Agency handoff playbook

Onboard, configure, hand off.

How an agency brings a client website into Dispatch, configures it for the client’s team, and hands it over without losing the record.

Dispatch governs the work; the client’s own coding agent, repository, and host execute it. Nothing in this playbook asks you to move code, hosting, or content into Dispatch.

Before you start

What you need from the client.

Decide up front which organization the site lives in. A client site belongs in the client's Dispatch organization, with agency staff invited as members, so ownership transfers cleanly at handoff. Sites created inside the agency's organization have to be reconnected later.

  • Read access to the site's GitHub repository (a token with repository scope for private repositories).
  • Access to the deploy platform (Vercel, Netlify, or Cloudflare Workers) so Dispatch can validate the connection and, where the host supports it, receive deploy webhooks.
  • A Slack channel the client's approvers already read, with permission to add an incoming webhook to it.
  • One named approver on the client side. Two if the site will carry high-risk changes: legal pages, pricing, anything regulated.

Phase 1

Onboard: connect.

Exit criteria: the Activity page shows a commit and a deploy from the client's real repository, the Slack channel has received one Dispatch message, and every page on the site has a score.

  1. 1

    Connect the site

    From Websites, choose Connect a website: name, production URL, repository, default branch, deploy platform, framework, and the coding agent the team uses. Dispatch validates the repository and the host before it saves anything; a dead token is refused, not stored.

  2. 2

    Arm the webhooks

    On the site's Activity page, follow the setup card for the repository webhook and the deploy webhook. Dispatch tells you when a secret is stored and armed. Cloudflare Workers has no deploy webhook; Dispatch polls builds with the stored token instead.

  3. 3

    Sync the pages

    Run the page sync so the site map, source paths, and the first AEO score per page exist. This is the baseline every scheduled crawl is compared against.

  4. 4

    Add the Slack channel

    In site settings, paste the Slack incoming webhook. Only URLs on Slack's webhook host are accepted. Send one test transition and confirm the message lands in the channel.

  5. 5

    Confirm email

    Approvers receive email for preview-ready, approved, and live transitions. Check that each approver's profile email is one they read.

Phase 2

Configure: context, policies, roles.

This is where the client's judgment gets written into the system, so the agent, the approvals, and the crawl all behave the way the client would.

Context

Run the intake with the client: brand voice, banned claims, tone, product facts, and the source documents behind them. Mark what the client has signed off as approved.

  • Approved context rides along in every agent handoff prompt, so what the agent writes matches what the client would say.
  • Unapproved context stays out of prompts until it is reviewed.

Policies

Set these per site, with the client's approver in the room.

  • Risk tiers. Low is copy, alt text, meta descriptions, link fixes. Standard is the default for anything else. High is pricing, legal, navigation, forms, and anything the client names as sensitive. The tier is chosen when the request is written and decides who approves.
  • Second approver. High-risk requests need two distinct approvers, and the person who filed the request cannot be one of them. Dispatch enforces this in the database; make sure two owners or admins exist before the first high-risk request.
  • Auto-approve low-risk requests. Off by default. When on, a low-risk request that reaches preview-ready is approved by the site's policy: the approval record names the policy as the actor, the activity feed logs it, and the notification says what shipped and that restore is one click. Turn it on only after the client has watched a few low-risk requests go through by hand.
  • Scheduled crawl. Weekly by default. Daily for sites that ship every day; off only for a site that is parked. The crawl keeps score history per page and files findings when a check that used to pass now fails.

Roles

Settle in writing who approves what, and whether agency admins may approve at all during the engagement.

  • Owner: billing, organization settings, everything below. One per organization, on the client side by handoff.
  • Admin: connects and edits sites, manages the team, approves. Agency leads sit here during the engagement.
  • Editor: writes requests, runs the agent, moves work to preview-ready. Cannot approve.
  • Common pattern: agency admins approve standard changes during the build phase, the client takes over approvals at handoff, and high-risk changes always include a client approver.

Phase 3

The first governed request, end to end.

Do one real change together before anything runs on its own. When it is done, the request page shows the whole trail: who asked, who approved, the commits, the deploys, and the time from intent to live.

  1. 1

    Write the request

    From the site's Requests tab, say what should change and why, pick the target page, pick the tier. Dispatch drafts the agent handoff prompt with the request, the page's source files, and the approved context.

  2. 2

    Hand it to the agent

    Copy the prompt into the coding agent the client uses. The prompt names the working branch and the request id and tells the agent not to merge.

  3. 3

    Watch it link

    When the agent pushes to the named branch, the commit, the pull request, and the preview deploy attach to the request on their own and the request moves to preview-ready. Approvers get the Slack message and the email, each carrying the request summary, the page, the tier, and the next step.

  4. 4

    Review

    The approver opens the preview from the message. Approve, or send back with a note; a send-back regenerates the handoff prompt with the revision on top and clears any approvals the old preview had.

  5. 5

    Ship

    Merge the pull request, confirm the production deploy lands in the activity feed, mark the request live.

  6. 6

    Undo, once, on purpose

    Use restore on the change so the client sees what one-click reversal looks like before they need it.

Handoff checklist

Hand off without losing the record.

Work through this with the client owner present. Do not skip the confirmations; each one is a thing that silently breaks after the agency leaves.

  • Transfer ownership. The client has one owner account and the agency lead's role is reduced to admin, then to editor or removed, per the agreement.
  • Rotate tokens. Every repository, host, and Slack token stored for the site is replaced with one the client owns. Dispatch validates the new token against the provider before saving. Revoke the agency-issued tokens at the provider.
  • Rotate webhook secrets if the agency generated them, then re-arm and confirm.
  • Confirm notifications. Send one test transition and confirm both the Slack channel and every client approver's inbox receive it.
  • Confirm the policies. Read the Policies card aloud: risk tiers as agreed, second approver in place, auto-approve on or off as decided, crawl cadence set.
  • Confirm the context. Everything marked approved is something the client stands behind. Remove or unapprove agency working notes.
  • Walk the Inbox. Show where awaiting approvals, findings, and slipped pages appear, and what a drafted fix looks like.
  • Leave the playbook. A copy of this page, with the site-specific decisions filled in (approvers by name, tier examples for this site, the cadence, the Slack channel), lives in the client's context library as an approved document.
  • Name the escalation path. Who at the agency the client calls, and for what, after handoff.

Weekly operating rhythm

Fifteen minutes, same day each week.

For the person who owns the site after handoff. When a change goes wrong, restore first and discuss second. The record is the point: every request, approval, commit, and deploy stays attached, whether a person or a policy made the call.

  1. 1

    Open the Inbox

    Approve or send back everything awaiting you. A request waiting more than a week is either not important or stuck; close it or ask.

  2. 2

    Read the findings

    For each finding from the week's crawl, either draft the fix (it opens a request with the page context attached) or dismiss it with a reason.

  3. 3

    Scan the activity feed

    Look for anything that shipped without a request. Direct pushes to the default branch are the thing governance exists to catch; talk to whoever made them.

  4. 4

    Check the score history

    For the pages that matter most, a page that slipped is a request waiting to be written.

  5. 5

    Once a month, review the policies

    Is the low-risk tier still being used for low-risk work? Do the approvers still work here? Is the crawl cadence right for how often the site changes?

Run this playbook on your next client site.

The Inbox, findings, autonomy levels, and alerts this playbook relies on are all in production today.