Week-One Onboarding Bot: The 5-Day Sprint After the Offer

By Lazar Milicevic · Published August 8, 2026 · 6 min read

Every hiring AI demo I've watched ends the same way: green checkmark, "offer signed," roll credits. Then a real human opens new_hire_onboarding_v4_FINAL.xlsx and burns six hours per hire chasing tax forms, provisioning Slack, and answering the same twelve questions about payday. That gap is the bot I'm going to walk through.

The pattern is boring on purpose. One webhook trigger, one Drive folder as source of truth, one Gmail sequence, one FAQ agent, one human-approved provisioning queue, one handoff. Nothing fancy — but it's the piece nobody automates because it doesn't demo well on YouTube.

The trigger: one webhook, one canonical hire record

The whole thing keys off a single event: the offer letter fully executed. DocuSign, PandaDoc, HelloSign, Dropbox Sign — all of them fire a webhook the moment the last signature lands. That webhook is the starting gun. Don't try to detect signature from Gmail parsing or a calendar event; you'll fight edge cases forever.

The payload gives you four fields you actually need: candidate name, email, role, and start date. Everything downstream is derived from those.

# webhook_listener.py — FastAPI, ~40 lines
from fastapi import FastAPI, Request, HTTPException
import hmac, hashlib, os

app = FastAPI()
SECRET = os.environ["DOCUSIGN_WEBHOOK_SECRET"]

@app.post("/hooks/offer-signed")
async def offer_signed(req: Request):
    body = await req.body()
    sig = req.headers.get("X-DocuSign-Signature-1", "")
    expected = hmac.new(SECRET.encode(), body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, expected):
        raise HTTPException(401, "bad signature")

    payload = await req.json()
    hire = {
        "name": payload["envelope"]["recipients"][0]["name"],
        "email": payload["envelope"]["recipients"][0]["email"],
        "role": payload["envelope"]["customFields"]["role"],
        "start_date": payload["envelope"]["customFields"]["start_date"],
        "envelope_id": payload["envelope"]["envelopeId"],
    }
    await enqueue("onboarding.start", hire)
    return {"ok": True}

Two things that will bite you if you skip them:

• Verify the HMAC signature. A public webhook endpoint that trusts anything gets abused within a week.
• Deduplicate on envelope_id. Signature providers retry. If you don't dedupe, you'll create the same Drive folder three times and send the candidate three welcome emails on day one.

The file spine: Drive folder as the source of truth

The instant the webhook lands, create a Google Drive folder named 2026-08-19 — Jane Doe (Senior Engineer) and drop empty placeholder files inside for every doc you're going to collect. Contract signed copy, government ID, W-4 (or W-9 for contractors), direct deposit form, emergency contact, signed NDA, and the employee handbook acknowledgment.

Why placeholders? Because two months later when someone asks "did Jane ever return her I-9?", you don't grep Gmail. You open the folder. If the file is still _PLACEHOLDER_i9.pdf, the answer is no. This is the single most useful piece of the whole system and takes forty lines of code.

The checklist itself lives in a small Postgres table (or Airtable if you don't want to run anything):

Every downstream step reads and writes this table. It's the state machine.

The document request sequence — with a real reply parser

Gmail sequence, spaced across the first three business days. Subject lines are boring and specific: Action needed: W-4 for your start date Aug 19. One document per email, not a wall of six requests in one message. Response rates on single-ask emails run roughly 2x versus the everything-in-one approach in the client data I've seen.

The interesting part is the reply parser. When the candidate replies with an attachment, you need to route it to the right slot without human intervention.

# reply_router.py
DOC_PATTERNS = {
    "w4": {"keywords": ["w-4", "w4", "withholding"], "mime": ["application/pdf"]},
    "i9": {"keywords": ["i-9", "i9", "eligibility"], "mime": ["application/pdf"]},
    "id_scan": {"keywords": ["passport", "license", "id"],
                "mime": ["application/pdf", "image/jpeg", "image/png"]},
    "direct_deposit": {"keywords": ["deposit", "bank", "routing"], "mime": ["application/pdf"]},
}

def classify_attachment(filename: str, mime: str, email_subject: str) -> str | None:
    haystack = (filename + " " + email_subject).lower()
    for doc_type, rules in DOC_PATTERNS.items():
        if mime in rules["mime"] and any(k in haystack for k in rules["keywords"]):
            return doc_type
    return None  # fallback → human review

Rules that keep this from going sideways:

• If classification confidence is ambiguous, don't guess. Forward to Telegram for a human to tag. Misfiling a bank details form as an ID scan is the kind of small error that erodes trust.
• Never auto-nag more than twice. Third nudge is a Telegram alert to a human. If a candidate hasn't sent their I-9 by day three, they're confused or overwhelmed — a real conversation fixes it in one message, a fourth robotic email loses you the hire.

Provisioning: human-in-the-loop is a feature, not a limitation

The bot knows the hire needs a Slack account, a Google Workspace mailbox, a Notion or Linear seat, a 1Password vault entry, and a GitHub org invite. The APIs to do all of this exist. The bot should absolutely not call them autonomously.

Every provisioning action gets queued and posted to a Telegram thread with ✅ / ❌ buttons. Human taps ✅, the API call fires. Human taps ❌, it's cancelled and logged.

🆕 Provisioning queued for Jane Doe (start: Aug 19)

  1. Google Workspace mailbox: jane.doe@company.com
  2. Slack invite → #general, #eng
  3. Linear seat (Engineering team)
  4. 1Password: Engineering vault access
  5. GitHub org invite (role: member)

  [✅ Approve all]  [🔍 Review each]  [❌ Cancel]

Fifteen seconds of human attention instead of fifteen minutes of clicking through five admin panels. And crucially, when the DocuSign webhook fires twice because their infrastructure hiccupped, you don't wake up to seventeen phantom Slack accounts. The approval gate is the circuit breaker.

This is the rule I give every client: any action that costs money, creates an account, or sends an external communication needs a human tap. Everything else — filing documents, updating checklists, drafting replies, scheduling calendar holds — can run unattended.

The day-one handoff

Day five, the bot posts a single summary to the hiring manager's Telegram or Slack DM:

• ✅ All documents collected and filed in /HR/2026 Hires/Jane Doe
• ✅ Accounts provisioned (5/5)
• ✅ Laptop shipped, tracking: 1Z999AA10123456784
• ✅ Day-one calendar: 9am welcome call, 10am team intro, 2pm 1:1 with manager
• ⚠️ Emergency contact form returned but phone number missing a digit — flagged

The manager reads that in 20 seconds instead of chasing seven threads on Sunday night wondering if Monday is going to be a mess. That's the actual product. Not the AI, not the LLM — the fact that a human's Sunday-night anxiety about Monday morning goes away.

Where bizflowai.io helps with this

This exact flow — DocuSign trigger, Drive spine, Gmail sequence with reply parsing, FAQ agent with escalation, human-approved provisioning, day-five summary — is one of the workflows I deploy for small teams at bizflowai.io. Most clients come in wanting "AI recruiting" and I push them toward this instead, because the post-signature window is where the real hours hide. A 10-person team hiring 12 people a year gets back roughly 60 hours of founder or ops time, and new hires stop arriving on Monday with no laptop.

What to build first if you only have a weekend

Skip provisioning and skip the FAQ agent on version one. Build the webhook → Drive folder → placeholder files → Gmail sequence → reply parser. That alone kills about 3 of the 6 hours per hire, and it's roughly 300 lines of Python plus an n8n workflow. Ship that, run it on your next two hires, then add the FAQ agent once you've got real inbound emails to test against.

The mistake I see teams make: they try to build the whole thing before deploying any of it. Every day this stays on your someday list is another six hours you're paying for by hand.

Want more like this?

I publish practical AI automation, GenAI engineering, and faceless content workflows on YouTube every week.

Subscribe to bizflowai.io on YouTube — never miss a new tutorial.

Planning an AI automation project or need a second opinion on your architecture?

Connect with me on LinkedIn — Lazar Milicevic, GenAI Engineer & bizflowai.io Founder.

Visit bizflowai.io for our services, case studies, and AI consulting.