Accept anything, trust nothing, and show your work in between
There is a piece of design advice older than the web, and it has aged better than almost anything written since. The Nielsen Norman Group frames it through two of its usability heuristics that pull against each other on purpose, flexibility and efficiency of use on one side, error prevention on the other. Engineers know the same idea as the robustness principle. Be liberal in what you accept, and conservative in what you produce. Take in whatever the world hands you. Hand back only what you can stand behind.
We built two things recently that live entirely inside that one sentence. The report builder now imports almost any spreadsheet a school can throw at it, and the new Mail Drop lets people email into Junipa for the first time. They look like different features. They are the same problem wearing two costumes, a wide and forgiving front door, and a narrow and strict exit.
The two doors
Flexibility says meet people where they are. Accept the messy thing they already have. Do not make them reformat their working life to suit your form. Error prevention says the opposite. Never let a sloppy input quietly become a wrong output.
Most software resolves that tension by picking a side. The strict apps reject your file because row one is not a header. The permissive apps accept your file and silently produce nonsense. Both are failures, and the silent one is worse, because the person never finds out.
The robustness principle refuses to pick a side. The front door and the exit have different jobs, so they get different rules. The front door is liberal. The exit is conservative. And the funnel between them, the part nobody usually sees, is where the real work happens, turning anything into something you can trust.
The point of the funnel is that it is not hidden. The system is open enough to accept the mess, confident enough to make a strong guess, and disciplined enough to make that guess visible and reversible before any of it hardens into a record.
Door one, costume one: the spreadsheet nobody formatted for you
A school exports a student subject list from its management system. What lands in the downloads folder is not a tidy grid. The first thing in it is a title banner, then the real header, then a cohort heading like Year 7, then the actual students, then Year 8, and so on. Names, codes, and thirteen unlabelled columns trailing off the end where the subjects spilled over.
The old importer was strict in exactly the wrong place. It assumed the first row was the header, read the title banner as the column names, and produced a screen of columns called column two through column sixteen. The person opened the data map, found a wall of nonsense, and could map none of it. We had been conservative at the front door, which is the one place you must never be conservative.
So we made the front door liberal. The importer now takes the file as it is and reads the room. It walks the first several rows and works out which one is really the header, by how full it is and by how many cells read as labels rather than as values. A header says Student Code. Data says a student number, or a name in surname comma given order, or a subject code. It spots the cohort rows by their tell, one lonely filled cell in a row that is not a student. And it keeps the spillover columns rather than dropping them on the floor.
None of that rejects your file. All of it is best effort. If the detection cannot make sense of something, it falls back to the old behaviour and says so, rather than crashing your upload.
The funnel: the part you are meant to see
Here is the heuristic that is most often quoted and most often misread. Automation should never be silent when it might be wrong. A confident system that guesses and hides the guess is worse than a humble one that guesses and shows its work.
So when a file looks irregular, Junipa does not quietly fix it and move on. It surfaces a small, honest strip on the source card. It tells you what it thinks, that the headers look like they are on row two, and it hands you the dial. A stepper lets you change which row the data starts on and re-reads the file live. A cohort control lets you carry Year 7 down as a column, drop those rows, or keep them. And when it recognises a column, it quietly suggests that Student Code probably maps to Student number, and it never applies that for you.
That last restraint is the whole philosophy in one detail. A suggestion you can accept is help. A decision made on your behalf is a trap. On a clean file the strip never appears at all. The price of forgiveness is paid only by the files that need it.
Door one, costume two: letting the world email you
The new Mail Drop is the same shape with the stakes turned up. For the first time you can communicate with Junipa by sending it an email. Three front doors open at once. A student inbox, an opaque address that lands mail against one student. A group inbox, a shared address created when a group is created and dissolved with it. And My Junipa, a staff member's own drop, so a message you send from your own account shows up on both sides.
Three targets, three addresses, one inbound stream. A teacher does not learn three mailboxes. They learn one Inbound view that already knows whether each message was for a student, a group, or them. That unification is the flexibility heuristic in practice, the same task expressed many ways, funnelled into one place to act on it.
But email is the most liberal front door there is. Anyone, anywhere, can type your address and press send. Here the robustness principle stops being a nicety and becomes a security boundary.
The exit is where you get strict, and where matters
The instinct when you build an inbox is to be strict at the moment of delivery, to bounce the sender and reply that they are not allowed. We do the opposite, and the choice is deliberate.
We are strict about who we trust, and silent about rejection. A message from a sender whose domain is not on the school's approved list is dropped before it is ever written down. No inbox record, no queue entry, no log row, no notification, and no automatic reply, ever, to anyone, approved or not. A bounce message is a confirmation that the address is real and the door exists. We do not hand that to the internet.
The list of who we trust is itself where an old be liberal instinct had quietly become a hole. The inbox used to trust the email domain of every staff member with an account. One teacher with a personal Gmail address meant the whole of Gmail could email a student. That is liberal acceptance applied to the wrong door, being generous about trust instead of about format. We removed it. Trust is now an explicit, school governed list, kept separate for each school so a domain approved for one can never reach another, with consumer mail domains blocked by default unless an administrator knowingly allows them.
So the front door is wide, any of the three addresses, any sender, any shape of message, and the exit is a vault. Liberal in what it accepts, conservative in what it lets become real.
An email is not evidence until a person says so
There is one more strict door, and in a compliance product it is the most important. An inbound email carries two things worth keeping, its body and its file attachments. Neither is an adjustment. Neither is evidence. They are raw material sitting in a queue.
Nothing files itself. A person opens the Inbound stream, picks which student, chooses whether this becomes a document, an adjustment, or an attachment on existing evidence, and only then does the email cross into the record an auditor will one day read. When the body is filed it is frozen into a self contained snapshot, the from, to, date, subject, and body, so the artefact cannot drift afterwards. And every filed item carries its origin, surfaced with a distinct Email attachment badge on the student's activity log, so a year later anyone can see this came in by email and exactly when.
The system never assigns a student automatically, because an automatic guess about who an email belongs to is a mistake you cannot see and cannot take back. The person makes the call. The system makes that call easy, attributed, and permanent.
Why the dials keep moving
If there is one thing to take from building both of these, it is that liberal and conservative are not settings you choose once. They are dials you are always turning.
Every new spreadsheet a school sends is a new shape the front door has to learn to accept, and each time we widen it we have to ask again whether the funnel still shows its work and the exit is still clean. Every new way to email Junipa is another front door, and each one reopens the question of who we trust and what we let through. The trust hole existed precisely because a be liberal decision made sense once and then quietly outlived its safety.
The robustness principle is not a feature you ship. It is a posture you hold. Open and accepting at the edge, strict and accountable at the core, and honest in the gap between, because the gap is the only part where people can see you thinking. Stay accessible. Stay intuitive. Never let either one cost you the integrity of what comes out the other side.
