local storage to Supabase
Persist courses, users, workspaces, assignments, progress, and settings in real database tables.
2
Add authentication and row-level security
Separate platform owner, admin, creator, client manager, and learner access.
3
Connect AI generation safely
Run OpenAI calls through server routes and log generation history by workspace and user.
4
Add media storage
Support images, audio, video, captions, certificates, and exports in secured storage buckets.
5
Add Stripe subscriptions
Activate free, paid, private, and subscription-based creator access.

Acquisition-ready product discipline

v14 Production Roadmap & Buyer-Readiness Plan

Build less, prove more MVP → paid users → retention → scalable SaaS

Strategic shift: Gemelli Biz Academy should now move from prototype expansion to production discipline. The next work should focus on a smaller sellable MVP, paid-user traction, clean data, secure architecture, and repeatable customer outcomes.

Buyer value

Recurring revenue

Future buyers will care more about monthly recurring revenue, churn, product usage, and retention than the number of prototype screens.

Product value

Niche workflow

The strongest product wedge is AI-generated workplace training with source rights, media approval, learner completion, and client workspace controls.

Technical value

Clean foundation

The production version should use GitHub, Cloudflare, Supabase, Stripe, server-side AI routes, documented schemas, and role-based access.

Build boundary

Minimum Sellable MVP Scope

Must ship first	Why it matters	Delay until later
Creator login, workspace, and saved courses	Users must trust that their content is private, saved, and recoverable.	Marketplace payouts
AI course generation from topic, notes, and uploaded documents	This is the core promise users will pay for.	Automatic YouTube scraping
Module/lesson/quiz editor	Creators need practical editing, not just a generated outline.	Complex collaboration approvals
Visual, chart, and media approval fields	Keeps courses professional, accessible, and safer to publish.	Auto-published AI images
Learner player, quiz, completion, certificate	Turns the tool into an LMS, not just a content generator.	Advanced SCORM/xAPI
Stripe subscriptions for creators	Validates the SaaS business model.	Full course resale marketplace
Admin review and publish checklist	Protects quality and prevents chaotic publishing.	Enterprise audit suite

First traction target

90-Day Paid User Plan

1
Build one production path
Support one complete path: create course → edit → add quiz/media → preview → publish → assign learner → track completion.
2
Recruit 10 founder users
Target HR consultants, small business trainers, ABA operators, ministry/business educators, and nonprofit trainers who already create learning content.
3
Charge early, even at a discount
Use a founder plan so interest converts into real payment behavior, not just compliments.
4
Measure activation
Track whether users create a course, edit it, publish it, assign learners, and return to create another course.
5
Document every friction point
Use support questions, failed tasks, cancellations, and confusion as the product roadmap.

Retention risk

What Could Make Users Cancel

Risk	Product response	Owner metric
Blank-screen confusion	Templates, guided wizard, help videos, sample courses.	Course draft created within first session
AI output needs too much cleanup	Better templates, prompt rules, module editor, regenerate buttons.	Time from draft to publish
Media becomes messy	Media library, categories, tags, alt text, rights status.	Percent of published courses with complete media metadata
Learners cannot find content	Categories, collections, search, assigned courses, clean player.	Course start and completion rate
Creators do not see value monthly	Monthly AI credits, reports, course duplication, new templates.	Monthly active creators
Trust/security concerns	Real auth, workspace permissions, terms, privacy, source-use guardrails.	Support tickets about access or privacy

Future diligence

Buyer-Readiness Checklist

Business proof to maintain:

Monthly recurring revenue and customer count
Monthly active creators and published courses
Churn, cancellation reasons, and refund records
Customer testimonials and use cases
Support issues and resolution history

Technical proof to maintain:

Clean GitHub repository and release notes
Database schema and API documentation
Security and role-permission design
AI prompt/version logs and usage costs
Terms, privacy, source-use, and voice consent policies

Decision rule: Do not keep adding advanced features until the first production path can attract paying users and keep them active. Acquisition value comes from traction, retention, and clean execution.

v15 bridge to real SaaS

Production Build Starter

Production focus: This version moves Gemelli Biz Academy from a front-end prototype toward a GitHub-ready, server-backed SaaS build. The next work should be implementation, not more feature expansion.

Front endCloudflare Pages

Deploy the academy interface and protected creator experience.

Secure APIsWorkers / Pages Functions

Run OpenAI, Stripe, uploads, and admin operations server-side.

Database/AuthSupabase

Store users, workspaces, courses, lessons, quizzes, completions, and roles.

PaymentsStripe Billing

Start with creator subscriptions before marketplace payouts.

Build sequence

First Production Sprint

Create a GitHub repository and connect it to Cloudflare Pages.
Set up Supabase project, database tables, auth, and row-level security policies.
Add environment variables for Supabase, Stripe, OpenAI, app URL, and webhook secrets.
Move AI course generation behind secure server routes.
Replace browser local storage with database-backed courses, users, assignments, and progress.
Launch a private alpha with Mary as owner, one creator workspace, and one learner workspace.

Do not skip

Production Guardrails

Never expose API keys in browser JavaScript.
Enforce permissions on the server and in Supabase row-level security.
Keep original uploaded media separate from AI-cleaned/edited versions.
Require source rights, voice consent, alt text, and publish review for sensitive courses.
Track AI generations for cost control, audit visibility, and subscription limits.
Keep export options so creators do not feel trapped.

Starter files in this package

What v15 Adds

`production-starter/`

GitHub-ready starter structure with Cloudflare function stubs, package file, environment example, and deployment notes.

`supabase/`

Migration, seed, and row-level security planning files to prepare the database build.

`docs/`

Setup checklists for Cloudflare, Supabase, Stripe, OpenAI, media storage, QA, and the first sprint.

`functions/api/`

Prototype server route stubs for health checks, course generation, checkout, webhooks, media signing, and invitations.

v16 production foundation

Auth + Workspace Production Skeleton

Foundation first: v16 defines how users sign in, how workspace membership is checked, how role-based views are protected, and how the app begins replacing browser-only local storage with database-backed records.

AuthenticationSupabase Auth

Email sign-up/sign-in, session handling, profile records, and invite acceptance.

Workspace securityMembership checks

Every course, media asset, learner assignment, and report belongs to a workspace.

Protected viewsOwner / Admin / Creator / Learner

The interface shows the right tools only to the right role.

Database pathCourse drafts

The first course draft flow moves from local storage toward Supabase persistence.

Production route protection

Role-Based Route Plan

Area	Allowed roles	Protection rule
Platform owner dashboard	Platform Owner	Requires platform_owner role and active profile.
Admin review queue	Owner, Admin / Reviewer	Can approve, reject, or request changes.
Creator workspace	Owner, Admin, Creator	Can create and edit courses within assigned workspace.
Client workspace reports	Owner, Admin, Client Manager	Can view learner assignments and completion for that workspace only.
Learner player	Assigned Learner	Can view only assigned, enrolled, free, or purchased courses.
Billing	Owner, workspace billing admin	Can manage subscription and plan limits.

Implementation path

Local Storage Replacement Plan

Keep the prototype as a reference while building the production starter in GitHub.
Create Supabase Auth profiles when users sign up.
Create or join a workspace before any course can be created.
Save course drafts to Supabase tables instead of browser local storage.
Move learner progress, quiz attempts, assignments, and certificates into database tables.
Enforce row-level security so users cannot access another workspace by changing an ID.

v16 files added

Production Skeleton Additions

`lib/auth.js`

Shared helper plan for reading the Supabase access token and resolving the current authenticated user.

`lib/permissions.js`

Central role rules for platform owner, reviewer, creator, client manager, and learner access.

`functions/api/me.js`

Route stub for returning the signed-in user, profile, and workspace memberships.

`functions/api/course-drafts.js`

Route stub for creating database-backed course drafts after auth and workspace checks.

Build discipline: Do not connect Stripe, media uploads, or OpenAI generation to live users until authentication and workspace access are verified end-to-end.

v17 production implementation

Database-Backed Course Builder

Core shift: v17 moves the course builder plan from browser-only local storage into a workspace-scoped database model. This is the foundation for real users, saved drafts, team editing, learner progress, assignments, certificates, and future paid creator subscriptions.

Course recordsSupabase tables

Courses, modules, lessons, quizzes, visuals, voiceover scripts, charts, assignments, progress, and certificates.

Draft flowDraft → Review → Published

Every course gets a controlled workflow so creators cannot accidentally publish incomplete or risky content.

Workspace scopePrivate by default

Every course row belongs to one workspace and is protected by membership checks and row-level security.

Migration targetNo browser-only saving

Local storage stays only for prototype demos; production data must be saved server-side.

Persistence model

What Gets Saved to the Database

Builder area	Database target	Why it matters
Course setup	`courses`	Title, audience, category, access type, price, source mode, review status, and publish status.
Learning objectives	`course_objectives`	Objectives need to be editable, reorderable, and checked against quizzes and lessons.
Modules	`course_modules`	Stores module titles, lesson order, estimated time, and completion requirements.
Lessons and slides	`lessons` + `lesson_slides`	Supports detailed content editing, learner playback, captions, and slide timing.
Quizzes	`quizzes` + `quiz_questions`	Stores pass score, retake rules, answer choices, rationale, and alignment checks.
Visuals and charts	`course_visuals` + `course_charts`	Tracks AI suggestions, approved images, chart data, alt text, summaries, and rights status.
Voiceover and captions	`voiceover_segments`	Saves narration scripts, audio status, cleanup status, transcript/caption text, and approval.
Learner delivery	`course_assignments`, `learner_progress`, `quiz_attempts`, `certificates`	Makes the LMS real: assigned learners, completions, scores, and certificate records.

Secure API plan

Course Builder Routes

Create draft: POST /api/courses creates a workspace-scoped draft.
Update setup: PATCH /api/courses/:id saves title, audience, access, pricing, and source settings.
Save structure: PUT /api/courses/:id/structure upserts modules, lessons, slides, objectives, and quiz plan.
Save media plan: PUT /api/courses/:id/media-plan stores images, charts, scripts, voiceover segments, captions, and rights metadata.
Submit review: POST /api/courses/:id/submit-review moves the course into the admin queue.
Publish: POST /api/courses/:id/publish requires reviewer/admin permission and a passing readiness score.
Assign learners: POST /api/courses/:id/assignments creates learner enrollment records.

Publishing workflow

Draft State Rules

1
Draft
Creator can edit freely. Course is private and not visible to learners.
2
In Review
Creator submits. Reviewer checks source rights, lesson quality, quiz alignment, media metadata, and accessibility.
3
Needs Changes
Reviewer sends the course back with required changes before publishing.
4
Approved
Course is ready for publishing, pricing, private assignment, or library release.
5
Published
Learners can access the course based on free, paid, subscription, or private assignment rules.

Migration discipline

Local Storage Replacement Map

Current prototype key	Production replacement	Priority
`gemelliBizAcademyCourses`	`courses`, `course_modules`, `lessons`, `lesson_slides`, `quizzes`, `quiz_questions`	First
`gemelliBizAcademyWorkspaces`	`workspaces` and `workspace_members`	First
`gemelliBizAcademyUsers`	`profiles` and Supabase Auth users	First
`gemelliBizAcademyAssignments`	`course_assignments`	Second
`gemelliBizAcademyProgress`	`learner_progress`, `quiz_attempts`, and `certificates`	Second
`gemelliBizAcademySettings`	`workspace_settings` and brand kit records	Third

Non-negotiable: Production course editing must call protected API routes. Do not let the browser directly update another workspace's course data without server-side permission checks and row-level security.

v17 files added

Implementation Package

`0003_course_builder_persistence.sql`

Adds course builder persistence tables and indexes for objectives, slides, charts, visuals, voiceover segments, and workflow events.

`course-persistence.js`

Shared server helper plan for validating workspace access and saving course structures transactionally.

`/api/courses/*`

Route stubs for create, update, structure save, media plan, submit review, publish, duplicate, and archive.

`docs/V17_*.md`

Implementation notes, data model, migration map, API route plan, and QA acceptance checklist.

v18 production implementation

Real AI Course Generation Route

Secure AI principle: the browser never calls OpenAI directly. Creators submit course intake to a protected server route. The server verifies the user, workspace, source-rights mode, and AI credit limits, then calls OpenAI with a strict structured-output schema and saves the generated course into the database-backed draft tables.

RoutePOST /api/ai/generate-course

Secure Cloudflare Pages Function / Worker endpoint for course generation.

OutputStructured JSON

Modules, lessons, slides, quiz, visuals, charts, scripts, and publish checklist items.

PersistenceSaved draft

Generated content maps into v17 course tables instead of browser local storage.

AuditAI generation logs

Tracks workspace, user, model, request type, source mode, token/cost estimates, and status.

Generation flow

How AI Creates and Saves a Course

1
Creator submits intake
Topic, audience, duration, source type, usage mode, language, category, collection, and desired outputs.
2
Server verifies access
Supabase token, workspace membership, creator role, plan limits, and source-rights acknowledgement are checked before generation.
3
AI returns structured course JSON
The route uses a course-generation schema so the AI produces predictable modules, lessons, quiz questions, visual prompts, chart ideas, and narration scripts.
4
System validates and saves draft
The response is validated, normalized, and saved into courses, objectives, modules, lessons, slides, quizzes, visuals, charts, voiceover segments, and workflow events.
5
Creator edits before publishing
The AI draft stays in Draft status until the creator reviews content, rights, accessibility, media, quiz alignment, and pricing.

Structured output

Course Generation Schema

Output area	Included fields	Saved to
Course overview	Title, description, audience, category, collection, duration, language, tags	`courses`
Objectives	Plain-language learning objectives aligned to modules and quiz	`course_objectives`
Modules/lessons	Module title, lesson title, lesson content, activity, facilitator notes, estimated minutes	`course_modules`, `lessons`
Slides	Slide title, bullet points, speaker notes, timing estimate, narration script	`lesson_slides`, `voiceover_segments`
Quiz	Question type, answer choices, correct answer, rationale, objective alignment	`quizzes`, `quiz_questions`
Visuals/charts	Image prompts, chart type ideas, data notes, alt text, accessibility summary	`course_visuals`, `course_charts`
Guardrails	Source notes, review warnings, accessibility reminders, publish checklist	`course_workflow_events`, `ai_generation_logs`

Safety and quality

AI Guardrails

No raw API keys in the browser. OpenAI calls happen only inside server-side routes.
Source-use mode required. Reference-only, user-owned, client-owned, licensed, public domain, open-license, or transcript-provided.
No one-click publishing. Generated content remains Draft until reviewed.
Rights and accessibility metadata required. Visuals, charts, captions, and uploaded materials need review fields.
Generation logs retained. Each AI run records creator, workspace, model, request type, and status for support and cost control.
Human review for compliance-sensitive courses. HR, payroll, legal-adjacent, medical-adjacent, and client-specific training should require admin/reviewer approval.

Important: v18 creates the secure production route structure and schema. It does not make the static prototype call OpenAI directly because that would expose credentials and bypass workspace permissions.

v18 files added

Implementation Package

`/api/ai/generate-course`

Protected route that validates intake, calls OpenAI Responses API with structured output, and returns/saves a normalized draft.

`ai-course-schema.js`

Reusable JSON schema for predictable course drafts, modules, lessons, slides, quizzes, visuals, charts, and scripts.

`ai-generation.js`

OpenAI request helper with model/env checks, structured-output request body, and response parsing.

`0004_ai_generation_logs.sql`

Database table for tracking AI runs, source mode, status, model, token/cost estimates, and saved course draft IDs.

v19 production implementation

Source & Media Library

Storage rule: files uploaded through AI Intake should be saved to a workspace-scoped Source & Media Library. The AI should only receive files or extracted text after the server verifies workspace access, source rights, AI-use permission, and course attachment rules.

Add file reference

AI Intake Upload Metadata

Upload file(s) for prototype reference This prototype saves file names and metadata only. The production version will store the actual files in private cloud storage. Display title File/source type Workspace owner Attach to course Attach level Source-use mode Rights status AI use permission Visibility Approval status Transcript/caption status Alt text, chart summary, or media description Internal notes

Controls

File Governance Rules

1
Private storage first
Original documents, images, audio, video, and data files live in private object storage, not browser local storage.
2
Metadata in database
Workspace, course link, rights status, AI-use permission, alt text, transcript status, and approval status are saved in database tables.
3
AI use is gated
The AI route can only use files marked as allowed for generation, reference, cleanup, transcription, or chart suggestions.
4
Publish requires review
Images need alt text, charts need accessible summaries, audio/video need transcript status, and client files must stay workspace-private.

Creator-facing promise: AI can suggest images, charts, source usage, and media placement, but a human approves the final file, rights status, alt text, and learner visibility before publishing.

Library

Source Documents, Images, Audio, Video & Data Files

Production route map

Upload, Replace, Attach, Ingest

Route	Purpose	Required checks
`POST /api/media-assets`	Create a file metadata record after signed upload.	Workspace membership, role permission, file type, file size, source-use mode.
`POST /api/uploads/sign`	Create short-lived upload URL for private storage.	User token, workspace role, MIME allowlist, storage prefix.
`PATCH /api/media-assets/:id`	Update rights, visibility, alt text, transcript status, or approval.	Workspace-scoped editor/reviewer permission.
`POST /api/media-assets/:id/attach`	Attach document/media to course, module, lesson, slide, quiz, or chart.	User can edit target course and asset belongs to same workspace.
`POST /api/ai/ingest-source`	Extract text/transcript metadata for approved AI use.	AI-use allowed, rights reviewed, workspace permission, source mode rules.
`DELETE /api/media-assets/:id`	Archive/delete metadata and optionally delete object storage file.	Owner/admin permission, audit log, retention policy.

Brand settings

Academy Settings

Private admin reference

Internal Course Build Method

Show internal workflow guidance

1
Define the offer promise
Clarify the course outcome, learner profile, length, and access model.
2
Document source rights
Confirm ownership, client permission, license, or reference-only use before generating content.
3
Generate structured assets
Create modules, lessons, objectives, quiz, handout, slides, and certificate language.
4
Align media
Attach audio or video by slide, lesson segment, or cue point before publishing.
5
Review and publish
Finalize accuracy, compliance, price, visibility, and learner access.