Hand the boring half of the programme to an agent.
Eight skills over the management API, a command line with no dependencies, and a key you scope yourself. Your agent works the review pile, chases the speakers who are holding up the schedule and reads the funnel back to you. It cannot submit a proposal or write a review, and that is on purpose.
Install it, then point it at your instance.
The repository is itself a plugin marketplace. Add it, install from it, and nothing else is downloaded.
/plugin marketplace add sameersegal/Podium
/plugin install podium-ops@podiumThen two values in a .env the agent can read: the address of your instance, and a key. Not a flag — anything on a command line is visible in the process list and lands in your shell history.
PODIUM_URL=https://cfp.yourconference.com
PODIUM_API_TOKEN=…Start every session by asking it who it is. That call reports the instance, the events the key can see, and which surfaces actually answer. It is the cheapest way to find out that a plan will be refused four steps in.
podium whoamiGive it the reach the job needs.
A key reaches exactly what its scopes name. There is no role behind it quietly widening the answer, and no key of any kind can mint another key.
What scoping actually buys you
- Read and write are separate. A key that reads the schedule for your marketing site cannot write a placement, read a score or see a phone number.
- Personal data is its own permission on top. Without it, email addresses, phone numbers, dietary notes and travel details come back empty — including inside a scope that can already read the whole proposal.
- A key can be pinned to named events, and every other event answers as though it does not exist rather than as though you were refused.
- Revoking one is a button, and rotating it is the button beside it. A leaked key is an afternoon, not an incident. A key can also carry an expiry date, though only when it is created over the API — the screen above has no field for it.
Three groupings you would not guess
Outreach is governed by the speaker scopes
Campaigns and the record of what was sent write to people rather than to the programme, so an events scope does not reach them. This is the usual cause of a refusal an organizer reads as a bug.
Entitlements sit with sponsors
An entitlement route is guarded by the deal it belongs to, not by a scope of its own.
One scope covers the plumbing
Webhooks, installed providers, message templates, the outbox and the audit log share a single platform-administration scope. It is also the only one that reaches your organization's settings.
Chasing the tasks holding the agenda shut.
Four calls against the demo conference. It read what was pending, found the two sessions that could not go live, counted the tasks behind them and reminded one speaker.
The last line is the one an agent gets wrong on its own. A reminder held back by quiet hours, an unsubscribe or the suppression list is not a reminder that was sent. The call answers with both counts, so nobody reports success on mail that went nowhere.
Nothing here was drafted for this page. If the seeded conference changes, these numbers change with it.
What you ask, and what it goes and does.
Skills load by task, so an agent reading the review pile is not also carrying the sponsor vocabulary. The one it always reads first covers scopes, redaction, paging, retries and what each refusal means.
| You ask | It does | Skill |
|---|---|---|
| “How is the call going?” | The funnel counted in one call — drafts, awaiting review, in review, accepted, confirmed — rather than a walk through three hundred records. | podium-reports |
| “Which talks still have nobody on them?” | Every proposal with how many reviews it has against how many it needs, then the assignments to close the gap. | podium-proposals |
| “Why can't I publish the agenda?” | Reads the conflict list, names the sessions holding it up, counts the onboarding tasks behind each, and chases, approves or waives them. | podium-speakers |
| “Put the keynote in Hall A at two.” | Places it, and answers with the clashes that placement caused in the same breath. Wall-clock times resolve in the event's own timezone. | podium-schedule |
| “How many speaking slots has Ferro Labs got left?” | What the package bought, what has been spent and what is left, on the deal, in one read. | podium-sponsors |
| “Set up next year.” | Clones this year's structure with the dates shifted, then opens the call and edits its form. | podium-events |
| “Who should we invite to keynote?” | Prospect pipelines, saved segments, and a campaign whose audience you can preview before anything leaves. | podium-crm |
| “Give me a CSV of the accepted talks.” | Requests the export, waits for it, downloads it, and says out loud when the file has personal data in it. | podium-reports |
The endpoint reference those skills ship is generated from the code that serves the routes, all 193 of them, with the scope each one needs beside it. A route that changes without the reference being regenerated fails the build, in the same job as the tests. An agent trusting a stale map spends its turn on a 404.
Three things no key is allowed to do.
Not a gap to route around. The refusal names the rule, and the right answer to an operator is who has to do it instead.
Submitting a proposal. Writing a review. Declining an assignment. Each is somebody's own assertion: this is my talk, this is my assessment, I cannot review this one. Each carries that person's name for as long as the record exists. A key is nobody, so all three come back refused whatever scopes it holds, with a sentence saying so rather than a bare number.
An agent can still open a draft proposal for someone. It appears in that person's portal and they finish and submit it themselves. Beginning a submission for somebody is an invitation; finishing it is not. Everything downstream stays open: triage, rounds, assignments, reading the scores, recording and publishing decisions, the whole schedule, onboarding, sponsors and exports. An organizer's edit is available too, and lands as an attributed revision with a reason on it rather than as the submitter's own words.
Two more absences, said here rather than found later. Uploading a file needs a signed-in person, because the record of who uploaded it is what the scanning is built around. In a blind round the reviewer's identity comes back empty for everyone, you included. That is the round working, not a redaction a permission unlocks.
Two actions reach real people and cannot be taken back. Publishing a batch of decisions is what tells the speakers, and sending a campaign is mail leaving the building. Both skills say to confirm with you first, and a campaign will show you exactly who it is about to reach.
There is no server speaking the model-context protocol here, and no machine-readable API description. Anything driving a running instance is driving HTTP, against a surface built for a machine to call and a specification written for one to read.
Four properties that keep a caller honest.
What the API does
- Every write carries a key that makes it repeatable. The same call inside twenty-four hours replays its stored answer and writes nothing.
- A write can carry the version it read. A stale one is refused, with the current state attached so the caller can merge rather than guess.
- Refusals are typed and name the rule they broke. Reading one tells an agent the next step instead of sending it hunting.
- Placement writes serialise through one writer per event, and each one answers with the conflicts it caused.
What that stops
- A timed-out call retried into a room booked twice.
- An agent flattening the change a human made while it was thinking.
- Reading “400 Bad Request” and guessing.
- Two agents dragging the same slot and both winning.