When HR marks an employee as terminated in the HRIS system.

1. #Custom Workday Query Hires for employees at exactly day 30, day 60, and day 90 from their start date.

2. For each matching employee:

   • #Lookup Users with includeManager.

   • Resolve HRBP via custom Get HRBP for Department.

3. Create the check-in calendar event:

   • #Custom Google Calendar Create Event for a 30-min check-in between employee, manager, and HRBP at the next available common slot within 7 days.

   • Title: "{{Day-30/60/90}} Check-in - {{employee.name}}".

4. Pre-fill the agenda by pulling signals:

   • #Custom Lattice Get Engagement Score for the employee (if Lattice is used).

   • #Search Okta System Log Custom for login activity (proxy for engagement).

   • #Custom Slack Get User Activity for message volume in team channels.

   • #Custom Workday Get Goals Progress if goals are tracked.

5. Generate the agenda doc:

   • #Custom Generate Check-in Agenda writes a Google Doc with prefilled engagement signals, suggested questions, and free-text sections.

   • Attach the doc to the calendar event.

6. Flag off-track signals:

   If engagement score dropped, login activity is low, or no goals set:

   • #Send Channel Message to #hrbp-alerts with: employee, day milestone, signal that's off, manager.

   • #Send Direct Message to the manager and HRBP with: calendar invite link, agenda doc link, the flagged signals (if any).

   • #Send Direct Message to the employee with: "You've got a {{day-X}} check-in coming up with {{manager}} and {{hrbp}}. Anything specific you want to discuss? Add to the agenda doc."

   • schedule_action wake 1 day after the check-in date to follow up: #Send Direct Message to manager + HRBP: "How did it go? Anything we should escalate or change?"

   • #Leave Internal Note in the employee's internal HR record.

1. Parse the target app name and entitlement level (member / admin / specific role) from the request.

2. #Lookup Apps with the parsed app name to confirm it exists in the catalog. If not found,

3. #Send Direct Message to the requester asking them to clarify or use Web Research to find the app.

4. #Lookup Users on the requester with includeManager and includeGroups.

5. #Lookup Policies with the requester's user ID and the matched app.

6. Check the policy:

   • If reviewStrategy == NO_REVIEW_REQUIRED and requester is eligible → proceed to step 7.

   • If reviewStrategy == APP_OWNERS → resolve app owner from the policy and route via #Request Approval.

   • If reviewStrategy == REQUESTERS_MANAGER → #Request Approval with the manager from step 3.

   • If reviewStrategy == EXPLICIT → #Request Approval with the listed approvers.

7. If approval denied, #Send Direct Message to requester with the reason and #Resolve Request. Stop.

8. Execute provisioning:

   • If the app uses Okta SSO with group-based access → #Add to Group (Okta) for the entitlement group from the policy.

   • If the app has a SCIM/native API → call the app-specific custom create-user or grant-role action.

   • If the policy specifies a custom provisioning action → invoke it with the entitlement metadata.

9. #Send Direct Message to the requester confirming access is live, including the app URL and any first-login instructions.

10. #Leave Internal Note on the request capturing the policy used and the action taken.

11. #Resolve Request.

1. Parse the new record details:

   • Name, domain, email, phone, location, owner.

2. Run internal dedupe:

   • #Search HubSpot Companies by name (fuzzy match) and by domain (exact).

   • #Search HubSpot Contacts by email and by phone.

3. Run external enrichment dedupe:

   • #Apollo Search Companies by Technology and Employee Range for the domain.

   • #Custom ZoomInfo Search Company for the name + domain.

4. Compute similarity scores:

   • Domain match → 100%.

   • Exact name + same country → 95%.

   • Fuzzy name (Levenshtein <3) + same domain → 90%.

   • Phone match → 85%.

   • Else use weighted attributes.

5. Branch on scores:

   • No match (<70%) → proceed with create; just enrich the new record.

   • Likely match (70-89%) → present options.

   • High-confidence match (≥90%) → block creation; suggest merge.

6. For matches (70%+):

   • #Lookup Users on the requester (or record owner if webhook-triggered).

   • #Send Direct Message with the candidate matches: "Found {{N}} possible duplicates for {{name}}. Review?"

   • Include a #Trigger Form with options per candidate: "Merge into this one" / "Different company" / "Create anyway".

7. On response:

   • Merge → custom HubSpot Merge Companies (or Salesforce Merge Accounts) with the chosen master.

   • Different / Create anyway → proceed with creation. Capture justification in a deal note.

8. Enrichment regardless of path:

   • Apply Apollo/ZoomInfo enrichment via #Update HubSpot Company Properties.

9. #Send Direct Message confirming the action taken.

10. #Send Channel Message to #revops-data weekly summary of duplicates prevented.

11. #Leave Internal Note capturing the decision.

12. #Resolve Request.

1. Parse the target account name and the scope of the brief (firmographics / champion / meetings / usage / news / all).

2. Resolve the account:

   • #Search HubSpot Companies by name.

   • If multiple matches, #Send Direct Message with disambiguation.

3. Pull data in parallel:

   • #Get HubSpot Company Details with Activity Timeline for the base record.

   • #Search HubSpot Contacts by Property Filter with companyId for contact list.

   • #Search HubSpot Deals by Company for open and historical deals.

   • #Custom ZoomInfo Get Firmographics for industry, employee count, revenue, tech stack.

   • #Custom Gong Get Calls by Account for the last 5 calls.

   • #Custom Product Analytics Get Usage for product engagement (if customer).

   • #Web Research for recent news / press / fundraising / layoffs about the company.

4. Identify the champion:

   • From the contact list, sort by:

     • Engagement score (Gong talk time + email opens + meetings).

     • Title weight (VP/Director > Manager > IC).

     • Recent activity recency.

   • Top result = champion candidate.

5. Compose the brief:

   • Company snapshot: industry, size, HQ, revenue, tech stack.

   • Champion: name, title, contact info, recent engagement summary.

   • Other key contacts: list with titles.

   • Recent meetings (last 5): date, attendees, AI summary.

   • Product usage (if customer): MAU/WAU, key features used, trend.

   • Recent news: 3-5 bullets.

   • Open opportunities: list with stage, amount, close date.

6. Format as a Slack message with sections + a Google Doc link for the full version.

   • #Custom Generate Account Brief Doc to write the full version to Google Drive.

7. #Send Direct Message with the brief and doc link.

8. Offer follow-up: "Want to set up a call with {{champion}}?" or "Want me to enrich the contact list further?"

9. #Leave Internal Note capturing the brief generation.

10. #Resolve Request.

Requester asks to update their legal name (post-marriage, post-correction) or address.

​ Parse the change type (legal name / preferred name / address / both).

​ #Lookup Users on the requester.

​ #Trigger Form to collect:

​ For legal name change: new legal first/middle/last, documentation (marriage cert /

court order upload).

​ For address: new street, city, state, zip, country, effective date.

​ Whether to also update preferred name (yes/no).

​ Reason (helps with audit trail).

​ Validate the documentation:

​ For legal name change → custom Validate Name Change Docs (HR review

required for first-pass).

​ #Request Approval from HRBP for legal name change.

​ Execute changes on effective date (use schedule_action if future):

​ Custom Workday Update Worker with new fields.

​ #Update Okta User Profile (Custom) to update name fields, login email if

name-based.

​ For legal name change with new login email:

​ #Create User Alias (Google) for the old email to forward to the new.

​ Custom Update Slack Display Name.

​ Custom Update GitHub User Name (if applicable).

​ Custom Update Badge System Name.

​ For address change:

​ Custom Workday Trigger Payroll Tax Recalc.

​ Custom Update Badge System Address.

​ Custom Update Shipping Address in asset DB for any future device

shipments.

​ #Send Direct Message to the requester with a checklist of what changed where, and what

they need to do themselves (e.g. "Update your I-9, update your Slack avatar, update your

title at events").

​ #Send Channel Message to #org-changes for the legal name change announcement

(only if requester opts in).

​ #Leave Internal Note capturing the change, documentation, approval trail.

​ #Resolve Request.

1. #Lookup Users on $event.userEmail with includeManager, includeGroups.

2. Filter false positives:

   • #Custom Check VPN Egress — if IP matches corporate VPN, exit.

   • #Custom Check Travel Authorization — if user has an active travel exemption matching the country, exit.

3. Pull context:

   • #Search Okta System Log Custom for the user's previous 5 logins (location, IP, device).

   • #CrowdStrike Get Device Login History for any corp device the user might be on.

4. Compute risk:

   • Impossible travel (distance > N km / time delta) → High.

   • New device + new country → High.

   • New IP from known country → Medium.

   • Just risk-flagged but recognizable → Low.

5. Branch on risk:

   1. High:

      • #Custom Okta Force Step-Up MFA for the active session.

      • #Send Direct Message to the user: "We saw a login from {{geo}} on {{device}}. Was this you?" + #Trigger Form "Yes / No".

      • schedule_action wake at 10 minutes.

   2. Medium:

      • #Send Direct Message with same prompt but no immediate step-up.

      • schedule_action wake at 30 minutes.

   3. Low → just log, no user prompt.

6. On wake, check response:

   1. Yes → log as confirmed, no further action.

   2. No OR no response:

      • #Revoke All User Sessions (Okta).

      • #Reset User Factor for any non-FIDO factors.

      • #Custom Okta Lock Account until manual review.

      • #Send Channel Message to #soc-triage with full context.

      • Fire Sec-11 (Compromised Credential Response) flow for the user.

      • #Send Direct Message to the user (after revocation): "We've locked your account as a precaution. To recover, contact security."

      • #Send Direct Message to the user's manager flagging the incident.

7. #Custom Vanta Log Anomalous Login for audit.

8. #Leave Internal Note capturing risk score, response, outcome.

1. #Trigger Form to collect:

   • App name and vendor URL

   • SSO protocol (SAML 2.0 / OIDC)

   • For SAML: ACS URL, entity ID, name ID format, certificate

   • For OIDC: redirect URI, scopes needed

   • SCIM endpoint + bearer token (if available)

   • Default user groups to provision (eng / product / design / all-company)

2. #Lookup Apps to confirm the app isn't already onboarded. If it exists, ask the requester whether to modify or reject.

3. #Request Approval from the security team for the new vendor (chain to Sec-18 if not already approved).

4. Create the Okta app:

   • For SAML → custom Okta Create SAML App with ACS URL, entity ID, attributes mapping.

   • For OIDC → custom Okta Create OIDC App with redirect URI and scopes.

5. #Create Okta Group (Custom) for default access: {{app-slug}}-users and {{app-slug}}-admins.

6. #Add to Group to assign the requester to {{app-slug}}-admins.

7. For each requested default group (eng/product/design/all-company): custom Okta Assign

8. Group to App to grant baseline access.

9. If SCIM endpoint provided: custom Okta Configure SCIM with the endpoint + token, then #Update 1Password App Username Template to set the username convention.

10. Generate test credentials via custom Okta Create Test User and Assign action.

11. #Send Direct Message to the requester with SSO sign-in URL, test creds, SCIM status, next steps.

12. #Create Linear Issue in the IT project for follow-up tasks: app catalog entry, access policy creation, KB doc.

13. #Leave Internal Note capturing the protocol, ACS URL, and groups configured.

14. #Resolve Request.

1. #Custom NetSuite Get Open AR with aging buckets.

2. For each open invoice:

   • #Custom NetSuite Get Invoice Details.

   • #Search HubSpot Companies for AE/CSM.

   • #Custom HubSpot Get Account Health.

3. Branch by bucket:

   • 0-30: standard; flag only if historically slow.

   • 31-60: draft collection email; #Send Email template to AR clerk for review; auto-send to billing cc AE on approval; #Create HubSpot Note on Company.

   • 61-90: second email + DM to controller; #custom NetSuite Add to Watchlist; DM AE + CSM.

   • 90+: DM controller + CFO; #Request Approval from CFO for continue / collections agency / write-off; on write-off custom NetSuite Write Off Invoice + Update Customer Status.

4. Aggregate by customer; multiple overdue → treat at worst bucket.

5. Weekly AR digest to #finance-ar.

6. Monthly bad debt review to #finance-leads.

7. #Leave Internal Note.

1. Pull all data sources in parallel:

   • #List Devices (Kandji) for enrolled devices.

   • #Custom Intune List Devices for Windows enrolled devices.

   • #Custom Jira Assets Query for the asset register.

   • #Search Graph for the HR roster from the HR ingest.

2. Build a unified view by serial number and assigned user.

3. Compute mismatches:

   • Lost-not-recovered: marked lost in any system but still active elsewhere.

   • Retired-but-active: marked retired in asset register but checking in to Kandji/Intune.

   • Employee-without-device: active employee in HR but no device assigned.

   • Device-without-owner: active device but unassigned or owner is offboarded.

   • Owner-mismatch: different owner in Kandji vs Jira Assets.

4. For each mismatch:

   • Determine the asset owner (IT team member responsible).

   • #Send Direct Message to the asset owner with the mismatch, proposed fix, and a

   • #Trigger Form to approve / modify / dismiss.

5. schedule_action wake at 7 days for each mismatch to check resolution.

6. On wake: if mismatch still exists, #Create Linear Issue for IT to resolve.

7. After full daily reconciliation:

   • #Send Channel Message to #it-asset-ops with totals and trend.

8. Quarterly run also produces a Linear summary issue with trend data via #Run Query.

1. #Lookup Users on the requester with includeManager and includeGroups.

2. #Search Graph in the custom HR/contractor ingest to find the engagement end-date.

3. #Trigger Form to collect:

   1. Role-based image needed (eng tools / design tools / GTM tools)

   2. Country of access

   3. Engagement duration (auto-fill from HR ingest if available)

4. #Request Approval from the requester's engagement owner.

5. On approval, provision the AVD:

   1. Custom Azure AVD Create Host Pool Assignment with image template and user UPN.

   2. Custom Entra Assign User to AVD App scoped to this user only.

   3. Custom Entra Set Conditional Access restricting sign-in to the engagement country.

6. Time-box the access:

​ schedule_action wake on the engagement end-date to call custom Azure AVD

Remove Assignment and Entra Revoke AVD App Access.

​ #Send Direct Message to the requester with AVD connection URL, sign-in credentials,

expiry date, support path.

​ #Send Channel Message to #it-contractor-access logging the provision.

​ #Leave Internal Note capturing image, country, end-date.

​ #Resolve Request.

1. #Custom Bill.com Get Bill Details.

2. #Custom NetSuite Lookup Vendor to confirm active.

3. #Custom Coupa Find Matching PO by vendor + amount + line items.

4. Validation:

   • PO exists for amounts above $X.

   • Amount matches PO within tolerance (±5% or $100).

   • GL coding valid for cost center.

   • Vendor not on payment hold.

   • Failures → #Send Channel Message to #ap-review and pause.

5. Approval tier:

   • <$5k → AP clerk.

   • $5k–$25k → controller.

   • $25k–$100k → controller + CFO.

   • >$100k → controller + CFO + CEO.

6. Resolve approvers (custom Get AP Clerk On Duty / Get Controller / Get CFO, cost-center owner via Workday).

7. #Request Approval chained per tier with: bill detail, PO match, GL coding, vendor history, terms, due-date proximity.

8. On full approval:

   • #Custom Bill.com Approve Bill with approval trail.

   • #Custom Bill.com Schedule Payment.

   • #Custom NetSuite Create Bill Payment.

9. Rejection / query → #Send Channel Message to #ap-review and DM PO owner.

10. #Send Channel Message to #ap-log.

11. #Leave Internal Note.

1. Parse:

   • Account/company name.

   • Date or relative date ("last Tuesday", "yesterday").

   • Participant name (if specified).

   • Type (demo / discovery / negotiation).

2. #Lookup Users on the requester (to filter to their calls by default).

3. Resolve the account:

   • #Search HubSpot Companies for the company name.

   • If multiple matches, #Send Direct Message with disambiguation.

4. Resolve the date window:

   • "Last Tuesday" → compute calendar date.

   • "Yesterday" → previous day.

   • "Last week" → 7-day window.

5. Search call recordings:

   • #Custom Gong Search Calls by accountId + date range.

   • #Get All Meetings from Fathom as fallback.

   • #Custom Get HubSpot Engagements (Meetings) by companyId + date.

6. If multiple matches, list them:

   1. #Send Direct Message with: Title | Date | Duration | Participants | Link.

   2. #Trigger Form to pick one.

7. On selection (or if single match):

   • #Custom Gong Get Call Transcript (or #Get Meeting Transcript from Fathom).

   • #Custom Gong Get Call AI Summary for the AI-generated summary.

   • #Custom Gong Get Call Highlights for key moments and action items.

8. Format the response:

   • TL;DR (1-3 sentence summary).

   • Key moments with timestamps.

   • Action items extracted.

   • Sentiment / talk ratio if relevant.

   • Full transcript link.

9. #Send Direct Message with the formatted call brief.

10. #Create HubSpot Note on Deal if a deal is associated, capturing the summary.

11. #Leave Internal Note.

12. #Resolve Request.

1. #Trigger Form for platform, card identifier, when lost, suspected fraud, replacement needed, shipping address.

2. #Lookup Users.

3. #List Ramp Cards by User to confirm card.

4. Immediate containment:

   • #Custom Ramp Freeze Card instantly.

   • #Custom Ramp List Recent Transactions for post-loss activity.

5. Fraud suspected:

   • #Custom Ramp Open Fraud Claim.

   • #Send Channel Message to #finance-fraud-log.

   • #Custom Notify Card Provider Fraud Team.

6. Identity verification:

   • #Request Approval from manager for replacement above threshold.

7. Replacement:

   • #Custom Ramp Order Replacement Card with overnight to address on file.

   • #Custom Ramp Set Card Limits matching previous.

   • For virtual: custom Ramp Issue Virtual Card immediately.

8. #Send Direct Message with freeze confirm, fraud case number, tracking, virtual card details, what to do if found.

9. #Send Channel Message to #finance-card-log.

10. schedule_action wake at expected delivery + 1 day to confirm receipt.

11. #Leave Internal Note.

12. #Resolve Request.

1. #Trigger Form for cardholder, current limit, requested limit, permanent vs temporary (with expiry), justification, cost center.

2. #Lookup Users with includeManager + includeGroups.

3. #List Ramp Cards by User.

4. Validate against role-based max:

   • #Custom Get Role Max Card Limit.

   • Above max → cannot proceed without exception.

5. Approval tier:

   • <25% increase → manager.

   • 25-100% → manager + finance ops.

   • >100% OR new limit >$25k → manager + finance ops + controller.

6. #Request Approval chained.

7. On approval:

   1. #Custom Ramp Update Card Limit.

   2. For temporary: capture original limit + expiry.

   3. schedule_action wake at expiry to revert.

8. #Send Direct Message with new limit, effective date, reversion date.

9. #Send Channel Message to #finance-card-log.

10. On reversion wake: DM cardholder + channel log.

11. #Leave Internal Note.

12. #Resolve Request.

1. Pull cert inventory:

   • #Custom Cloudflare List Certificates for all zones.

   • #Custom AWS ACM List Certificates for all regions.

   • #Custom Let's Encrypt List Certificates if any managed externally.

   • #Custom GCP Certificate Manager List.

2. For each cert, capture:

   • Domain(s)

   • Issuer

   • Not-after date

   • Days-to-expiry

   • Cert owner (via custom Get Cert Owner).

3. Determine alert tier:

   • 30 days → first reminder.

   • 14 days → second reminder.

   • 3 days → urgent + create Linear ticket.

   • Expired → critical alert.

4. For each cert at an alert tier:

   • #Lookup Users on the cert owner.

   • Check if already alerted in the last 24h (avoid spam).

5. Send the alert:

   • #Send Direct Message to the owner with: domain, expiry date, days remaining, renewal runbook link, "Renew now" form.

   • For auto-renewable certs (LE, ACM auto-renew): just notify; system will handle.

   • For manual: provide step-by-step.

6. On "Renew now":

   1. For LE / ACM: custom Trigger Cert Renewal action.

   2. For manual cert sources: #Create Linear Issue in the platform project assigned to the owner.

7. At 3-day mark:

   1. #Create Linear Issue regardless of prior action.

   2. #Send Channel Message to #security with the impending expiry.

8. At expiry:

   1. #Send Channel Message to #security-critical and the cert owner's team channel.

   2. #Custom Page On-Call for production-critical certs.

9. Weekly summary:

   1. #Send Channel Message to #security with: certs expiring in next 30/60/90 days, renewal status.

10. #Custom Vanta Upload Evidence monthly with cert inventory snapshot. ​

11. #Leave Internal Note for each cert action.

1. #Get HubSpot Deal Details with Activity Timeline for context.

2. #Lookup Users on $deal.ownerId.

3. Capture loss reason if not already on the deal:

   • Check closedLostReason field — if empty, prompt the AE.

   • #Send Direct Message to AE with a #Trigger Form:

     • Primary loss reason (Price / Product fit / Competitor / Timing / No decision / Champion left / Other).

     • Competitor (if Competitor selected).

     • Decision-maker (who made the call).

     • Lessons learned (free text).

     • Win-back potential (Likely / Possible / Unlikely).

4. schedule_action wake at 3 days if AE hasn't responded.

5. On AE response:

   • #Update HubSpot Deal Properties with the loss data.

   • #Create HubSpot Note on Deal with the full loss analysis.

6. Schedule win-back cadence (if Likely or Possible):

   • #Custom Outreach Enroll Sequence with a 90-day post-close win-back sequence.

   • #Custom HubSpot Add Contacts to List for "lost-win-back-candidates".

7. Competitive intelligence:

   • If Competitor reason: #Send Channel Message to #competitive-intel with the deal + competitor + dynamics.

   • #Custom Update Competitive Tracker with the loss.

8. Gong tagging:

   • #Custom Gong Tag Deal Calls with closed-lost-{{reason}} for future training.

9. QBR tagging:

   • #Custom Tag for Loss Analysis to surface this deal in the next QBR/loss review.

10. AE coaching trigger:

    • For specific loss reasons (e.g. "Champion left", "Product fit"): suggest coaching topic to manager.

    • #Send Direct Message to manager with: "Three deals lost to {{reason}} this quarter. Coaching session?"

11. #Send Channel Message to #deal-lost-log for visibility (without amount if sensitive).

12. #Leave Internal Note with full cascade.