Choose the tool for the job. Start with the systems the client already uses, map one repeating process before buying new subscriptions, and keep a named person responsible for outbound approvals.
ASSESS FIRST · ISOLATE CREDENTIALS · DRY-RUN & READ-BACK VERIFY
FIG 01 · THE 22-ROUTE OPERATOR STACK — First-party routing (danielhallman.com/go/*) across GoHighLevel CRM, headless secrets, webhook glue, voice synthesis, deliverability, and agency treasury.
Affiliate & partner disclosure: Several first-party links on this page (/go/*, including GoHighLevel ?fp_ref=moosh, Mercury, Skool, 1Password, n8n, ElevenLabs, and outbound tools) are referral or partner links. I may earn a commission or account credit if you sign up through them, at no additional cost to you. Every tool listed here is part of our active operating or client-delivery reference.
AI assistant & human review boundary
Use AI assistants to draft replies, summarize call transcripts, check Knowledge Base coverage, and prepare recommendations from approved information. Keep a person responsible for final review before any message, quote, or live CRM mutation goes out.
Spreadsheet or CRM
Track every inbound inquiry, process owner, current status, and next action in one place. Do not split a single workflow across two competing trackers.
1. GoHighLevel (CRM, Pipelines, Voice AI & Sub-Accounts)
I use GoHighLevel (?fp_ref=moosh) for agency contacts, intake forms, pipelines, Voice AI receptionists (V01–V08), Conversation AI routing (C01–C08), and isolated client sub-accounts. Starting or upgrading GoHighLevel through my referral link unlocks our 3-Tier Affiliate Bonus Stack ($291 to $612+ in operator kits and MCP tools) plus access to the 8-Department Operator Library Vault and Weekly Operator Implementation Clinics:
Tier 1 · 14-Day Trial / $97 Starter ($291 bonus value): Free KIT-GHL ($47 Workflow Recipe Pack), KIT-VOICE ($47 Voice, Conversation & 80-FAQ KB Kit), KIT-DNS-BIMI ($47 Apple Branded Mail & RFC 1035 DNS Playbook), and CRS-INSTALL ($150 90-Minute Voice & Conversation AI Install Runbook).
Tier 2 · $297/mo Unlimited ($562 bonus value): All Tier 1 kits plus KIT-LAUNCH ($197 AI Agency Launch Kit), KIT-GROK ($47 8-Seat Grok Bot Agency Roster), and KIT-JUMBO ($27 365 Social Hooks & 52 Prompts).
Tier 3 · $497/mo Agency Pro SaaS ($612+ bonus + $97/mo recurring): Full BND-PRO Bundle ($612 total value), 100% FREE ghl-tools Operator MCP Pro subscription ($97/mo value) for as long as your referral remains active, and a 1-on-1 ghl-crm doctor sub-account health audit.
Agencies routinely leak client API keys by pasting HighLevel Private Integration Tokens (GHL_LOCATION_PIT), Cloudflare DNS tokens, and webhook secrets into shared spreadsheets, Slack messages, or unencrypted .env files. We store all operator credentials in 1Password and access them headlessly via 1Password Service Accounts (OP_SERVICE_ACCOUNT_TOKEN):
Per-Client Vault Isolation: Separate credentials into dedicated Operator Vaults (for example, Moosh Works Operator vs. client-specific vaults) so a single automation runner only reads the vault grants it needs.
Zero Touch ID Prompts in Unattended Runs: Desktop 1Password prompts block background CLI jobs and MCP servers. Exporting a scoped OP_SERVICE_ACCOUNT_TOKEN lets ghl-tools and CI runners fetch tokens headlessly with zero GUI popups.
Clean Rotation for HighLevel PITs: When rotating a sub-account Private Integration Token via ghl-agency pit rotate, write the new token directly back to the owning 1Password Operator Vault item.
$ export OP_SERVICE_ACCOUNT_TOKEN="$(cat ~/.local/op-service-account.token)"
$ GHL_LOCATION_PIT="$(op item get 'Operator Key — HighLevel Location PIT' --vault 'Moosh Works Operator' --fields label=credential --reveal)" \
ghl-crm doctor --location <LOCATION_ID> --dry-run
Audit and update agency sub-accounts in seconds with CLI and Model Context Protocol (MCP) tools instead of fragile browser click-ops. Every mutating command in ghl-crm, ghl-agency, ghl-onboard, ghl-mkt, and apple-branded-mail computes a --dry-run plan first, locks state with a SHA-256 fingerprint, and performs a live post-write read-back before reporting completion.
FIG 02 · HEADLESS SECRETS & WEBHOOK GLUE — Scoped 1Password Service Account tokens paired with deduplicated n8n/Make.com webhook routing and SHA-256 read-back verification.
Keep contact state, appointment reminders, missed-call text-back, and kill-switch tags (ai_voice_paused) inside native GoHighLevel workflows (W01–W12). Reach for an external workflow runner only when you need multi-step JSON payload transformation, idempotency deduplication, or custom database/ERP syncs:
WEBHOOK & JSON ORCHESTRATION
n8n (/go/n8n)
Our default external automation runner for defined, repeatable data transfers between HighLevel webhooks, Postgres/SQLite stores, and internal APIs. Supports code nodes, explicit payload validation, duplicate event suppression, and dead-letter error workflows.
When a client's internal operations manager already runs Google Sheets, QuickBooks Online, or Slack automations and wants to inspect visual scenario history themselves without maintaining code nodes, we build and document the bridge in Make.com.
5. Voice Synthesis & Low-Latency Telephony: ElevenLabs, Retell AI & Vapi
FIG 03 · VOICE SYNTHESIS & SIP TELEPHONY — ElevenLabs custom pronunciation dictionaries paired with Retell AI / Vapi sub-500ms barge-in and 80-FAQ Knowledge Base guardrails.
Spoken receptionists fail when they sound synthetic, mispronounce local street or trade names, or guess prices when a fact is missing from the Knowledge Base. We pair our KIT-VOICE prompt architecture (V01–V08 + 30-scenario test scorecard) with three voice tools depending on the call requirements:
NATURAL SPEECH & PRONUNCIATION
ElevenLabs (/go/elevenlabs)
Used for natural conversational voice synthesis, custom pronunciation dictionaries (local road names, medical/legal terms, brand names), and clean voice cloning for founder video hooks and receptionist greetings.
When a client workflow requires sub-500ms turn-taking latency, custom mid-call function calling against an external scheduling API, or custom Twilio/Telnyx SIP trunking, we run the voice session on Retell AI or Vapi and write the structured call summary and booking tags back to GoHighLevel.
6. Email Infrastructure, Outbound & Lead Data: Google Workspace, Instantly, Smartlead & Apify
FIG 04 · DELIVERABILITY, CLIENT PORTALS & TREASURY — Authenticated Workspace mail with BIMI SVG Tiny-PS, isolated outbound domains on Instantly/Smartlead, Apify directory research, Notion KB staging, and Mercury virtual card controls.
Never send cold outbound prospecting from a client's primary corporate domain or their primary GoHighLevel transactional subdomain. Keep primary business mail clean and isolate outbound discovery invitations onto dedicated secondary domains:
PRIMARY INBOX & BIMI AUTHORITY
Google Workspace (/go/workspace)
Our standard mailbox infrastructure for agency and client domains. Pair every Workspace domain with authoritative RFC 1035 SPF, 2048-bit DKIM, enforced DMARC (p=quarantine or p=reject), and a validated 1024×1024 SVG Tiny-PS logo (KIT-DNS-BIMI).
Used to warm secondary sending domains, rotate across inbox pools, and send plain-text invitations for 15-minute process walkthroughs. Replies that request an assessment or resource are synced into our GoHighLevel pipeline.
Before reaching out to local service businesses (HVAC, plumbing, roofing, dental, legal, detailing), we use Apify actors to pull verified Google Maps listings, review response gaps, and website contact paths to identify real intake bottlenecks.
GoHighLevel native calendars handle 90% of sub-account booking. When an engineering or multi-partner team needs open-source webhook routing, collective multi-host availability, or custom embed parameters outside a sub-account, we use Cal.com.
7. Documents, SOPs & Knowledge Base Staging: Notion
Keep approved facts, process notes, stall maps, and operating instructions in the client's existing document system (Google Docs or Notion). In our workflow, we use Notion (/go/notion) to collaborate with the client's process owner on the 4 paid assessment deliverables and the 80-pair Receptionist Knowledge Base table before exporting versioned kb.yaml files into GoHighLevel.
8. Agency Banking, Payments & Community Delivery: Mercury & Skool
Collect payment for the agreed assessment ($750–$1,500), workflow build, or monthly retainer ($2,500/month) with the written scope attached to the invoice. Keep agency operating cash, client ad/usage pass-throughs, and training portals cleanly separated:
AGENCY TREASURY & VIRTUAL CARDS
Mercury Business Banking (/go/mercury)
We run Moosh Works banking on Mercury to separate operating checking, tax reserve accounts, and per-vendor virtual cards (isolating Twilio/LC phone usage, cloud hosting, and software subscriptions with hard spend limits). Qualifying new accounts opened through our partner link earn a $250 referral payout after depositing $10,000 within 90 days.
When an agency packages implementation clinics, SOP video libraries, and weekly Q&A office hours for clients or operator cohorts, Skool provides a clean classroom + calendar + discussion board without complex LMS maintenance.
9. Complete 22-Route Agency Operator Stack & First-Party Link Directory
Every first-party short link below (danielhallman.com/go/*) redirects to the canonical tool destination, preserves incoming utm_* campaign parameters, and pairs with an X/Instagram DM keyword trigger:
Operating checking, tax reserves, and per-vendor virtual cards for software and telephony spend. Keywords: MERCURY, STACK.
Issue separate virtual cards with monthly spend caps for each client telephony/usage lane.
Start with the blueprint, the Operator Library, or the Launch Kit
Read the 7-part operating manual for a 4-client, $2,500/month retainer practice, browse copy-ready Voice AI and workflow specs in the Operator Library Vault, or get the full Launch Kit.