SGA Growth Manager Tech Stack For review

Microsoft 365 Copilot

What it is. Microsoft's assistant inside Teams, Outlook, Word, Excel and SharePoint, under SGA's Microsoft BAA. The $30 add-on (Microsoft calls it "Microsoft 365 Copilot"; SGA shorthand is "Copilot Premium") is the one that includes Copilot in Teams. The no-cost "Copilot Chat" that every Entra account already has does not cover Teams meetings.

What the Growth Manager does with it

• Record and transcribe doctor and office-manager interviews in Teams; get the recap, action items and quotes without a third-party notetaker.
• Screen the recap: "list every patient name, age, date of care or detail that identifies a patient, then remove them," and save the screened text to the SharePoint interview library. This is layer 1 of the PHI scrub.
• Draft vendor tickets, office follow-ups and ROD replies in Outlook, grounded in the thread and the attached files.
• Summarize and search SharePoint files: contracts, audit workbooks, the marketing plan.
• Prepare for a call from the last three emails and the meeting history with that office.

Access and cost

• Microsoft 365 Copilot add-on: $30 per user per month, paid yearly, on top of a qualifying Microsoft 365 license (source: microsoft.com/en-us/copilot/pricing/enterprise). Copilot Chat is at no additional cost but has no Teams coverage.
• Status 10/19: Copilot is the default for work-data tasks inside Microsoft 365; Scott, Amy and Dakota hold evaluation licenses; a company-wide rollout was estimated at about $240K and parked. Growth Manager licenses are a request to Scott, three seats first.
• Teams native transcription is the standard for internal meetings as of 10/19. Always-on transcription needs Ron, HR and General Counsel to settle a retention policy first.

Guardrails

• Recordings, transcripts and recaps stay in the tenant. Nothing leaves Microsoft 365 until it has been screened and saved to the interview library.
• Copilot never touches sga3p, WordPress or Yext. If Copilot can do the job, it does it inside the tenant; if the job needs an SGA system, the screened text moves to Cowork.
• Externally hosted calls that could involve patient details use the one approved exception tool once it has a BAA (Fireflies is the leading candidate); never Granola.

Setup

1. Scott assigns the add-on license to Jenn, then Kelly and Jayme on the go decision.
2. Transcription on for interview calls; consent language at join.
3. SharePoint interview library with a raw folder and a screened folder (the two-folder library already named as a bridge precondition).
4. One 30-minute session: the screening prompt, where to save, what never leaves the tenant.

Claude Cowork

What it is. Claude's desktop workspace on the Growth Managers' Claude Team seats. It is where drafting, analysis and every SGA connector come together: SGA Toolbox MCP, SGA Data MCP, Yext, and, after the pilot, WPVibe. Anthropic's page says "Claude Cowork is now just Claude" and lists it as included on Pro, Max and Team (source: claude.com/pricing).

What the Growth Manager does with it

• Morning triage: my tasks, what is waiting on an office, what is past due, with comments and status changes posted back to sga3p.
• Content in the practice's voice: service pages, bios, financing and membership sections, the Plan Forward and Sunbit swaps, drawn from the Practice Knowledge Base brand voice and doctor quotes.
• Hours, insurance, scheduler links and phone numbers checked against the crosswalk effective value before anything is published.
• Pacing briefs and ROD prep from the SGA Data MCP numbers.
• Turning Granola vendor notes into task comments and next steps.
• Running the PHI scrubber (layer 2) on anything transcript-derived before it is used.

Access and cost

• Already licensed. Budget line: $21 per seat per month at the current rate. Anthropic list price is $25 per Team seat monthly or $20 annual; claudecowork.io, often found in search, is an unofficial fan site and not a pricing source.
• Team plan, no HIPAA configuration. Personal Claude accounts tied to SGA email are not permitted (10/19).
• On Team workspaces only an Owner or Admin can add a custom connector; members then authenticate individually.

Guardrails

• No PHI, ever: no recordings, no unscreened transcripts, no patient lists, no files from a practice management system. The Claude Cowork training page on the hub carries the full rule set.
• The hipaa-phi-scrubber skill runs on any transcript-derived text before drafting. It targets the 18 HIPAA Safe Harbor identifiers, replaces each match with a bracketed placeholder such as [PATIENT_NAME] or [DOB], and is followed by a manual spot-check for what regex misses, such as a first name inside a story.
• Authoring rules: a patient story becomes "a working case example"; doctor quotes stay, patient attributions go; every voice draft carries a Redaction Log; nothing is pushed to sga3p unscrubbed; no patient name, photo or case detail goes on a page without a consent record.
• Facts come from the connectors, not from memory: hours and links from the crosswalk, numbers from the SGA Data MCP, task state from the Toolbox MCP.

Setup

• Connectors today: SGA Toolbox MCP (sign in once under Account, Connections) and Yext. WPVibe is added by the workspace admin after the vendor gate.
• Project instructions for the Growth Manager project: the Section 6 rulebook from the pilot tab plus the sga-intranet quick reference.

WPVibe

What it is. A free WordPress plugin plus a hosted MCP server at mcp.wpvibe.ai. Cowork adds it as a custom connector; the Growth Manager can then read, draft and edit pages in plain conversation. It runs as whatever WordPress user approves the connection, so WordPress capability checks do the gating. It is the only path from Cowork into WordPress; the marketing operations side stays on the REST API from Claude Code.

What the Growth Manager does with it

• Lane A: create new service pages, bios and sections as WordPress drafts for Wyatt to review and publish.
• Lane B: edit and publish small factual changes on existing pages: hours, fax, doctor list, financing and membership sections, booking links, text and photo corrections, snapshot flag fixes.
• Read a page before editing it, confirm what changed after.

Access and cost

• Budget line: $19 per Growth Manager per month. The pricing page (mcp.wpvibe.ai/pricing) now lists annual tiers only: Free at 100 tool calls a day, Pro $99 a year (about $8.25 a month, 500 calls a day), Power $299 a year (2,000 a day). The daily limit is shared across all sites on one account, not per site. $19 is held as the budget figure until the month-to-month rate is confirmed; Pro at $99 a year covers a Growth Manager's drafting volume.
• One WPVibe account per Growth Manager, SGA email, six-digit email-code login.
• Status: proposed, not installed. Gated on the Scott and Brooke quick review and the BAA request. If WPVibe declines a BAA, no pilot without a written risk exception from Scott. Fallback: an SGA-owned MCP on Railway wrapping the REST client, Cognito-gated, about a week of build.

Guardrails

• One WordPress user per Growth Manager per site, Editor role, never Administrator. Nobody on Cowork can delete, change a slug, or touch plugins, themes or settings.
• Lane A is draft only; lane B publishes only the item types listed above and never creates a page.
• Excluded sites stay on the Claude Code REST path with Amy executing: Artistry in Dentistry, every Dobson-hosted site (WPVibe's cloud addresses would trip Wordfence unless Eric Hazelwood allowlists them), every LocalIQ-hosted site, Beaver Builder sites, anything in the rebuild queue.
• Every edit gets a comment on its sga3p task with the page URL and what changed.

Setup

• Per site, Wyatt, about 15 minutes: install the plugin, confirm application passwords are enabled in Wordfence, create the Editor user, confirm the site is on the allowlist.
• Per Growth Manager, Amy, about 30 minutes: WPVibe account, connector sign-in, "Connect my site," project instructions, smoke test, first three tasks.
• Full pilot plan, timeline and approvals: the last tab.

Yext API

What it is. Yext's management and content APIs, reached from Cowork through the Yext connector (api.yext.com/mcp). Reads and writes entities, listings, hours, holiday hours, photos and website or scheduler URLs across Google, Apple, Bing and 60-plus publishers from one place. Yext's API page lists the Management API (content, analytics, reviews, listings), the Content Delivery API and the Search API; API access comes with the platform and carries no separate price (source: yext.com/platform/features/apis).

What the Growth Manager does with it

• Hours and holiday hours changed once and pushed to every listing, the same hour the site is updated.
• Listing status sweeps before a launch: which publishers show errors or warnings, and which fields to fix.
• Entity audits: categories, timezone, phone, website and scheduler URL checked against the crosswalk effective value.
• Photo gallery and description updates with a before-and-after shown first.

Access and cost

• Already licensed. The connector is bound to the SGA Dental Partners account (101 healthcareFacility entities: the 88 Gen4 offices plus a handful of SGA East pilots). API and connector access runs through the end of the current term without a Scout license, confirmed with Yext on 9/8; no incremental cost.
• Most of the 249 practices are not in Yext yet. 37 are on the Q4 launch list; a practice is resolved by name before assuming it has an entity.

Guardrails

• Writes are live-publisher mutations. Read the entity first, show the field and the before and after, and get a per-entity yes.
• photoGallery and holiday hours are replace-all arrays: always send the full list.
• Field values come from the sga3p effective value, never from the raw source.
• Review responses are not available through the connector today (Yelp only, cannot respond). Google reviews are handled outside Yext.

Setup

• Already connected for the Growth Managers. The Yext Cowork playbook on the hub carries the setup steps and the paste-in rules.

SGA Toolbox MCP

What it is. The sga3p connector (api.sga3p.com/api/v1/mcp), built by Dakota and live since 9/24. It gives Cowork the task manager, the practice directory, the Master Crosswalk effective values, the Practice Knowledge Base and the interview manifest, scoped to what the signed-in person is allowed to see. Every call is written to the sga3p audit log.

What the Growth Manager does with it

• Tasks: my tasks, what is waiting on an office, search, comment, change status, create a task from a call.
• Practice context before any edit: website, scheduler link, hours, insurance list, ROD, marketing contact, all as the effective value that supersedes the public lookup API.
• Practice Knowledge Base: brand voice, doctor interview summaries and quotes for content drafting.
• Snapshot flags: see which fields an office flagged and close the execution subtasks when the destination system reflects the new value.

Access and cost

• No license cost; part of sga3p.
• Granted to every Growth Manager on 10/5 (the use-MCP permission on the Growth Manager role). One-time sign-in under Account, Connections in sga3p; Microsoft sign-in with the SGA email.
• Asks for Dakota from the pilot plan: a "Drafts awaiting review" view for Wyatt, an auto-comment on draft_ready, default-assign website edit requests to the Growth Manager with a "needs Wyatt" flag, and snapshot website subtasks to the Growth Manager when the site is on the credential list.

Guardrails

• The sga3p task is the record. Nothing is tracked inside a tool.
• Reads are scoped by the same visibility rules as the sga3p app; writes need the task-mutate permission.
• No PHI is pushed to the Practice Knowledge Base; transcripts are screened and scrubbed first.

SGA Data MCP

What it is. The governed metrics connector behind Growth Toolbox Reporting. It returns location-month rows for net production, collections, new patients and hygiene reappointment rate, plus the Dental Intel series (gross production, new patients, hygiene reappointment), keyed to the practice. Numbers carry an as-of time and must be cited with it.

What the Growth Manager does with it

• Pacing against goal for a practice or a book of practices before an ROD call, without filing a reporting request.
• New-patient trend by month for the practices in a Q4 plan.
• A one-page brief: the numbers, the two practices to watch, the question to ask the office.
• Practice lookup by name or code to resolve which location a number belongs to.

Access and cost

• No license cost; an SGA service.
• HQ entitlement is live. Growth Manager entitlement (own book, the four core metrics) is to be confirmed with Scott; the connector supports per-user scopes.
• The day-1 session noted that most reporting requests from operations leaders could be self-served; this is the self-serve path.

Guardrails

• Rate metrics (hygiene reappointment rate) are never summed across months.
• Pull with an explicit practice list; a network-wide pull can silently omit practices.
• Dental Intel series run asynchronously and can take a minute or two; cite the pull time.
• Aggregates only; no patient-level data exists in this connector.

Granola Basic

What it is. Granola's free plan: meeting notes and transcripts for calls on Zoom, Google Meet or the phone, with a 30-day history and an MCP connector scoped to the user's own notes from the last 30 days (source: granola.ai/pricing: Basic $0, Business $14, Enterprise $35 per user per month; MCP on all plans).

What the Growth Manager does with it

• Notes and action items from vendor calls hosted outside Teams: LocalIQ, MSP, Wonderist, Dobson, Yext, Plan Forward.
• Through the Granola MCP in Cowork, turn those notes into task comments, a vendor follow-up and a dated record on the sga3p task.

Access and cost

• Already in use on the free plan; $0.
• 30-day history on Basic: anything worth keeping is written to the sga3p task the same day.

Guardrails

• Vendor calls only. No patient is discussed on a vendor call; if one would be, the call moves to Teams or to the BAA-covered exception tool.
• Never used for doctor interviews, office-manager calls or internal meetings; those run in Teams with Copilot (10/19 decision, Granola retired on the growth side for internal meetings).
• No transcript from Granola is uploaded to sga3p; the task comment carries the actions, not the transcript.

Cost

Pricing notes: Copilot is $30 per user per month paid yearly (Microsoft). Cowork is held at the current $21 seat rate; Anthropic lists Team at $25 monthly or $20 annual. WPVibe is held at $19; the published tiers are annual (Pro $99 a year). Yext, the two SGA connectors and Granola Basic carry no incremental cost.

Return

The stack pays for itself in the first week of each month if it saves a Growth Manager two hours. Everything below that line is return.

Wyatt's side: the 23 queued edits that only need an application password, and the 27 already on sites with credentials, leave his desk. That is roughly 4 to 6 hours a month per Growth Manager book returned to site builds and technical work, and a backlog that stops growing.

What would reduce the return: WPVibe failing the vendor review (fallback is the SGA-owned MCP, about a week of build), Copilot licenses not granted (the interview flow then runs on Teams transcription alone, with manual screening), or Growth Managers not adopting the morning triage habit. The 30-day pilot measures all three.

What changes on Monday

1. Scott: three Copilot add-on licenses (Jenn first), Teams transcription on for interview calls, the SharePoint interview library, Growth Manager entitlement on the SGA Data MCP, and the WPVibe vendor review with the BAA request.
2. Wyatt: application passwords on the 20 WordPress sites in the 10/21 "after creds" list now, and the three pilot sites for WPVibe once the gate clears.
3. Dakota: the four sga3p asks on the SGA Toolbox MCP tab.
4. Amy: Growth Manager project instructions, the Jenn setup session, and the pilot checkpoint measures.

The original WPVibe + Claude Cowork pilot plan, kept whole for the approvals in its Section 8. Prepared 2026-10-20, amended 2026-10-21. The Claude Doc copy at claude.ai/artifact/DgH3u9d8RrhNZytJbwPHC2 carries the same text.

1. What we are asking you to approve

We want to let the Field Growth Managers (Jenn Freemyer, Kelly Caldwell, Jayme Monroe) draft website content directly in WordPress from Claude Cowork, using WPVibe as the connector. Two lanes: new pages and builder layouts are drafts that Wyatt publishes (lane A); small factual edits to existing pages, such as hours, fax, doctor list, financing links and booking links, the Growth Manager publishes directly under the Section 6 rules (lane B). Wyatt keeps everything technical. Microsoft 365 Copilot sits beside these two as the Growth Manager's tool for interview calls and email inside the tenant; Section 2 explains why all three are needed and how they fit together.

Approve, amend, or reject these six things:

1. Scope: a 30-day pilot with one Growth Manager (Jenn) on three sites, then a go or no-go for Kelly and Jayme.
2. Access model: one WordPress user per Growth Manager per site, Editor role, never Administrator. New pages and builder layouts land as drafts for Wyatt to publish (lane A). Small factual edits to existing pages may be published by the Growth Manager directly (lane B, Section 3). Nobody on Cowork can delete, change a slug, or touch plugins, themes or settings.
3. Work type: content items the website audits already assign to the Growth Manager (service pages, bios, financing and insurance copy, CTAs on content pages, trust content), plus the lane B edits that make up half of Wyatt's queue today. No technical items.
4. sga3p flow: the existing website-audit-remediation project carries the work. The GM drafts in WordPress and moves the task to draft_ready with the preview link. Wyatt reviews, publishes, and completes the task.
5. Gate: nothing is installed until the vendor passes the Scott and Brooke quick review and the BAA request is answered.
6. Intake routing: every website edit request is routed by type when it is triaged: content to the Growth Manager lane, wp-admin, Webflow Designer, Theme Builder, DNS, Google property ownership and plugin work to Wyatt, vendor-hosted sites to a vendor ticket. The Practice Snapshot flags follow the same rule from day one.

2. Why three tools: Microsoft 365 Copilot, Claude Cowork, WPVibe

The three tools and what each one is for

Why all three, not one. Each covers a boundary the other two cannot cross. Copilot is the only BAA-covered surface for meeting audio, transcripts and email, but it has no connection to sga3p, the crosswalk, the Practice Knowledge Base, Yext or WordPress. Cowork is the only surface wired to those systems, but a Team plan cannot be made HIPAA-ready, so it cannot be where a recording lands. WPVibe is the only path from Cowork into WordPress. The bridge between the first two is the one the AI session agreed on 10/19: Copilot retrieves and screens, sanitized text lands in an ingest location, Claude works from there, with Microsoft Presidio as an extra deterministic filter. Claude does not read email or meetings directly; that access routes through Copilot.

How a Growth Manager uses them: doctor interview to published page

1. Interview in Teams with transcription on. Teams native transcription is the standard for internal meetings as of 10/19 and Granola is retired on the growth side; an externally hosted call uses the one approved exception tool once it has a BAA (Fireflies is the leading candidate). Copilot produces the transcript and a recap inside the tenant.
2. Screen in Copilot. The Growth Manager asks Copilot to list and remove patient names, ages, dates of care and any detail that identifies a patient from the recap, then saves the screened text to the SharePoint interview library. Presidio runs as the deterministic pass once the bridge prototype is live (Scott and Amy, target 11/21).
3. Upload the screened transcript on the practice's Brand Voice page in sga3p (Practice Marketing, Brand Voice), which replaced the Drive drop folder. The composer builds or refreshes the practice's voice pack from it.
4. In Cowork, open the sga3p task, pull the brand voice and doctor quotes through the sga-intranet connector, and run the PHI scrubber on the transcript-derived text before drafting. Draft the page, bio or section in the practice's voice, and check hours, insurance and the scheduler link against the crosswalk effective values.
5. Through WPVibe, create the WordPress draft (lane A) or make and publish the edit on the existing page (lane B).
6. Comment on the sga3p task with the preview link or page URL and what changed; move lane A tasks to draft_ready for Wyatt.

PHI scrubbing: two layers, both required

• Layer 1, inside Microsoft 365 (BAA-covered): Copilot screens the transcript and recap, and Presidio runs on the saved text at ingest once the bridge is live. Nothing with free text crosses to Claude until this pass has run.
• Layer 2, in Claude: the hipaa-phi-scrubber skill runs on any transcript-derived file or text before it is used. It targets the 18 HIPAA Safe Harbor identifiers (names, dates of birth and of care, ages over 89, phone, fax, email, addresses finer than state, Social Security, medical record, account and plan numbers, device and vehicle identifiers, URLs, IP addresses, biometrics, photos, any other unique code), replaces each match with a bracketed placeholder such as [PATIENT_NAME] or [DOB], and is followed by a manual spot-check for what regex misses, such as a first name inside a story.
• Authoring rules that apply in both tools: a patient story becomes "a working case example"; doctor quotes stay, patient attributions go; every voice draft carries a Redaction Log; nothing is pushed to sga3p unscrubbed; no patient name, photo or case detail goes on a page without a consent record.
• What the Growth Manager never does: paste a raw recording or an unscreened transcript into Cowork, or use a third-party notetaker that lacks a BAA.

WPVibe specifically. WPVibe is a free WordPress plugin plus a hosted MCP server. Cowork adds it as a custom connector and the Growth Manager can then read and draft pages in plain conversation. It is not a replacement for the WP REST API we drive from Claude Code today. It sits on top of it.

For the marketing operations side we are staying on the REST API. The reasons WPVibe fits the Growth Managers and not us:

• Cowork cannot run our scripts. WPVibe is one connector URL that covers many sites.
• It runs as whatever WordPress user approves the connection, so WordPress capability checks do the gating. An Editor cannot touch plugins, themes, settings, SQL, or WP-CLI.
• New posts and pages default to draft. Deletes go to trash. Destructive actions need a dry run. Every sensitive action goes to an append-only audit log.
• It carries built-in skills for Divi, Elementor, Gutenberg, Beaver Builder, Kadence, and others. We will verify this on the pilot sites before trusting it.
• Free tier allows 100 tool calls per rolling 24 hours per account, which covers drafting. Paid tiers run $19 to $149 per month if we need more.

What it costs us: every call routes through WPVibe's cloud, and each GM's WordPress application password is stored there (encrypted at rest, per their docs). That is why the pilot uses Editor-role users on a short allowlist of sites, and why the vendor review comes first.

Two phases, so the routing rule can start now. Until step 2 in Section 7 clears, a task in the Growth Manager lane is executed from Claude Code by Amy over the REST API with the site's administrator application password; the Growth Manager supplies the content and the approval on the sga3p task. After the pilot, the Growth Manager makes the edit in Cowork through WPVibe with their own Editor user. Growth Managers never hold an administrator application password in either phase.

3. What the Growth Managers should work on

Confirmed: the audit already answers this. Every item in the website audit is assigned to either Internal Dev (Wyatt and Studio) or the Growth Manager, and the GM side is content. Across the 178 current audit workbooks, the Growth Manager items that fail or partially fail most often:

Three groups inside that list:

• Copy the GM can draft end to end: service pages, financing and insurance copy, membership plan section, new patient and emergency CTA copy, doctor bios, About page, testimonials from public reviews, blog posts. This is the pilot's core.
• Needs assets from the office first, then the GM drafts: awards, certifications, association badges, team page, video, before-and-after gallery. The GM collects, then drafts. Before-and-after photos need signed patient consent on file before anything is uploaded.
• Stays with Wyatt: everything the audit assigns to Internal Dev. Mobile performance (fails on 98% of sites), accessibility, HIPAA form language, privacy policy, location pages, viewport, broken links, header and nav changes, menu placement, builder templates, redirects, plugins. None of this is in scope for Cowork.

What Wyatt's queue says (reviewed 2026-10-21). The audit split holds up against the live backlog. Of the 103 open tasks assigned to Wyatt on 10/21 (77 past due, the oldest assigned 94 days earlier), 50 are content edits a Growth Manager could make, 32 need Wyatt, 19 have to go through a vendor, and 11 are stale or duplicate. 27 of the 50 are on sites where an application password or Webflow token is already on file; the other 23 need one created once. Per-task detail: Wyatt West open tasks with Claude feedback. The 39-practice Plan Forward and Sunbit swap in that queue, due 10/16, was 4 of 45 sites complete on a 10/21 scan of the live pages.

The two Growth Manager lanes

Content inputs the GM already has in Cowork through the sga-intranet MCP: the practice crosswalk (hours, insurance list, financing URLs, scheduler link), the Practice Knowledge Base brand voice and doctor interviews, and the GP sitemap spec for which service pages a general practice should have.

4. How it ties to the sga3p task manager

The website-audit-remediation project is already structured for this. Each practice has W tasks (web, Studio board), G tasks (GM collection, assigned to the Growth Manager), and B tasks (build, blocked by the G task). Today the G task ends with the GM handing a doc to Wyatt. With WPVibe the G task ends with a WordPress draft instead.

Proposed flow per task

1. GM opens the G task in Cowork (sga-intranet MCP, list_my_tasks) and reads the audit evidence.
2. GM drafts the page or section in WordPress through WPVibe. Status in WordPress: Draft.
3. GM comments on the sga3p task with the WordPress preview link and a two-line summary, then moves the task to draft_ready.
4. Wyatt reviews in wp-admin: rendered page, builder layout, SEO title and meta, internal links, menu placement. He publishes or sends it back with needs_revision.
5. Wyatt moves the task to completed. The linked B task unblocks automatically if the draft covered it, or stays open for the build work he still owns.

Rules

• Task naming stays as is: practice code prefix, verb, object, owner initials.
• Definition of Done on a G task becomes "WordPress draft exists at [preview link], reviewed by Wyatt."
• 24-hour comment SLA applies in both directions.
• The sga3p task is the record. The WordPress draft is the work product. Nothing is tracked in WPVibe.

Asks for Dakota

1. Confirm Jenn, Kelly, and Jayme hold tasks.action.mutate so they can move a task to draft_ready from Cowork.
2. A saved view for Wyatt: taskTypes=website, status=draft_ready, team=studio. Name it "Drafts awaiting review."
3. An auto-comment rule on status_changed to draft_ready for website tasks that mentions Wyatt. The rules engine already does this pattern elsewhere.
4. Optional, after the pilot: a wp_draft_url custom field so the preview link is a field and not a comment.
5. Intake: default-assign website_edit requests to the practice's Growth Manager with a "needs Wyatt" flag (or team reroute) instead of landing them on Wyatt first.
6. Snapshot execution subtasks whose destination is Website: assign to the Growth Manager when the practice's site is on the credential list, otherwise to Wyatt.

Intake routing for form-submitted Website Edit requests and snapshot flags

Most of Wyatt's non-batch queue arrives through the request form as a Website Edit, pre-assigned to him, and then waits while he asks the Growth Manager what the page should say. The rule: when the Growth Manager triages a request, lane B content goes to the Growth Manager (executed by Amy from Claude Code until the pilot clears, then in Cowork); anything that needs wp-admin, the Designer, Theme Builder, DNS or a plugin goes to Wyatt; anything on a vendor-hosted site becomes a vendor ticket the Growth Manager sends, with Wyatt looped in only when needed. Practice Snapshot execution subtasks (hours, fax, doctor list, scheduler link) follow the same rule: Growth Manager lane when the site is on the credential list, Wyatt or vendor otherwise. Carlton's snapshot alone produced 9 changes; across 249 practices that is hundreds of small edits. Asks 5 and 6 above cover the sga3p side.

Nothing in WPVibe writes to sga3p and nothing in sga3p writes to WordPress. Two systems, one human handoff.

5. Setup process for the Cowork users

Prerequisites (before anything is installed)

1. Vendor review through the Scott and Brooke quick-review tier. Package: what WPVibe is, data path, credential storage, Editor-role model, site allowlist, pilot scope.
2. BAA request to WPVibe. SGA policy requires one from every vendor regardless of the data path. If they decline, the pilot does not proceed without a written risk exception from Scott.
3. Confirm the Claude Team workspace: which account the GMs' Cowork is signed into, who the workspace Owner or Admin is, and that custom connectors are enabled for members. On Team plans only an Owner or Admin can add a connector. Members then authenticate individually.
4. Confirm that no pilot site exposes form entries to the Editor role. Gravity Forms and WPForms restrict entries to administrators by default. Wyatt checks each pilot site.
5. Microsoft 365 Copilot license for the pilot Growth Manager (Jenn), Teams transcription enabled on her interview calls, and the SharePoint interview library with a raw folder and a screened folder (the two-folder library already named as a bridge precondition). Requested from Scott.

Per site (Wyatt, about 15 minutes each)

1. Install the WPVibe plugin from WordPress.org (slug vibe-ai). Free.
2. Wordfence: confirm application passwords are enabled (All Options, Brute Force Protection, uncheck "Disable WordPress application passwords").
3. Create one WordPress user per Growth Manager, Editor role, named "Jenn Freemyer (Cowork)" with her SGA email.
4. Confirm the site is on the pilot allowlist and not in the rebuild or migration queue.

Per Growth Manager (Amy with the GM, about 30 minutes)

1. Create a WPVibe account with the GM's SGA email. Login is a six-digit email code. No password to manage.
2. In Cowork: Settings, Connectors, add custom connector, paste the WPVibe MCP URL (mcp.wpvibe.ai/mcp), sign in. If the workspace admin has already added it, the GM only authenticates.
3. In the Cowork chat: "Connect my site [URL]." WPVibe returns an authorization link. The GM opens it, logs in as their Editor user, approves.
4. Paste the Cowork project instructions (Section 6 rulebook) into the GM's Cowork project, alongside the sga-intranet MCP quick reference they already use.
5. Smoke test: read the homepage, list pages, create a test draft titled "Cowork test," confirm it shows as Draft in wp-admin, trash it.
6. First three G tasks assigned and walked through live.

Training

• One 45-minute session per GM. Reuse the Claude Cowork training page on the growth hub and the Yext Cowork playbook format (setup steps, then paste-in rules).
• Weekly 15-minute check-in during the pilot with Wyatt present.

6. Guardrails (the Cowork project instructions, in short)

• Lane A (new pages, bios, builder layouts): draft only. Never publish, never schedule.
• Lane B (hours, fax, doctor list, financing and membership sections, booking links, text and photo corrections on an existing page): edit and publish the existing page, then comment on the sga3p task with the page URL and what changed. Never create a new page or change a page's status under lane B.
• Never delete pages, posts, or media. Never change a URL slug.
• Only work on sites in your allowlist. If a site is not listed, stop and ask.
• Service pages follow the GP sitemap spec. Bios and voice come from the Practice Knowledge Base.
• No patient names, photos, or stories unless the office confirms consent is on file. Reviews quoted on the site come from public Google reviews only.
• Every draft gets a comment on its sga3p task with the preview link. Then move the task to draft_ready.
• Builder pages (Divi, Elementor): draft the content, tell Wyatt in the comment which page template or section you expected. He confirms the layout before publishing.
• If WPVibe asks for approval on anything (delete, SQL, WP-CLI, bulk change), the answer is no.

Sites excluded from the Cowork pilot and from any later wave until re-reviewed: Artistry in Dentistry (Amy approves each edit by standing rule), every Dobson-hosted site (WPVibe's cloud addresses would trip Wordfence unless Eric Hazelwood allowlists them), every LocalIQ-hosted site (edits go through a LocalIQ ticket), sites on Beaver Builder, and any site in the rebuild or Sanity migration queue. Growth Manager lane tasks on these sites stay on the Claude Code REST path with Amy executing. In the 10/21 queue that is nine tasks: Amelia Island, Jacksonville Beach (two), Dawson Rd, Southern Oak Greenville, Hammond, Clinton, and the two Artistry items.

Revocation: delete the GM's WordPress user on the site and delete the site from the WPVibe account. Both take under a minute and Wyatt can do either without Amy.

7. Next steps to launch on the Claude Team account

Steps 5 through 7 do not start until step 2 clears.

Checkpoint measures: drafts created, drafts published without changes, drafts sent back, days from G task assignment to publish, WPVibe tool calls used per week, incidents (anything published or changed that should not have been). The go decision needs zero incidents and a shorter assignment-to-publish time than the current doc-handoff path.

If the pilot works but the vendor is the sticking point: the fallback is our own MCP on Railway wrapping the REST client we already use, Cognito-gated, same "copy for Cowork" pattern already planned for the sga3p MCP. That keeps credentials in-house. Roughly a week of build.

8. Approval checklist

Wyatt:

• Editor-role model is acceptable on sites you own
• Lane B (Growth Manager publishes small factual edits on existing pages) is acceptable; you remain the publisher for lane A
• Application passwords created on the 20 WordPress sites in the 10/21 "after creds" list
• Three pilot sites named
• Exclusion list in Section 6 is complete

Dakota:

• GMs hold tasks.action.mutate
• "Drafts awaiting review" view and draft_ready rule are feasible by 11/5
• No objection to the preview link living in a comment for the pilot
• Intake: website_edit requests default to the Growth Manager with a "needs Wyatt" flag; snapshot execution subtasks follow the same rule

Both:

• The 30-day checkpoint measures are the right ones
• Copilot license for Jenn and the SharePoint interview library are requested from Scott, so the interview flow in Section 2 can run during the pilot

Appendix: full audit item split

Internal Dev items (Wyatt and Studio): HTTPS, viewport, Lighthouse performance, accessibility and best practices, broken links, duplicate titles, missing meta descriptions, missing H1, internal redirects, noindex, sitemap, robots, homepage metadata, scheduling CTA in header, appointment button above the fold, phone in header, click-to-call, sticky mobile CTA, appointment form, phone consistency, address, phone, hours, embedded map, contact page, location page, services in navigation, mobile navigation, readable text, tap targets, CTA visible on mobile, popups, forms on mobile, heading hierarchy, privacy policy, HIPAA form language, accessibility plugin and statement, HIPAA notice page, cookie notice, custom 404.

Growth Manager items: Lighthouse SEO findings, true online scheduling evaluation, emergency CTA, insurance and financing CTA, new patient CTA, every service page (general hub, exams and cleanings, fillings, root canals, extractions, restorative hub, crowns, dentures, implants, Invisalign, cosmetic, veneers, whitening, smile makeover, sedation, emergency, pediatric and family, orthodontics, periodontics), doctor bio, photo, credentials, education, team page, about page, before-and-after gallery, video, insurance information, financing information, patient forms, membership plan, blog, testimonials, embedded reviews, awards, certifications, association badges, trust badges.

Score-only, no task yet: real office photos, FAQs, first-visit expectations, downloadable forms.

Sources: AI Strategy Alignment session day 1 decisions (2026-10-19, sga-growth.dev/reports/ai-enablement-day1-2026-10-19/), the hipaa-phi-scrubber skill, Wyatt West open-task review and Plan Forward site scan (2026-10-21, sga-growth.dev/reports/wyatt-open-tasks/), WPVibe site and docs (wpvibe.ai), WPVibe plugin listing on WordPress.org, WPBeginner review, SGA website audit tool task map (tools/website-storefront-audit/audit.py), 178 current audit workbooks in docs/audits/website-audit, sga3p website-audit-remediation project notes.