Lesson 5 of 7 / HQ fundamentals

Onboard a Team Member with /new-hire

Invite a teammate, choose least-privilege role and resource access, prepare a starter package, and verify the recipient's first HQ session.

Begin lesson

Complete in: 8–10 minutes
Written path: 11 steps

Outcome

You will send a reviewed invitation and give the teammate only the role, knowledge, credentials, and next steps needed to begin work.

Recorded walkthrough

Watch the complete path.

Follow the recording once, then use the written steps below as the durable checklist. English captions are available from the player controls.

HQ / Tutorial recording

This walkthrough uses demo data and shows the complete recorded workflow. Use the written steps below as your durable checklist while you follow along.

Before You Begin

A cloud-backed HQ company already exists.
You are authorized to invite teammates and grant company resources.
You know the teammate's business function and have their work email ready for the private prompt.
You can review the proposed access bundle before sending the invitation.

Step 1
Start the new-hire flow
Run the command with the teammate's name so HQ can check the roster and begin a new invitation.
CommandRun exactly as shown
```
> /new-hire [teammate name]
```
Expected result
HQ checks the company roster and opens the teammate onboarding flow.
Field note
[teammate name] is a placeholder; enter the person you are actually authorized to invite.
Figure 5.1
Start a new-hire flow from the HQ composer.
Step 2
Resolve identity ambiguity
If HQ finds a similar existing person, confirm whether your target is that person or a genuinely new teammate.
Expected result
HQ stops targeting the existing roster entry and continues with the correct new teammate.
Step 3
Choose the least-privilege role
Select Member or Admin according to the teammate's responsibilities. Reserve Owner for people who truly need complete company control.
SelectionChoose in the interface
```
— Select Member or Admin after reviewing responsibilities
```
Expected result
The invitation carries the lowest role that still supports the teammate's job.
Field note
The recording selects Admin for its example team; that choice is not a universal default.
Figure 5.3
Choose Member or Admin based on the teammate's responsibilities.
Step 4
Enter the business function
Describe the teammate's function in a short label so HQ can recommend relevant access.
PromptSend in your AI session
```
› Enter [business function]
```
Expected result
HQ has a functional label for building the onboarding bundle.
Field note
[business function] is a placeholder; use the teammate's real responsibilities.
Step 5
Choose an access strategy
Select whether to mirror a trusted teammate, use a functional baseline, or specify each grant manually. Review the result whichever path you choose.
SelectionChoose in the interface
```
— Select Baseline for this function
```
Expected result
HQ proposes role-appropriate credentials, knowledge, and onboarding context.
Field note
The recording chooses a functional baseline; it remains a starting point that a human should review.
Figure 5.5
Choose a functional baseline or another grant strategy.
Step 6
Review the bundle and send the invite
Check every proposed grant, enter the teammate's work email only in the private prompt, confirm the invitation, and request a starter package.
PromptSend in your AI session
```
› Review the proposed access bundle
› Enter [work email] privately and confirm
› Create a welcome package for [teammate name].
```
Expected result
HQ sends the reviewed invitation and begins building the onboarding package.
Field note
Bracketed values are placeholders. Never place a real email, invitation address, or credential in public tutorial content.
Step 7
Verify the operator-side result
Read the completion summary and confirm the invitation, assigned resources, starter package, and onboarding message are ready.
Expected result
The operator side shows a complete, reviewed onboarding package without revealing private values.
Step 8
Accept from the recipient account
On the teammate's account, open the HQ invitation and accept it.
NavigationOpen this destination
```
→ Open the private HQ invitation and accept
```
Expected result
The teammate joins the company and sees only the resources assigned to them.
Field note
Keep inboxes, invitation addresses, and account switchers out of screenshots and shared notes.
Step 9
Start the recipient's first session
From the teammate's HQ installation, scope a fresh session to the company and briefly introduce the work.
CommandRun exactly as shown
```
> /startwork awesomeco
> Hi, I'm getting started with awesomeco.
```
Expected result
HQ binds the session to the company and loads the teammate's authorized shared context.
Field note
awesomeco is the recording's example handle; replace it with the teammate's authorized company handle.
Step 10
Send an HQ DM if useful
Send the prepared onboarding note through HQ so the teammate receives the same next steps in their account.
CommandRun exactly as shown
```
> /dm [teammate name] with this message
```
Expected result
The onboarding note is delivered between the two HQ accounts.
Step 11
Verify the recipient's access
On the recipient side, check the role, assigned credential access, shared knowledge, onboarding note, and stated next steps.
Expected result
The teammate sees the intended role and resources without receiving any raw credential value.
Figure 5.11
The recipient's onboarding note summarizes role, access, and next steps.

Observable finish line

You are done when this is true.

The teammate has accepted the invitation, their role and access match the reviewed bundle, their onboarding note arrived, and their first company-scoped session loads only authorized context.