AgenTeams Access Setup

THE COMPLETE RUNBOOK

Six gates to contribution-ready

Agency identity

One durable identity for the agency, never a personal account and never borrowed access.

0/4

Create the AgenTeams Workspace userHUMAN GATEUse one dedicated mailbox on the agency domain for invitations, calendar, Drive and recovery notices.FaresLock it with MFA and recoveryHUMAN GATEAdd two security keys where possible. Fares keeps the recovery path. Do not use SMS as the only factor.FaresCreate the agency password vaultQUEUEDOne shared vault named AgenTeams Agency. Client credentials stay in separate vault sections, never in Telegram, email, or this guide.AgenTeamsCreate an isolated browser profileQUEUEDSign the agency mailbox into its own browser profile. No personal extensions, saved cards, or unrelated project accounts.AgenTeams

Cloudflare and staging

Give the agency the smallest useful access, then build a safe surface away from production.

0/5

Invite the agency identity to CloudflareHUMAN GATEInvite the new mailbox to the account that owns the AgenTeams domain. Use least privilege, not the global API key.FaresConfirm the Cloudflare account and URL policyHUMAN GATEUse temporary pages.dev URLs for guides and staging. Keep admin.agenteams.my as the only AgenTeams custom subdomain.FaresEstablish scoped Cloudflare CLI accessQUEUEDAgenTeams initiates the login and limits access to the agenteams.my zone and required Pages, DNS and Access operations. Fares only approves if Cloudflare prompts.AgenTeamsPut internal pages behind AccessQUEUEDAllow only named agency users. Staging and setup pages must not be public or indexable.AgenTeamsCreate one temporary Pages project per clientQUEUEDBubble Bros, Hanskraft and future clients each get an isolated pages.dev project and environment, without adding custom subdomains.AgenTeams

Email and workspace

One agency front door, with strict walls between client folders and conversations.

0/4

Create the agency Drive structureQUEUEDCreate separate top-level folders for Bubble Bros, Hanskraft and Amalan Setar/YHOD. Do not reuse links across clients.AgenTeamsEnable mailbox and calendar accessQUEUEDUse the agency mailbox for client invites, handover meetings and support threads so history survives staff changes.AgenTeamsUpload contracts and support promisesQUEUEDPut the signed scope, price, maintenance terms and any promised features into the correct client folder.AgenTeams -> Fares for sourceStart the access registerQUEUEDRecord asset, owner, access level, expiry, last verification and offboarding path. Never record the secret value itself.AgenTeams

Bubble Bros

Close the missing context, remove continuity risk, and create the first safe place to contribute.

0/6

Share the live tracking sheet and last email threadHUMAN GATEThese are the final missing business-context artifacts. Put them in the Bubble Bros workspace folder.FaresCreate an agency admin-panel userQUEUEDCreate a named account with MFA. Verify AUTO_LOGIN is absent before treating the panel as protected.AgenTeams -> LouisBook the Louis handoverHUMAN GATEWalk through the real production branch, daily dispatch, current issues, live tracking and what the client still expects.Fares + LouisTransfer operational access read-only firstQUEUEDServer, database, Cloudflare tunnel, Shopify, Aramex, Google Sheets, Windsor and Grafana. Verify each one by using it.AgenTeams -> LouisClose the day-one safety itemsQUEUEDProve backups restore, rotate the exposed database password, remove AUTO_LOGIN and agree how committed customer photos are handled.No production change without Fares' GO and an agreed rollback path.AgenTeams -> LouisBuild staging away from the personal serverQUEUEDUse synthetic fixtures. No production database copy. Every future change leaves as a reviewed PR.AgenTeams

Hanskraft / Momentum

Source access already works. Secrets, infrastructure, client expectations and a safe handover do not.

0/6

Create an agency admin-panel userQUEUEDConfirm whether the client calls the product Hanskraft or Momentum before sending any client-facing message.AgenTeams -> LouisAdd the agency age recipientQUEUEDRe-encrypt the secrets bundle to an agency-held key. Do not share a personal private key.AgenTeams -> Louis / MathieuTransfer and verify infrastructure accessQUEUEDWireGuard, SSH, deployment environment, R2 backups, Grafana and the Google service account.AgenTeams -> Louis / MathieuVerify production controlsQUEUEDConfirm AUTO_LOGIN is absent, backups restore, alerts reach a person, and the production/staging data boundary is real.AgenTeamsWrite down the commercial handoverQUEUEDCapture price, support hours, current obligations, Xero expectation, go-live status and an agreed freeze date.AgenTeams -> Fares / LouisKeep bank credentials client-sideQUEUEDThe agency tests payment-file generation. Hanskraft Finance remains responsible for CIMB login, upload and final payment approval.Do not request, store or share CIMB credentials.AgenTeams -> Hanskraft Finance

Amalan Setar / YHOD

This remains discovery and a pre-sales POC. Collect evidence before asking for any live-system access.

0/5

Schedule Cameron's workflow callHUMAN GATEUse 45 minutes to walk one Credit Admin case from incoming document to Excel and every downstream system.Fares / LouisCollect redacted Credit Admin samplesQUEUEDThree to five documents, the Excel template, every rekeyed field, weekly volume and one ugly case.AgenTeams -> CameronCollect governance examplesQUEUEDOne departmental SOP, two phase-based LOA packages and the full approval matrix around the RM 20,000 threshold.AgenTeams -> Raj's teamMap the target systemsQUEUEDName each system, owner, field and handoff method. The POC produces draft outputs until a real integration is approved.AgenTeams -> CameronGet Fares' GO before the Friday showcaseHUMAN GATEThe demo uses synthetic data and must state what is simulated, what is proven and what still needs client validation.No client data, credentials or production writes in the POC.Fares

You handle the gates.
We handle the setup.

Eight human gates