Back to Client Onboarding & Engagement Letters

Developer Handover Pack

Everything an engineer needs to build end to end: current state, agent specs, data flow, security, and a pre-build checklist.

4 pagesPDF · Technical
FS-DOC-04Technical

Developer Handover Pack

Client Onboarding & Engagement Letters

Process
Client Onboarding & Engagement Letters
Trigger
Client marked won in CRM
Volume
~15 new clients/month (188 runs this month)
Build option
Standard (recommended)
Total build effort
64 hours across 4 weeks
Build cost
$4,600
Annual saving
$11,700/year
Payback period
5 months
Date
[Today's Date]
Client
[YourCompany.com]

01Process snapshot

The current state is fully manual across six steps. Three steps are confirmed bottlenecks where work queues and steps are dropped under load. Total manual time per client is 210 minutes. At 15 clients/month and $45/hour, this costs $16,400/year in staff time. The automated build eliminates four of six steps from the manual queue, keeping two human checkpoints by design.

#
Step
Owner
Tool
Time
Bottleneck
Post-build status
1
Draft Engagement Letter
Practice Manager
Google Docs
40 min
Yes
Automated
2
Send For Signature
Practice Manager
PandaDoc
20 min
No
Automated
3
Run ID And AML Checks
Practice Manager
None
45 min
Yes
Human review
4
Request Client Documents
Onboarding Admin
Gmail
35 min
Yes
Automated
5
Set Up In Systems
Onboarding Admin
Karbon
50 min
No
Automated
6
Confirm Ready To Work
Practice Manager
None
20 min
No
Human confirm
Metric
Before
After
Time to client ready
3 weeks
4 days
Hours per client
7 hrs
2 hrs
Annual staff cost
$16,400
$4,700
Steps missed
Occasional
None tracked
Manual step coverage
73% manual
Agents handle 4 of 6 steps
Steps 3 and 6 (ID/AML checks and final ready confirmation) remain with a human by design. The automation flags and routes; it does not decide on compliance matters.
Developer Handover PackPage 1 of 4
FS-DOC-04Technical

02Agent specifications

Engagement Letter Agent

Generates a populated engagement letter from the CRM client record using a Google Docs template, then sends it to the client via PandaDoc for electronic signature. Eliminates manual drafting (step 1) and manual send (step 2). Build time: 14 hours.

Trigger
Client status set to won in CRM (webhook or polling interval 5 min)
Tools
Google Docs, PandaDoc
Replaces steps
Steps 1 and 2 (Draft Engagement Letter, Send For Signature)
Build time
14 hours
Implementation notes
Merge fields: client_name, service_scope, fee_structure, start_date, partner_name. PandaDoc template ID must be set in config. On PandaDoc send failure, retry x2 then alert Practice Manager via email. Tone and letter body are configurable per service type.
// Input
{ crm_client_id, client_name, client_email, service_scope, fee_structure, start_date, partner_name }

// Process
1. Fetch full client record from CRM using crm_client_id
2. Clone Google Docs template; replace merge fields
3. Export cloned doc as PDF
4. Create PandaDoc document from PDF; assign signer (client_email)
5. Send PandaDoc document for signature
6. Store PandaDoc document_id against crm_client_id

// Output
{ pandadoc_document_id, status: 'sent_for_signature', sent_at: ISO8601 }
Document Collection Agent

Triggered by the PandaDoc signature webhook once the engagement letter is signed. Sends a structured document and ID request email via Gmail. Sends up to three automated reminders on a configurable schedule until all required documents are uploaded or confirmed received. Tracks outstanding items in FullSpec Automation. Eliminates manual chasing (step 4). Build time: 18 hours.

Trigger
PandaDoc webhook: document status changed to 'completed' (signed)
Tools
Gmail, FullSpec Automation
Replaces steps
Step 4 (Request Client Documents)
Build time
18 hours
Implementation notes
Required document list is configurable per service scope. Reminder schedule default: day 2, day 5, day 9. If documents not received by day 12, escalate to Practice Manager. Gmail sends from a shared firm address; OAuth credential scoped to send-only. Track document receipt state in FullSpec Automation task record.
// Input
{ pandadoc_document_id, crm_client_id, client_email, client_name, service_scope }

// Process
1. Resolve required document checklist from service_scope
2. Send initial document request email via Gmail (template: doc_request_v1)
3. Create tracking record in FullSpec Automation with document checklist
4. On schedule: check outstanding items; send reminder if any remain
5. On all items received: update tracking record to 'complete'; emit trigger
6. On day-12 timeout: flag to Practice Manager; pause reminders

// Output
{ collection_status: 'complete' | 'escalated', completed_at: ISO8601, documents_received: [string] }
Onboarding Setup Agent

Triggered once documents are confirmed received and the ID/AML check (step 3, human) is marked clear. Creates the full client record in Karbon, assigns the correct workflow template, and notifies the Practice Manager that the client is ready to work. A person must manually mark AML clear before this agent fires. Build time: 20 hours.

Trigger
FullSpec Automation: collection_status = 'complete' AND aml_status = 'cleared' (set manually by Practice Manager)
Tools
Karbon, FullSpec Automation
Replaces steps
Step 5 (Set Up In Systems)
Build time
20 hours
Implementation notes
Karbon client record creation uses REST API v3. Assign default workflow template by service_scope mapping (see Integration & API Spec). On Karbon API error, log to FullSpec Automation and alert Onboarding Admin. Do not proceed to notification until Karbon confirms client_id returned. Step 6 (Confirm Ready To Work) remains a human action; this agent sends the prompt.
// Input
{ crm_client_id, client_name, client_email, service_scope, aml_status: 'cleared', documents_received: [string] }

// Process
1. Map service_scope to Karbon workflow_template_id
2. POST /clients to Karbon: name, email, workflow_template_id, custom fields
3. Store karbon_client_id against crm_client_id in FullSpec Automation
4. Send internal notification email to Practice Manager (Gmail): client ready for final confirm
5. Update FullSpec Automation run record: status = 'onboarding_complete'

// Output
{ karbon_client_id, onboarding_status: 'complete', notified_at: ISO8601 }
Total agent build time: 52 hours. Remaining 12 hours cover foundation, integrations, end-to-end QA, and go-live (see section 06).
Developer Handover PackPage 2 of 4
FS-DOC-04Technical

03End-to-end data flow

Full trigger-to-ready data flow for Client Onboarding & Engagement Letters
// ================================================================
// TRIGGER
// ================================================================
CRM webhook | poll (5 min interval)
  -> event: client_status = 'won'
  -> payload: { crm_client_id, client_name, client_email,
                service_scope, fee_structure, start_date, partner_name }

// ================================================================
// AGENT 1: Engagement Letter Agent
// ================================================================
FullSpec Automation receives trigger payload
  -> Google Docs API: clone template (template_id from config)
     merge: {{client_name}}, {{service_scope}}, {{fee_structure}},
            {{start_date}}, {{partner_name}}
  -> export cloned doc as PDF (Drive export endpoint)
  -> PandaDoc API: POST /documents
     body: { name, file: PDF, recipients: [{ client_email, role: 'signer' }] }
  -> PandaDoc API: POST /documents/{id}/send
  -> store: { crm_client_id -> pandadoc_document_id }
  -> output: { pandadoc_document_id, status: 'sent_for_signature' }

// ================================================================
// GATE 1: Signature received
// ================================================================
PandaDoc webhook -> FullSpec Automation
  event: document.completed (status = 'completed')
  payload: { pandadoc_document_id, completed_at }
  lookup: pandadoc_document_id -> crm_client_id

// ================================================================
// AGENT 2: Document Collection Agent
// ================================================================
FullSpec Automation receives gate-1 pass
  -> resolve document checklist from service_scope config
  -> Gmail API: send initial request email (template: doc_request_v1)
     to: client_email, subject: 'Documents needed to complete your onboarding'
  -> FullSpec Automation: create tracking record
     { crm_client_id, checklist: [...], status: 'awaiting_documents' }
  -> Scheduler: day+2, day+5, day+9 reminders if outstanding items > 0
  -> On all docs received: update record status = 'complete'
  -> On day+12 timeout: status = 'escalated'; alert Practice Manager
  -> output: { collection_status, completed_at, documents_received: [...] }

// ================================================================
// GATE 2: ID/AML check (human step)
// ================================================================
Practice Manager performs ID and AML checks manually
  -> On clear: set aml_status = 'cleared' in FullSpec Automation
  -> On fail: set aml_status = 'flagged'; compliance review loop begins
  -> Automation waits on aml_status before proceeding

// ================================================================
// AGENT 3: Onboarding Setup Agent
// ================================================================
FullSpec Automation detects: collection_status = 'complete'
                         AND aml_status = 'cleared'
  -> Karbon API: POST /clients
     body: { name: client_name, email: client_email,
             workflow_template_id: mapped from service_scope,
             custom_fields: { crm_ref: crm_client_id } }
  -> store: { crm_client_id -> karbon_client_id }
  -> Gmail API: send internal notification to Practice Manager
     subject: '[client_name] is ready to work'
  -> FullSpec Automation: update run record
     { status: 'onboarding_complete', karbon_client_id, notified_at }
  -> output: { karbon_client_id, onboarding_status: 'complete' }

// ================================================================
// FINAL STATE
// ================================================================
Client record exists in: CRM (won), PandaDoc (signed), Karbon (active)
FullSpec Automation run log: complete
Practice Manager notified: yes
Manual actions remaining: Step 6 (Confirm Ready To Work) at Practice Manager discretion
Developer Handover PackPage 3 of 4
FS-DOC-04Technical

04Security and compliance requirements

#
Requirement
Detail
Status
1
OAuth 2.0 for Gmail
Scopes required: gmail.send, gmail.readonly. Service account with domain-wide delegation or per-user OAuth. Tokens stored encrypted in FullSpec Automation credential vault.
To confirm
2
Google Docs API access
OAuth 2.0 scopes: drive.file (clone and export only). Access limited to the template folder. Do not grant drive full-access scope.
To confirm
3
PandaDoc API key storage
API key stored as an encrypted secret in FullSpec Automation. Never logged in plaintext. Rotate every 90 days. Confirm PandaDoc workspace is production, not sandbox, at go-live.
To confirm
4
Karbon API credentials
Karbon uses API key plus access token pair. Store both in FullSpec Automation credential vault. Confirm API key is scoped to clients and workflows only, not admin or billing endpoints.
To confirm
5
AML/ID data handling
ID documents received by email must not be stored in automation logs. Practice Manager reviews and stores in compliant document store only. FullSpec Automation records checklist state, not document content.
To confirm
6
Data residency
Confirm that FullSpec Automation instance, Gmail workspace, and Karbon tenant are all within the required jurisdiction for client PII. Default assumption: US/AU. Document the confirmed region before go-live.
To confirm
7
PII in automation logs
No client PII (email, full name, ID data) to be written into raw automation execution logs. Use crm_client_id as the log reference key. Mask or exclude PII fields at the logging layer.
To confirm
8
Engagement letter retention
Signed PandaDoc documents must be retained per firm policy (typically 7 years). Confirm PandaDoc workspace retention settings. Do not rely on automation storage for primary retention.
To confirm
9
Access control for automation config
FullSpec Automation workflow editor access limited to the assigned developer and Practice Manager. No shared admin credentials. Audit log enabled for config changes.
To confirm
10
Error and escalation alerts
All escalation and error notifications sent to a monitored shared mailbox, not a personal email. Confirm recipient address before go-live. Alerts must not expose API keys or raw payloads in email body.
To confirm
11
Webhook endpoint security
PandaDoc webhook must validate the HMAC signature header on every inbound request. Reject any request without a valid signature. FullSpec Automation webhook URL should be non-guessable (UUID-based path).
To confirm
12
GDPR/Privacy Act compliance
Client data processed through this automation falls under applicable privacy legislation. Confirm a data processing agreement is in place with each tool vendor (PandaDoc, Google, Karbon). Record agreements in the firm compliance register.
To confirm
All rows are marked 'To confirm' and must be reviewed with [YourCompany.com] before build commencement. The developer should not proceed to credential provisioning until at least items 1 through 6 are signed off.

05Pre-build checklist

Two separate checklists are provided below. The first covers items the client ([YourCompany.com]) must supply before the build can start. The second covers items the developer must set up independently. Neither list should be considered complete until every item is ticked off and confirmed in writing.

Client to provide:

CRM access and won-status webhook or API key : Developer needs to confirm the CRM in use (e.g. HubSpot, Salesforce, other) and obtain API credentials or webhook config. The trigger depends on this.
Google Docs engagement letter template : The existing letter template must be shared to the service account or OAuth user used by the automation. Merge field names must be agreed and marked in the document.
PandaDoc workspace credentials and template ID : Provide the PandaDoc API key and the document template ID to use for engagement letters. Confirm the workspace is production-ready.
Gmail shared mailbox OAuth consent : A firm Gmail account or shared mailbox must grant OAuth consent for send and read scopes. Confirm the account to use and who will authorise consent.
Karbon API key and workspace URL : Provide Karbon API key scoped to clients and workflows. Confirm the workspace subdomain and environment (production only).
Required document checklist per service scope : Supply the list of documents required for each service type (e.g. tax, bookkeeping, advisory). This drives the Document Collection Agent checklist logic.
AML/ID check process confirmation : Confirm the manual AML process: who performs it, where the result is recorded, and how the automation should be signalled that the check is clear.
Escalation and alert recipient email address : A monitored shared mailbox address to receive all automation error and escalation alerts. Must not be a personal inbox.
Data residency and privacy confirmation : Written confirmation that all tools in the stack are approved for processing client PII under applicable privacy legislation. Include DPA references.
Go-live date and pilot client list : Agree a target go-live date and identify 2 to 3 pilot clients for controlled testing before full rollout.

Developer to set up:

FullSpec Automation environment provisioned : Create and configure the FullSpec Automation workspace for [YourCompany.com]. Enable audit logging and set execution retention to 90 days minimum.
Credential vault entries created : Store all API keys and OAuth tokens in the FullSpec Automation encrypted credential vault: CRM key, Google OAuth token, PandaDoc API key, Karbon API key + access token.
Google OAuth app registered : Register an OAuth 2.0 application in Google Cloud Console. Set redirect URIs for FullSpec Automation. Restrict scopes to drive.file and gmail.send, gmail.readonly only.
PandaDoc webhook endpoint configured : Register the FullSpec Automation webhook URL in PandaDoc settings. Enable HMAC signature validation. Subscribe to the document.completed event only.
Karbon API connectivity tested : Confirm a successful authenticated GET /clients call against the production Karbon workspace before starting agent build. Log the response schema version.
Google Docs template cloning tested : Run a manual clone-and-merge test using the client-supplied template. Confirm all merge fields resolve correctly and the PDF export is clean.
FullSpec Automation tracking schema defined : Create the run record schema in FullSpec Automation: fields for crm_client_id, pandadoc_document_id, karbon_client_id, collection_status, aml_status, timestamps.
Reminder scheduler configured : Set up the day+2, day+5, day+9 reminder schedule in FullSpec Automation. Confirm timezone setting matches the client's operating timezone.
Error handling and retry logic implemented : Implement retry logic (x2) on PandaDoc send and Karbon POST. All unresolved errors must write to the run log and trigger an alert to the escalation mailbox.
Internal notification email templates created : Draft and test the three email templates: initial document request, reminder, and Practice Manager ready-to-work notification. Get client sign-off on copy before go-live.

06Recommended build stack

Tool
Role
Monthly cost
Auth method
Notes
FullSpec Automation
Orchestration and monitoring
$165/month
API key (platform)
Primary workflow engine. All agents built here. Credential vault used for all secrets.
Google Docs
Engagement letter templating
$0 (Workspace)
OAuth 2.0 (drive.file)
Clone template per client. Export as PDF for PandaDoc upload. Template stored in shared Drive folder.
PandaDoc
Engagement letter signature
$25/month
API key + HMAC webhook
Standard or Business plan required for API access. Confirm template feature is available on current plan.
Gmail
Document requests and alerts
$0 (Workspace)
OAuth 2.0 (gmail.send)
Used by Document Collection Agent and for internal notifications. Shared mailbox preferred.
Karbon
Practice management setup
$0 (existing)
API key + access token
Client record creation and workflow template assignment. REST API v3. Confirm plan includes API access.
Total monthly tooling cost
$190/month ($165 FullSpec + $25 PandaDoc; other tools at no additional cost)
Automation cost annualised
$1,980/year
Build effort breakdown
Foundation and integrations: 8 hrs; Engagement Letter Agent: 14 hrs; Document Collection Agent: 18 hrs; Onboarding Setup Agent: 20 hrs; QA and go-live: 4 hrs
Total build hours
64 hours
Total build cost (Standard)
$4,600
Estimated calendar time
3 to 4 weeks
Payback period
5 months from go-live
Three-year net saving
$35,100
Phase
Scope
Weeks
Hours
1 Foundation
Environment, credential vault, all API connections tested
Week 1
8
2 Engagement Letter Agent
Google Docs clone, PandaDoc send, webhook intake
Weeks 1 to 2
14
3 Document Collection Agent
Gmail send, reminder scheduler, FullSpec tracking record
Weeks 2 to 3
18
4 Onboarding Setup Agent
Karbon record creation, aml_status gate, notification email
Weeks 3 to 4
20
5 QA and go-live
End-to-end regression, pilot clients, stakeholder sign-off, monitoring on
Week 4
4
The Standard build is the recommended option for [YourCompany.com]. It delivers the full three-agent flow with configurable thresholds and a monitored run log. The Lite build ($2,800) suits a no-code owner but lacks the scheduling and error-handling depth needed for AML compliance routing. The Enterprise build ($10,600) adds owned infrastructure and is appropriate only if data residency rules prevent use of cloud tooling.
Developer Handover PackPage 4 of 4

More documents for this process

Every document generated for Client Onboarding & Engagement Letters.

Launch Plan
Operations · Owner
View
ROI and Business Case
Finance · Owner
View
Process Runbook / SOP
Operations · Owner
View
Integration and API Spec
Technical · Developer
View
Test and QA Plan
Quality · Developer
View