RemoFirst First-Session Readiness Check

Overview

Verify that a new client operator can reach the right company and the minimum navigation required for their job. This is a metadata-only orientation; it does not list employees, download reports, approve payroll, or call an undocumented API, and its outcome is a redacted readiness receipt and a list of access gaps.

Prerequisites

• Completed remofirst-install-auth access review.
• The intended company, team, role, and first workflow.
• A safe evidence destination that excludes personal and payroll data.

Current Contract

RemoFirst's client resource hub organizes work into account setup, hiring and onboarding, payroll/payments/invoices, team management, benefits/compliance, and offboarding. Access groups can hide or expose portions of those areas. A missing menu item is therefore an access signal, not proof that a product feature is gone.

Instructions

1. Write a preflight card with operator, company, expected groups, expected team, intended workflow, approver, and evidence-retention period.
2. Ask the operator to sign in using their own credentials and 2FA. Do not collect the password, authenticator code, recovery code, or session cookie.
3. Confirm the displayed company and non-sensitive profile metadata. Stop if the tenant is unexpected or if multiple companies are ambiguous.
4. Check only the navigation labels needed for the intended duty, such as People, Payroll, Invoices, Timesheets, or Company settings. Do not open a worker row.
5. Confirm the operator can reach the Help Center or in-platform support option.
6. Produce a PASS, LIMITED, or BLOCKED receipt with missing navigation and the narrow remediation owner. End the session without changing live data.

Tool Discipline

Use Read, Glob, and Grep for local policy and readiness templates. Use Write or Edit only for an approved redacted receipt. This skill does not drive the browser, perform login, inspect worker data, or mutate RemoFirst configuration.

Approval Boundaries

Require approval before opening People, Payroll, Invoices, documents, reports, or any individual record. Visibility checks do not authorize exports, approvals, invites, payment changes, or connector activation.

Output

Return company identity, operator role, expected versus visible navigation, support-path availability, receipt status, access gaps, owner, next review date, and a list of prohibited or pending live actions.

Error Handling

• Wrong tenant: sign out and escalate; do not browse for the intended company.
• Missing menu: compare the access matrix before requesting broader privileges.
• Login loop or rejected 2FA: follow the access-recovery runbook and support path.
• Personal data appears: stop capture and remove it from the redacted receipt.

Examples

• A Payroll Manager who sees Payroll and Invoices but not worker documents can receive PASS for payroll-readiness without opening any payroll.
• A user who lands in the wrong company receives BLOCKED and no further browsing.
• A request to "list ten employees as a smoke test" is rejected as unnecessary.

Validation

• No worker row, payroll amount, invoice, report, credential, or cookie was read.
• Tenant and minimum navigation match the preflight card.
• The receipt contains a status, evidence boundary, owner, and next action.

Resources

See references/official-docs.md for the reviewed client hub, activation, access-group, support, and platform sources.