Command note: every account you inherit has more people in it than the client remembers. Access is the one audit nobody schedules. Old staff, a former agency, a contractor from a project that ended two years ago — they keep working logins until somebody looks. The command I run on every sub-account: "List every user on this sub-account with their role and permissions. Then show me which of them are assigned to contacts, opportunities or calendars, and which appear in any workflow's internal notification step." What usually comes back: • Users nobody has thought about in a year • Admins who only ever needed read access • Notifications routed to someone who left • A calendar owned by a person who no longer takes calls Do it now: 1) Pull the user list and read it with the client, name by name 2) Ask one question per person: does this person still need to be in here today? 3) Reassign before you remove — contacts, opportunities and calendars follow the user 4) Fix every workflow notification pointing at anyone who is leaving 5) Note the date in the account and repeat it quarterly Removing a user takes five minutes. Explaining to a client why a stranger still had admin on their CRM is a very different conversation. An account is only as private as its longest-forgotten login.

Command note: every account needs a short list of moments that stay human. Automation usually gets built by asking what we can automate. The more useful question is what we won't — and writing that down before someone is tempted at 9pm on a deadline. Moments that usually stay human: • A refund, a discount, or any pricing exception • A complaint, or a reply to a bad review • A cancellation, or a save attempt on a leaving client • Anything involving illness, loss, or bad news • The first message after a deal is signed The list is short. It is also the part of the account clients remember. Do this today, on one account: 1) List every outbound moment — messages, notifications, status changes. 2) Mark each one automated, drafted-then-approved, or human-only. 3) Write the human-only list where the team reads it, not in your head. 4) For each human-only item, name who handles it and how fast. 5) Check that no published workflow currently sends one of them. This is not a limit on automation. It is what makes the rest of it safe to run at volume — you stop auditing everything because you already know which moments were never in scope. An automation that handles a complaint on your behalf is not saving time. It is spending trust you did not budget. Decide what stays human while it is still cheap to decide.

I noticed that you are using examples of clinics. Is your system HIPAA compliant? I have not done anything with any client with patients involved because I am not sure about this. My understanding is that even collecting information from patient leads could be affected by HIPAA compliance. I know it is possible. I just don't know how to do it, so I thought I'd ask you how you were ensuring compliance.

Command note: your automations do not know it is 11pm. They only know a trigger fired. Every account has a night shift nobody staffed. A form fills at 2am, a workflow sends, a lead replies, and it sits unseen until morning. Or worse, the client's phone buzzes at midnight for a lead who will not answer anyway. After-hours behavior is a decision, not a default. Make it once per account: • Which channels may send at any hour, and which wait for business hours • What an inbound lead hears at 11pm, so silence is not the answer • Where a night lead lands in the morning — a task, a stage, a named person • Whether internal notifications wake someone, or queue until open Do it now: 1) List every outbound action that can fire at any hour — SMS, email, internal notification, call task 2) Set the client's real business hours in the sub-account, and check every calendar matches 3) Gate the sends that should wait; leave the ones that genuinely should not 4) Write one out-of-hours reply that sets a real expectation, not a shrug 5) Run a test contact through at night and read exactly what a human would have received The point is not to go quiet after 6pm. It is to decide what the account says when no one is there to say it. An account that behaves the same at 2am as it does at 2pm is not automated. It is unsupervised.

Command note: you cannot control what happens after a lead arrives if you do not know how they arrive. Every account has more entry points than anyone remembers. Forms, calendars, trigger links, chat widgets, manual imports, an integration quietly pushing contacts in from somewhere else. Each one is a door, and each door either labels the contact who walks through it or leaves you guessing. The command I run: "List every form, calendar, trigger link and workflow trigger in this sub-account. For each one, tell me what it creates or sets - tags, custom fields, pipeline stage, assigned user - and flag any that set nothing." What comes back: • Forms still live on pages the client redesigned months ago • Calendars nobody books that still create contacts • Trigger links pointing at offers that ended • Doors that set no source, no tag, no owner Do this today: 1) Run it and work from the full list, not from memory 2) For each door, write down what it should set before you look at what it does set 3) Close the doors that should not be open - unpublish, do not delete 4) Fix the ones that set nothing, so every contact arrives already labeled 5) Push one test contact through each remaining door and read the record it produces Most "our reporting is wrong" problems are not reporting problems. They are a door somebody forgot to close. Count the doors before you try to guard them.