Rippling

One employee record,

sold cold.

An outbound-only playbook for US mid-market: ICP definition, account screen, buyer map, trigger library, wedge selection, multichannel sequences, call scripts and the activity math behind quota.

Company facts are taken from Rippling's own site, its live job postings, and third-party trackers, each labelled where it matters. Pricing figures published by third parties are marked as such — Rippling does not publish full pricing. Every planning assumption is listed in Section 14.

01 · The brief

H1What the role actually is, and what that means for this capstone

Before choosing an ICP I read Rippling's live SDR postings rather than guessing at the org chart. Three things came back, and each one changed a decision in this document.

The honest finding: Rippling's outbound SDR is a platform seller aimed at upmarket accounts. Which means the difference between a good SDR and a bad one here is not product knowledge — it is deciding which single door to knock on first.

So this capstone does one thing properly rather than four things thinly: it picks the door, proves the account list, and writes the touches. No inbound, no content, no partner motion — those are real levers at Rippling but they are not the job I would be hired to do.

02 · The company

H1What Rippling sells, in the language a buyer uses

Rippling is a workforce management platform. The claim underneath every product is a single one: one source of truth for employee data, and every downstream system driven off it. Rippling's own description of the payoff is the clearest version — hire someone and their payroll, health insurance, work laptop and third-party apps like Slack, Zoom and Office 365 are all set up in about ninety seconds, from one click.

The three suites

Global reach: employer of record coverage in 80+ countries, contractor payments in 185+ countries and 50+ currencies, and native payroll in the US, UK, Canada, Australia and India — which matters because native payroll means a company can hire directly in those markets without paying EOR margin.

Stage and scale, for credibility on a call

Pricing, as far as it is public

Rippling does not publish full pricing, which is itself a fact to plan around: an SDR cannot lead with a price, so the opener has to lead with a cost the prospect is already paying. Third-party reporting puts the platform base around $8 per employee per month plus a base fee, roughly $25–50 PEPM once payroll is added, and $60 or more where HR and IT run together. Treat every one of those numbers as third-party and unconfirmed — I would validate them internally in week one before using any of them in a sequence.

Useful comparison anchors from the same third-party reporting: Insperity around $150–210 PEPM, Deel's PEO around $95 PEPM, and EOR pricing at Deel and Justworks around $599 per employee per month. These are the numbers a mid-market buyer is already paying, which is why the wedge in Section 06 is built on their spend, not on Rippling's.

03 · The ICP

H1Who I would build a list of, and who I would refuse

Segment given: US mid-market, 200–1,000 employees. That band alone is not an ICP — it is a filter that still leaves tens of thousands of companies, most of which will not take a meeting. The screen below is what turns it into a list worth working.

Firmographic core

Technographic screen — the part most lists skip

Firmographics tell me they could buy. The stack tells me whether they will, and when.

Hard disqualifiers

• Under 150 employees — self-serve and the SMB team already cover it, and the deal will not carry a mid-market cycle.
• Over 1,500 employees — enterprise segment, longer security review, different AE.
• Heavily hourly, unionised or shift-based workforces with complex collective agreements — traditional PEOs and industry-specific vendors fit better and the sales cycle punishes a generalist platform.
• Government contractors with FedRAMP or similar procurement requirements.
• Companies fewer than 18 months into a major HRIS implementation, regardless of how much they hate it.
• Single-state, no international, fewer than three systems in the stack. There is not enough pain to justify a change.

Account tiering — 200 named accounts per quarter

The tier is not a comment on how good the company is. It is a statement about how many of my hours it deserves this month.

04 · The buyer map

H1Four doors, and the one I open first

At 200–1,000 employees nobody signs alone. The SDR job is not to find the signer — it is to find the person who will describe the pain in their own words and then walk me upstairs.

Multithreading rule

Three contacts minimum per Tier A account, opened in sequence rather than simultaneously: People Ops first, IT on day three, Finance on day eight and only with a number in the subject line. The same account, three different problems, three different words for the same platform. If two of the three reply, the account is warm regardless of which one takes the meeting.

One message repeated to three people is spam. Three problems described to three owners is an account strategy.

05 · Trigger library

H1Dated, observable events — ranked by how well they predict a meeting

A cold email with no trigger is an interruption. A cold email attached to something that happened last month is a conversation. Everything below is publicly observable and can be monitored without paid intent data, though I would use intent data if it exists.

How the monitoring actually runs

• Monday morning, ninety minutes: job-board sweep across the Tier B list for HRIS, People Ops, Payroll and IT roles, and for any posting located outside the US. Anything found promotes that account to Tier A this week.
• LinkedIn Sales Navigator alerts on the full 200: job changes at director level and above, headcount growth flags, and company news.
• A saved search per PEO logo, because a PEO customer crossing 200 heads is the single best account I can find.
• Every trigger gets logged in the CRM with its date. A trigger older than 90 days is history, not a reason to call.

06 · Wedge selection

H1Three doors, and why I lead with the cost one

Rippling can sell HR, IT and Finance to the same account. Outbound cannot. A message that describes a platform describes nothing, so the sequence leads with one problem and the platform arrives later, once someone is talking.

The call, and the reasoning behind it

I lead with Wedge A. Three reasons. It is the only wedge whose cost the prospect can verify without me — the invoice is already in their inbox. It rides the highest-yield trigger in Section 05, which is a PEO customer crossing 200 employees, and that trigger is findable at scale rather than one account at a time. And it opens with the economic buyer already in the room, which shortens the path from a first reply to an AE-accepted meeting.

Wedge B is not a fallback, it is the second thread on the same account, opened on day three to a different person. It is also the wedge with the highest reply rate in my experience of writing to technical buyers, because it names a risk rather than a saving, and risk is harder to defer than cost.

Wedge C is trigger-gated. I do not run it on a schedule, I run it the week a foreign job post appears. Roughly one Tier A account in four will qualify at any time, and when it does it outperforms both other wedges because the decision already has a date on it.

The wedge is the door. The platform is the house. No cold email has ever sold a house by describing every room.

07 · Building the list

H1How 200 accounts and 600 contacts get made

Data rules I would hold myself to

• No account enters a sequence without a named stack and a named trigger. If I cannot say why I am writing this week rather than any other week, I am not ready to write.
• No contact enters a sequence without a verified email or a verified mobile. Guessed patterns burn the domain and the domain belongs to the whole team.
• Twenty-five new accounts researched every week, which is what keeps the 200 alive as the tiers churn.
• Anything disqualified gets a disqualification reason written down, because six months later the reason may have expired.

08 · The sequence

H121 business days, three people, four channels

Account-based, not contact-based: the clock belongs to the account, and the three contacts sit at different points on it. Phone leads, because at mid-market the phone still produces most of the conversations and email produces most of the meetings that were already warm.

Rules that do not bend

• Every follow-up is a new angle, never a bump. Just following up is a confession that the first email had nothing in it.
• No calendar link until after a reply. A link in a cold email is an ask before a reason.
• Under 90 words per email at this segment, and a single question at the end.
• Never two touches to the same person on the same day, except the deliberate day-12 double tap.
• The break-up is genuinely final. Re-entry happens on a trigger, not on a schedule, and a re-entry after a trigger reads completely differently.

Calling blocks

Best-answer windows for US mid-market are early morning and late afternoon local time, before the calendar fills and after it empties. Working from IST that means a US-Eastern morning block from roughly 6:30pm IST and a US-Pacific block later still. Two blocks of ninety minutes beats five hours of scattered dialling, because connect rates depend on their calendar, not on my effort.

09 · The copy

H1Verbatim, with variables in brackets

House rules: lowercase subject lines, no throat-clearing, under 90 words, one observable fact that proves I looked, one question. No fabricated metrics anywhere — if a number is not verifiable I do not use it.

Wedge A · email 1 · People Ops · day 1

subject: [peo] at [headcount] people

called earlier, no luck.

you've added [n] people in the last year and you're still on [peo]. that fee scales with every hire, and the reason you bought it — not having an hr function — stopped being true somewhere around 200.

worth a look at what the same headcount costs without co-employment?

harshit

Wedge B · email 1 · IT lead · day 3

subject: friday offboards

when someone leaves [company] on a friday afternoon, who disables their app access, and how long does it actually take?

asking because you're running [hris] and [idp] separately, so somebody is doing that by hand across [n] apps and hoping the list is complete.

if that list has ever been wrong, this is a fifteen-minute conversation.

Wedge A · email 2 · Finance · day 8

subject: cost per employee, [company]

[name] — one number, then i'll leave you alone.

you're paying [peo] a per-employee fee, [it vendor] for devices, [idp] for access and [expense vendor] for expenses. four vendors, four renewals, one employee who exists in all four.

companies your size usually find the consolidated cost lands under what they pay today. worth twenty minutes to see whether that's true here?

Video email · day 5

subject: 90 seconds, your stack

made you a short video instead of writing a longer email — it's your careers page, your [hris] job post, and what the seam between them costs.

[video link]

if it's not your problem, tell me whose it is and i'll stop.

Account email · day 15 · all three

subject: who owns this at [company]

[name 1], [name 2], [name 3] — putting you on one thread rather than guessing.

[company] is hiring a [hris analyst / role]. that job exists because [hris] and [it system] don't talk to each other, and someone has been the integration between them.

which of you owns that decision? twenty minutes with whoever it is.

Break-up · day 21

subject: closing this out

last one from me.

if the timing is just wrong, reply with the month your [peo / hris] contract comes up and i'll come back then rather than keep guessing.

if it's not relevant at all, that's a useful answer too.

LinkedIn — connection note, day 2

No product mention. Under 300 characters. A connection request that pitches gets ignored and costs me the profile.

[name] — came across [company] while looking at how teams your size handle multi-state payroll. the [n]-state footprint with [n] people is a genuinely unusual setup. following your work.

LinkedIn DM — day 10

thanks for connecting.

noticed you're hiring an [hris analyst]. curious — is that role there to run the system, or to hold [hris] and [payroll] together by hand?

asking because the answer differs a lot between companies your size and i'm trying to get a real picture.

10 · The phone

H1Opener, discovery, and the ask

Cold call opener

"[name], harshit calling from rippling. you don't know me — this is a cold call. can i have thirty seconds and you can decide if it's worth the rest?"

[pause. wait for the yes.]

"i'm calling because [company] has gone from [x] to [y] people in the last year and you're still running [peo]. the reason most teams buy a peo is that they don't have an hr function yet — and you clearly do now."

"can i ask — is that fee something anyone's looked at recently, or is it just running?"

Permission opener, then a fact about them, then one question. The fact has to be true and specific or the whole call is a template and they can hear it.

Discovery — five questions, in order

• How many systems does a new hire have to be set up in before their first day, and who does that?
• What happens to that setup when someone changes department or location?
• Who handles offboarding, and what is the gap between someone's last day and their access actually being switched off?
• Where does your international hiring sit right now — entity, EOR, or contractors?
• When does your [PEO / HRIS] agreement come up, and who else would be in the room when you look at it?

Question five does two jobs: it gets the timing anchor the AE needs, and it surfaces the rest of the buying committee without asking who the decision maker is, which is a question that makes people defensive and rarely gets an honest answer.

The ask

"here's what i'd suggest. twenty minutes with [ae name], who does this for companies at your headcount all day. no deck — they'll take your actual stack and show you where the seams are and what it costs to keep them."

"would tuesday morning or thursday afternoon work better?"

Two specific options, never an open-ended when suits you. And the meeting is framed as diagnostic rather than as a demo, because a mid-market buyer has sat through enough demos to be immune to the word.

Voicemail — under 20 seconds

"[name], harshit from rippling. calling about the [hris analyst] role you've got open — i think that job exists because two of your systems don't talk. sending you an email now with what i mean. [number]."

11 · What counts as a qualified meeting

H1

A booked meeting is not the unit. An AE-accepted meeting that holds is the unit, and the difference between the two numbers is where most SDRs quietly lose their quarter.

All five logged in the CRM before the handover note goes out, or the meeting does not count in my own numbers regardless of what the dashboard says. The handover note itself is three lines: what they said, what triggered it, and what I promised the AE would do.

No-show control

• Confirmation the same day, in the channel they replied on.
• A calendar invite with a one-line agenda written in their words, not mine.
• A reminder the morning of, containing one new piece of information rather than a reminder.
• Any meeting booked more than eight business days out gets an extra touch, because the no-show rate climbs sharply past that point.

12 · The math

H1Activity to quota, worked backwards

Ranges rather than single figures, because I have no access to Rippling's real conversion data. Every rate below is a planning assumption and the first thing I would replace with the team's actuals.

Daily and weekly activity

Conversion assumptions

What that produces in a month

Ten to fourteen accepted meetings a month is a defensible mid-market SDR number, and the range is honest: the top of it needs the trigger monitoring in Section 05 working properly, and the bottom of it is what happens if I run the same sequence at everyone.

What that is worth downstream

At published third-party estimates of $25–50 per employee per month for HR and payroll, a 400-person account sits somewhere around $120,000–240,000 in annual contract value before IT or Finance modules attach. At a conservative close rate, twelve accepted meetings a month is a pipeline contribution well past what the role costs — but I would rather present the accepted-meeting number, because the close rate is the AE's to own and quoting it as mine would be borrowing someone else's work.

13 · Objection log

H1

14 · Assumptions, risks and what I would confirm in week one

H1

Assumptions this plan rests on

• Territory is net-new logo only, with existing customers belonging to the Acquisition team, as the job postings imply.
• I own a defined account list rather than sharing a pooled one, since the whole design depends on account-level multithreading.
• Verified mobile numbers are available, because the funnel math is phone-led and collapses without them.
• I can send personalised video, and use my own name and face rather than a shared alias.
• Conversion rates in Section 12 are industry-typical rather than Rippling's own. Every one gets replaced with actuals in week one.
• Pricing figures used in this document are third-party reported. I would not quote any of them to a prospect until they are confirmed internally.

Risks I can see from outside

What I would ask in week one

• Real conversion rates by channel for this segment, and the current definition of an accepted meeting.
• Which modules the mid-market AEs actually close first, because that should override my wedge ranking if the data disagrees with me.
• Whether the PEO and the platform are sold by the same team, since Wedge A moves prospects between the two.
• What the account list looks like today: size, tiering, and whether triggers are already tracked anywhere.
• Which pricing figures I am allowed to say out loud.

The part of this I would most want challenged: Wedge A assumes the PEO-graduation trigger is as strong at Rippling as it looks from outside. If the team's data says otherwise, the ranking in Section 06 flips to Wedge B and the sequences change accordingly — the rest of the document holds either way.

Account sequence: Sendbird

Selling Rippling IT. Three personas, three problems. Email and LinkedIn run separately. No breakup.

The Account

Website: sendbird.com

Company LinkedIn: linkedin.com/company/sendbird

HQ: 100 S Ellsworth Ave, San Mateo, California

Other offices: New York, London, Seoul, Singapore, Bengaluru

Headcount: 262 as of 30 June 2026 per Tracxn. Other trackers put it near 290 to 299

Stage: Series C, founded 2013, $221M raised, $1B valuation

What they do: Omnichannel AI agent and communications API platform. 4,000+ brands including DoorDash, Match Group, Noom, Yahoo Sports

Tier: A. Firmographic fit, technographic fit, and a dated trigger inside 90 days

Why This Account

Their own engineering blog describes the offboarding seam in their own words. HR terminates the record in the HRIS. Meanwhile IT disables the laptop in MDM, disables the Okta account, and Okta Workflows calls GCP and Jamf APIs to lock the machine.

That is Wedge B written by the prospect. It is the rarest thing in outbound, a company that has already published the problem you sell against.

Stack, confirmed publicly

• Okta for identity, with custom Okta Workflows as the glue layer
• Jamf for device management, driven by API calls
• Google Workspace
• A separate HRIS that starts the chain

Four systems joined by code somebody has to maintain. That maintainer is the wedge.

The dated trigger

• Enterprise Security Engineer, San Mateo, posted 1 April 2026, $190k to $230k. Partners with IT to harden endpoints using EDR, NGAV and MDM platforms, and designs identity and access policy across SSO, MFA, SCIM and least privilege
• IT Operations Specialist, San Mateo, posted 28 January 2026, $114k to $130k, sitting under the Information Security team

Two hires against the same seam, three months apart. They are solving this with headcount right now, which is exactly the window.

The Product

Rippling IT only. Device management, identity and access management, app provisioning and deprovisioning, inventory. It displaces Jamf, Okta and the custom workflow layer between them.

Not HR, not Finance. The IT product is the only one where the prospect has already published the problem, and it is the only one that needs no pricing figure.

The Three Doors

At Sendbird the Global Head of People reports to CFO Joe Pagano, confirmed in their own job posting. So the champion and the economic buyer are one hop apart, which makes the People thread more valuable here than it usually is.

Social proof, matched to each seat

One proof point per first message, chosen for what that seat is actually worried about. Stated as a fact and then moved past, never sold at.

• IT and Security fears the glue breaking and an audit finding. Proof used: 20,000+ companies run provisioning and deprovisioning off one employee record. Scale as evidence the control holds, not as a brag
• People fears being the guinea pig. Proof used: about 62% of Rippling's roughly 11,000 G2 reviews come from mid-market. Their peer set, not a logo wall
• Finance fears vendor sprawl and an unverifiable claim. Proof used: the same consolidation figure, then their number invited rather than ours asserted

Sequence 1: IT and Security, Email

Day 1

Subject: your okta workflows post

[name],

read your team's post on automating offboarding. HR terminates in the HRIS, then Okta workflows calls GCP and Jamf to lock the machine.

it's a good build. the question i'd have if it were mine is who owns it, when it breaks, and what happens on the internal move rather than the leaver.

20,000+ companies run provisioning and deprovisioning off one employee record instead, so there's no glue layer to maintain.

worth fifteen minutes on the mover case?

Day 4, follow up 1

the mover case is the one i'd want to test.

someone moves from support to engineering. they get the new permissions. does anything take the old ones away, or does that depend on a person noticing?

most custom workflows handle the leaver and quietly skip this.

Day 7, follow up 2

you're hiring an enterprise security engineer and an it operations specialist within three months of each other.

both partly exist to hold okta, jamf and the hris together.

is that the plan, or the workaround?

Day 10, follow up 3, Loom, 90 seconds

made you ninety seconds of video instead of writing more.

no deck. your blog's offboarding flow on one side, the same thing with one record on the other, and where the maintenance goes.

[insert Loom link]

yours either way.

Day 14, follow up 4

[name], has the security engineer started yet?

Day 18, follow up 5

one question and i'll stop guessing.

if you had to pull dated evidence of access granted and revoked, per person, per app, could you do it today without asking someone to check?

Day 25 onward

One line every two weeks, same thread. IT replies to a named gap, so every re-touch names one rather than asking for time. Stops when they answer, not when the touches run out.

Sequence 2: Head of People, Email

Day 3

Subject: ninety seconds to a laptop

[name],

you're hiring across six offices, san mateo through bengaluru. every new starter needs an hris record, a laptop, an okta account and app access, and right now those are four systems and a checklist.

about 62% of rippling's 11,000 g2 reviews come from mid-market companies, so this isn't a bet on being first.

who on your team is actually holding that checklist together today?

Day 6, follow up 1

the part that usually hurts more than onboarding is the change.

someone moves office or department, and their access follows them by hand. nobody logs it because it isn't a hire or a leaver.

does that sit with your team or with it?

Day 9, follow up 2

six countries means six sets of employment records feeding the same access decisions.

how much of that reconciliation is manual right now?

Day 12, follow up 3, Loom, 90 seconds

ninety seconds of video rather than another email.

what a sendbird onboarding looks like as one record instead of four systems, using your own careers page as the example.

[insert Loom link]

no ask attached to it.

Day 16, follow up 4

still worth fifteen minutes, or wrong quarter?

Day 20, follow up 5

[name], one question. when someone joins, how many systems does a person touch by hand before day one?

Day 27 onward

One line every two weeks. This thread matters more than usual because People reports to the CFO here, so a reply is a route upward as well as a champion.

Sequence 3: Joe Pagano, CFO, Email

Opens day 8. Fewest touches, longest gaps, and never a product feature.

Day 8

Subject: three renewals, one record

Joe, one thought, then i'll leave you alone.

sendbird pays okta for identity, jamf for devices and a separate hris for the employee record. three renewals, three vendors, one employee who exists in all three, plus the engineering time holding them together.

20,000+ companies consolidated that onto one record.

i don't know your all in per employee number. do you?

Day 12, follow up 1

the number worth having here isn't ours, it's yours.

okta plus jamf plus hris per employee per month, including the engineer hours spent on the workflows between them.

worth twenty minutes to put that on one page?

Day 16, follow up 2

you're hiring an enterprise security engineer at 190 to 230 and an it operations specialist at 114 to 130.

some part of both roles exists because three systems don't talk. that's a real line item, it just doesn't sit in the software budget.

Day 20, follow up 3, Loom, 90 seconds

ninety seconds, your stack, no deck.

[insert Loom link]

Day 24, follow up 4

when does okta renew?

Day 31 onward

One line every three weeks. The renewal date is the only thing worth asking for until he gives it.

Sequence 4: LinkedIn, All Three

Separate from email, nothing repeated. No thanks for connecting, because it wastes the first line of the message they are most likely to read. Connection notes carry no product word.

IT and Security lead

Day 2, connection note

[name], read sendbird's post on automating offboarding with okta workflows and jamf. the part about locking rather than wiping the laptop is a decision most teams get wrong. following your work.

Day 5

{Handwritten text }

Day 9

asking because you're hiring an enterprise security engineer and an it operations specialist inside three months.

both partly exist to keep okta, jamf and the hris in agreement. is that permanent by design?

Day 13, voice note, 25 seconds

[name], voice note instead of more text. your team built the offboarding automation properly, which is rarer than it should be. the thing i'd want to show you is what it looks like when there's no workflow layer to maintain at all, because the device and the identity come off the same employee record. fifteen minutes if you want it, and if the timing's off just say so.

Day 17, then every 10 days

has the security engineer started yet?

Head of People

Day 4, connection note

[name], came across sendbird while looking at how teams run people ops across six offices on three continents. san mateo through bengaluru with under 300 people is a genuinely unusual shape. following your work.

Day 7

curious about something. when someone joins sendbird, how many systems does a person touch by hand before their first day?

asking because the answer varies a lot at your size and i'm trying to get a real picture rather than a vendor one.

Day 11

on that. most teams fix onboarding and leave the change case alone. someone moves team or office and their access follows by hand.

which of those two is the bigger headache for you?

Day 15, then every 10 days

still happy to walk through what one record looks like whenever. no call needed to see it.

Joe Pagano, CFO

Day 10, connection note

joe, came across sendbird while looking at how companies past 250 heads handle the okta and jamf and hris overlap. following your work.

Day 15

one question. do you know your all in per employee per month across identity, devices and the hris?

most finance leaders i ask have two of the three numbers.

{attached wd meme}

Day 21, then every 3 weeks

if you have all three, i'd genuinely like to know what it comes to. if you don't, that's the twenty minutes.

Account Clock

The clock belongs to the account. Never two touches to the same person on the same day.

• A reply kills that person's sequence. If two of three reply, the account is warm regardless of who takes the meeting
• No breakup. The sequence ends when they say no

The Persona

Seat: Head of IT and Security, Sendbird

Confirmed how: Sendbird's own Manager, IT Operations posting states the role reports to the Head of IT and Security

Owns: Three IT specialists across two offices, South Korea and the US, via an IT Operations Manager

Company LinkedIn: linkedin.com/company/sendbird

Name: Not confirmed. Pull from the company page under People, filtered to IT and Security

Selling: Rippling IT. Device management, identity and access, provisioning and deprovisioning, inventory

Fallback target: If the seat is open, run this identical sequence at the Manager, IT Operations

What They Published

Their engineering team wrote up the offboarding architecture themselves. HR terminates the record in the HRIS. Okta Workflows then calls GCP to give the departing employee's manager delegated inbox access for sixty days before revoking it, and calls Jamf to lock the laptop rather than wipe it.

It is a good build. Nobody else in their inbox has read it. Two things it does not appear to cover: what happens on an internal move rather than a departure, and who maintains the workflow layer itself.

Two live hires against the same seam

• Enterprise Security Engineer, San Mateo, posted 1 April 2026, $190k to $230k
• IT Operations Specialist, San Mateo, posted 28 January 2026, $114k to $130k, under Information Security

The Nine Touches

Nine messages inside twenty one days, one every two to three days, never two in a day. Two voice notes and a Loom, which is three non-text touches out of nine. That ratio is the whole differentiator.

The Sequence

Day 1, connection request

[name], read your team's offboarding post. locking the laptop instead of wiping it is the right call and almost nobody makes it. most people optimise for feeling decisive over being able to recover the disk.

Principle: Restrained compliment.

Why it works: Six out of ten, not ten. It praises one specific decision instead of the whole build, and it takes a side on a technical argument. That reads as a peer, not a vendor.

Day 4, voice note, 20 seconds

[name], voice note because typing this would take four paragraphs. your post says okta workflows gives the manager delegated inbox access for sixty days, then revokes it. that sixty day window is the thing auditors ask about, and almost nobody documents who reviewed what during it. curious whether that came up when you built it or after. no agenda, just genuinely interested.

Principle: Voice note plus expert observation.

Why it works: Early rather than late, because the differentiator is worth more before they have decided who I am. Nobody sends these. The sixty day detail could only come from reading their post properly, and there is no ask attached to it at all.

Day 7, the WDYM line

your offboarding automation is the safest part of your stack and the reason the risk is somewhere else.

Principle: WDYM.

Why it works: That is the entire message. No question mark, no ask, nothing attached. A security person either replies what do you mean, or thinks about it all afternoon. If they ask, the gap becomes their question instead of my talking point. This will feel wrong to send. Send it.

Day 10, personal thread opens

unrelated to any of the above. you've got san mateo and bengaluru on the same org chart. i'm in gurgaon working US hours, so i've got opinions about that split.

what actually breaks for you, the handoff or the on call?

Principle: Hyper-specific commonality, and the second thread opens.

Why it works: Not both in tech. Same timezone problem from opposite ends of it, which is true of almost nobody else who will message them this month. From here two threads run in parallel, which is what makes the whole thing read like a person rather than a sequence.

Day 13, business thread, the gap

the mover is the gap. someone goes support to engineering, picks up the new access, keeps the old. your workflow fires on termination, and a department change isn't one.

it's the one an auditor pulls and the one custom builds skip.

Principle: Expert observation.

Why it works: The payoff to day

7. If they replied asking what I meant, this is the answer and it arrives as requested information. If they did not, it still lands as the specific claim behind the vague one, which is the only honest way to follow an unanswered tease.

Day 15, Loom, 90 seconds

ninety seconds of video rather than more text.

no deck. your blog's offboarding flow on one side, the same thing off one employee record on the other, and where the maintenance goes.

[insert Loom link]

yours either way.

Principle: Give with no ask.

Why it works: Their own architecture on screen, not a product tour. Ninety seconds is short enough to watch on a phone between meetings. Yours either way removes every reason to decline it.

Day 18, voice note, 25 seconds

[name], last one from me on this for a while. the reason i keep coming back to the mover case is that it's the only access problem that gets worse as the company grows, because internal moves scale faster than headcount does. if you've solved it i'd actually like to know how. if you haven't, that's the fifteen minutes. either answer is useful to me.

Principle: Voice note, with the win condition removed.

Why it works: Two voice notes in one sequence is itself a signal, because almost nobody sends one, let alone two. Either answer is useful to me is what turns a fifteen minute ask into a low pressure one. There is no version of replying that feels like losing.

Day 21, personal thread continues

separate from all that. did the on call thing ever get solved, or is bengaluru still absorbing it?

asking selfishly. i'm about to make the same decision from this side.

Principle: Two threads.

Why it works: Deliberately the last touch inside the twenty one days, and deliberately not about business. It proves the personal thread was real and not a device. Asking selfishly gives them a reason to answer that has nothing to do with me selling anything.

Day 25 onward

Alternate the threads, one touch every ten days. A question about the split, then a comment on something they shipped, then a question about access. Comment properly on their posts in between, which does more than another DM. No breakup. This ends when they say no.