Design a gallery viewing-room system that links discovery to fulfillment

A viewing room isn't a webpage. It's a workflow that starts when a collector opens a private link and doesn't actually end until the artist has been paid, the resale royalty is reserved, and the crate has left the building. Most galleries treat it as a marketing artifact — a nicely lit set of images with a "request price" button — and then wonder why the same three problems keep showing up: a piece sold twice, a discount someone wasn't authorized to give, and an artist emailing three weeks later asking where their money is.

The gap is almost never the front end. Galleries obsess over the presentation layer because that's the part collectors see. The failures live underneath — in the places where the viewing room hands off to inventory, to pricing, to checkout, and to fulfillment. Each of those handoffs is a seam, and seams are where money falls through.

This is a blueprint for stitching those seams together. Not a design guide — there are plenty of those — but an operational one. The goal is a gallery online viewing room system where a collector clicking "reserve" automatically locks inventory, respects your pricing floor, generates a checkout with the right terms, and writes the royalty split into a ledger before anyone touches a spreadsheet.

The canonical field problem nobody talks about

Before any of the workflow logic works, one thing has to be true: every part of your operation has to be looking at the same record for a given artwork. This sounds obvious. In practice, it's where things quietly rot.

Here's what typically happens. The viewing room pulls a price from the website CMS. The invoice gets built from a Google Sheet the director maintains. The consignment terms live in a PDF in a shared drive. The condition status is in someone's inbox. When a collector asks "is this still available and what's the out-the-door price," four different people can give four different answers — all sincerely, all slightly wrong.

“

Label display copies clearly in every system so editors know which record is authoritative.

The rule is simple and unforgiving: if a field appears in two systems, one of them is a display copy and must be labeled as such. The moment two systems both think they own list_price, you will eventually sell something at last season's number.

Getting this right connects directly to broader inventory discipline — if your underlying artwork lifecycle governance is loose, no viewing-room layer on top will save you. Pricing especially needs to resolve to a single rule-based record rather than a director's memory.

Pricing guardrails: the difference between a discount and a leak

Every gallery gives discounts. The problem isn't the discount — it's the unbounded discount, given by whoever happens to be closing the sale, with no floor and no record of why.

1. 1
   Auto-approve zone — any price at or above list_price. No approval needed.
2. 2
   Managed zone — discounts up to a set percentage off list, allowed but logged, with a reason code required.
3. 3
   Locked zone — anything below price_floor. Checkout cannot proceed without a named approver overriding it.

A worked example. Say a painting lists at $18,000, with a price_floor of $15,300 — the point below which the artist split and your margin stop making sense together. The tiers might run:

The insight most galleries miss: the guardrail isn't there to stop discounting. It's there to make discounting legible. When every sub-list price carries a reason code — "long-term collector," "acquiring three works," "end-of-show clearance" — you can actually see your discount patterns at year-end instead of discovering them buried in the margins. One gallery ran unbounded discounts for years and found, once they made floors explicit, that roughly a third of their "negotiated" sales were discounts nobody would have defended if asked directly.

Inventory locks and the double-sold nightmare

The single most damaging viewing-room failure is selling the same physical object twice. It happens more than galleries admit — usually when a piece is showing in two viewing rooms at once, or when a verbal hold from a phone call never made it into any system.

A lock is a state, not a note. When a collector reserves a work — or a salesperson places a hold on their behalf — the availability_status must flip immediately and everywhere. Other viewing rooms showing that piece should update in real time to "on hold" or hide the reserve button entirely.

1. 1
   Soft hold (collector-initiated, 24–48h)

   reserves the piece, auto-releases if no deposit or confirmation follows.

2. 2
   Firm hold (deposit received or director-approved, up to 14 days): stays locked while paperwork moves.
3. 3
   Committed (checkout generated, terms agreed)

   locked until fulfillment or explicit cancellation.

The failure mode to design against: a soft hold that silently converts to "sold" in someone's head without ever crossing a gate. Someone tells a collector "yes it's yours" over dinner, and now two systems disagree with a promise. Gate discipline is what prevents this — no state advances without a defined trigger, and every state has an owner.

Checkout rules that carry terms, not just totals

A viewing-room checkout is not a shopping cart. The number at the bottom is almost the least important thing on it. What actually matters is the bundle of terms that travel with the sale: deposit structure, tax treatment, shipping responsibility, and any conditions attached to the work.

1. 1
   If location is a partner or fair booth, add the correct freight estimate before the total displays.
2. 2
   If resale_flag is true, insert the resale-royalty disclosure into the terms automatically.
3. 3
   If condition_status is flagged, block checkout entirely and route to the registrar — no "sell now, resolve later."
4. 4
   If the buyer is international, surface the customs and documentation requirements as part of the confirmation, not as an afterthought.

The mistake is treating checkout as the end of the sales process when it's really the beginning of fulfillment and accounting. Every rule you enforce at checkout is a problem you don't inherit downstream. A checkout that quietly skips the deposit terms produces a fulfillment team that ships before payment clears — and then a very uncomfortable conversation follows.

Mapping checkout to the royalty ledger

This is the seam that causes the most artist-relationship damage, and it's entirely preventable. The moment a checkout is confirmed, the split it implies should be written into a ledger — not calculated later, not reconstructed from invoices at quarter-end.

1. 1
   Gallery share — saleprice × (1 − consignmentsplit), minus any agreed shipping or framing recoveries.
2. 2
   Artist payable — saleprice × consignmentsplit, with a due date derived from your payment SLA (e.g. net-30 from cleared funds).
3. 3
   Resale reserve — if resale_flag is true, the applicable royalty percentage set aside as a separate line, not commingled with the artist payable.

A worked case: a work sells at $16,200 — a managed 10% discount off an $18,000 list — with a 50% consignment split. The ledger writes an $8,100 artist payable, dated 30 days from cleared payment, and a gallery share of $8,100 less the $340 crating recovery the checkout terms specified. No spreadsheet. No "I'll calculate it later." The record exists the instant the sale confirms.

Artist payment disputes almost never come from bad faith. They come from reconstruction — someone trying to piece together, months later, what the split should have been on a discounted price nobody logged the reason for. Writing the ledger at checkout kills that reconstruction problem at the source. For the full mechanics of splits, schedules, and audit-proofing, the artist payments and resale royalty ledger system goes deeper than there's room for here.

Fulfillment SLAs: the part collectors actually remember

A collector forgives a slightly slow response during negotiation. They do not forgive a piece that takes six weeks to ship with no updates. Fulfillment is where your reputation gets made or lost, and it's the stage galleries systematize least.

1. 1
   Deposit-to-confirmation

   within 2 business days.

2. 2
   Confirmation-to-condition-check

   within 3 business days.

3. 3
   Condition-clear-to-crate

   within 5 business days.

4. 4
   Domestic dispatch

   within 10 business days of cleared payment; international longer, with customs steps flagged early.

The point isn't arbitrary speed targets. It's making the next expected action visible to everyone so nothing sits in a silent queue. The classic fulfillment failure is the "who's got this?" gap — a sold piece sitting in a corner because the salesperson thought the registrar had it and the registrar never got the handoff. An SLA with a named owner per stage means the ball is always in a known hand.

Failure modes, and the gates that catch them

Every seam in this system has a characteristic way of breaking. Naming them makes them designable:

The pattern across all of them is the same: failures happen at unguarded transitions. Wherever one part of the system hands off to another without a gate — a defined trigger, an owner, a state change — that's where money and trust leak. The whole blueprint is really just an argument for putting gates at every handoff.

Decision gates a gallery can actually adopt

You don't need to build all of this at once, and trying to is how galleries end up with a half-finished system worse than the mess they started with. The right sequence:

1. 1
   Establish canonical fields first. Until price, availability, and split resolve to single sources, nothing downstream is trustworthy. Unglamorous and non-negotiable.
2. 2
   Add inventory locks with expiry. This alone eliminates your most damaging failure — double-sold works — and it's relatively contained to build.
3. 3
   Layer pricing guardrails. Once price is canonical, floors and reason codes cost little to enforce and immediately make discounting legible.
4. 4
   Wire checkout to the ledger. This is the step that ends artist payment disputes. It depends on the canonical split being clean, which is why it comes after step one.
5. 5
   Formalize fulfillment SLAs last. By now the sale arrives at fulfillment with clean terms, so the SLA layer has something reliable to act on.

This sequence is a practical rollout you can follow.

Most galleries want to start at step five because it's the visible pain. Resist that. Fulfillment problems are usually symptoms of upstream chaos — a fulfillment team firefighting because the checkout handed them incomplete information. Fix the source, and the downstream problems mostly sort themselves out.

A short real scenario

A two-person contemporary gallery ran viewing rooms for each show through a combination of a website plugin, a shared spreadsheet, and email. Over roughly a year they double-sold two works (one recoverable, one genuinely embarrassing), gave discounts they later couldn't reconstruct on about a fifth of sales, and paid three artists late enough to strain the relationships.

They didn't buy anything expensive or complex. They spent a month collapsing their fields to single sources, added a hard hold-with-expiry rule, put a price floor on every work with a reason code required below it, and set the sale confirmation to automatically generate the artist payable. Within the next two show cycles, double-sells stopped entirely, their discount log finally showed them where margin was walking out the door, and the artist-payment complaints went to zero — not because they became more careful people, but because the reconstruction step that caused the delays no longer existed.

None of that is a technology miracle. It's the difference between a viewing room as a brochure and a viewing room as a workflow with gates.

Where this connects

A viewing-room system doesn't live in isolation. Its inputs come from your CRM segmentation — you can't run a private viewing room well if you can't clean up a noisy CRM enough to know which collectors get which links. Its pricing logic is only as good as the underlying framework that sets your floors in the first place. And its ledger is the front door to your entire artist-payment obligation.

The consistent lesson from watching galleries build these systems: the viewing room people obsess over — the images, the layout, the presentation — is the easy 20%. The 80% that determines whether it makes or loses money is the plumbing underneath, at every seam where discovery hands off to fulfillment. Build the seams first. The room takes care of itself.

The consistent lesson from watching galleries build these systems: the viewing room people obsess over — the images, the layout, the presentation — is the easy 20%. The 80% that determines whether it makes or loses money is the plumbing underneath, at every seam where discovery hands off to fulfillment. Build the seams first. The room takes care of itself.