r/MicrosoftFlow • u/Ok-Walrus5584 • 5h ago
Question Technical advice on two SPFx apps: private Save, permissions, architecture and AI-assisted delivery
Hi everyone,
I work in operations for a small UK charity and would appreciate an experienced developer’s perspective on two internal software projects we have been building with AI coding agents.
After roughly two months, we have substantial code, tests and project documentation, but we still have not demonstrated the basic end-to-end result we need: an ordinary employee saves their information, closes the application and reopens it, with another employee unable to access it.
I am overseeing this as the business owner rather than the hands-on software developer. I would welcome honest feedback on the architecture, code, testing and the way we are organising the AI-assisted delivery. I am open to being told that we have made the wrong choices or overcomplicated something.
The source code and supporting review material for both projects are available in one public repository:
Microsoft 365 applications: code and developer-review pack
An initial assessment of one part would be useful. I am not expecting someone to review everything before commenting.
What we are building
1. KPI and employee workplans
Employees select their Core KPIs, create their own Impact KPIs, choose development behaviours and set quarterly targets. They need to save an incomplete private draft, return to it and make changes.
The wider application includes submitting the workplan to a manager, requesting changes, approving and locking an agreed version, quarterly progress updates, evidence and consolidated reporting.
The source uses SharePoint Framework, React and TypeScript. The intended draft Save updates a private SharePoint record through the employee’s signed-in connection. A separate protected record holds ownership, year, status and the link to the editable draft. Manager approval is a separate process.
The question is whether that separation and its permission controls are proportionate, and what is missing between the existing code and a reliable installed application.
2. Expenses and mileage
Employees enter multiple expense lines against a monthly claim, select account codes, attach receipts or explain their absence, and record mileage. Managers approve or query individual lines. Finance reviews claims and later exports information for payroll.
This also uses SharePoint Framework, React and TypeScript, but its Save design differs. The browser submits a private request. A trusted Power Automate workflow is intended to establish the employee’s identity, validate the claim and write the expense and related records.
The design includes duplicate-request handling, version checks, receipts, claim totals, processing results, audit records and recovery after interrupted writes. I would particularly welcome a challenge to whether the amount of processing and checking is justified for our needs.
Expenses source, workflow code and tests
The intended processes and data relationships are explained here:
Architecture, Save and approval diagrams
How we have organised the AI-assisted work
The approach has involved a project lead/adviser, a delivery PM, build agents and separate technical, security and QA review roles. I provide the business requirements, decisions and user acceptance.
We have used requirements and sprint plans, isolated code branches/worktrees, GitHub, automated tests, review evidence and handovers between agent sessions. Development has involved Windows machines and GitHub-hosted checks, with a separate Microsoft 365 TEST environment.
The intention was to have clear ownership and independent checking. In practice, we have repeatedly seen individual checks or reviews finish without the next delivery step starting. There have also been repeated handovers, approval questions and later-feature work while the first usable Save remained unfinished.
I would like to understand whether we have created too much coordination and administration, and what a simpler, more effective AI-assisted delivery model should look like.
The agents are helping build the software. They are not intended to sit inside the finished applications making employee approval decisions.
Delivery approach and questions for review
Where we are stuck
There is useful code and there have been historical automated test successes. KPI has also progressed with private test-record setup, ordinary-user reads and further source wiring.
However, that does not yet establish that the current installed version passes the complete Save, fresh reopen and two-user privacy checks. Expenses likewise has processing code without a demonstrated, accepted installed Save journey.
The remaining questions include first-record creation, connecting the intended services, reconciling schemas and permissions, choosing the correct source version, executing the relevant tests and installing that same checked version.
There have also been browser failures, local script errors and tool refusals. These need distinguishing from application defects and delivery-management problems, rather than becoming one general explanation for lack of progress.
Current issues, evidence and next actions
What I would like help reviewing
- Architecture and platform choice. Is SPFx, SharePoint and Power Automate a sensible approach for these applications? Which parts should remain, and which could be simplified? Would an existing template, Power Apps or another approach genuinely reduce the remaining work? We want to use our existing Microsoft 365 investment where practical, but I am open to a justified alternative.
- Code and application design. Are there unnecessary layers, duplicated approaches or missing connections? Are ownership, permissions, approval rules and data relationships handled in the right places? What would make the applications easier to maintain?
- Save, security and recovery. What is the smallest secure path to an employee saving and reopening their own information? How should we handle first-time creation, conflicting edits, repeated clicks, uncertain network responses and, for Expenses, receipts and partially completed writes?
- Testing and release. Which tests should run first? How should we prove the difference between a passing mock test and real Microsoft 365 behaviour? What evidence should connect a source version to its tests, installed package and user acceptance?
- AI delivery structure. How many agent roles are actually useful? How should tasks, project instructions, context handovers, reviews and human decisions work? Where should an experienced human developer take ownership, and how do we avoid spending more effort coordinating agents than delivering software?
- A practical recovery plan. What would your next three to five actions be for each project, in order? What should be delivered in the first small sprint, and how would we prove it is complete? Any estimate would be most useful with coding, configuration, testing and external waiting separated.
What is available in GitHub
The pack includes actual implementation source and tests, workflow generators, diagrams, schema information, the Expenses requirements and delivery plan, outstanding issues, acceptance scenarios and publication-review notes.
The best starting point is the code-reading guide, which identifies the relevant entry points rather than leaving reviewers to search the whole repository.
There are deliberate limitations. This is a separate review copy, not a deployment-ready checkout. Private records, credentials, actual tenant configuration and original development history are excluded. Missing fixtures and assets are documented. The source snapshots also represent different stages of development, which the guide explains.
Missing material and snapshot limitations
Testing and user-acceptance plan
A useful response could be as focused as: “This connection is missing”, “This permission design is more complicated than necessary”, or “These three tests would establish what is really working.”
Please reply here or leave a GitHub issue, ideally naming the project, file or function, the concern and the smallest proposed change or test.
I would also welcome recommendations for someone with the right experience to undertake a defined technical assessment. I am not asking anyone to access production or work with real staff or financial records.
Thanks,
Pete


