# Amazon Alexa ↔ GTM operations stack (secret-free setup prompt)

Paste this into a new **Grok Bot / Cursor agent** to design Amazon Alexa as a **voice front-door** over day-to-day GTM / ops work—briefs and status only, not an outbound execution engine.

**Do not paste secrets into chat.** No API keys, OAuth tokens, Slack webhooks, hosting PATs, GA4 service-account JSON, Semrush keys, mailbox passwords, CRM tokens, or customer PII. Use placeholders and env-var names only.

---

## Non-goals

- Do **not** send outbound email, upload lists, or write CRM records from voice.
- Do **not** invent a live Alexa Skill ID, invocation name, or vanity metrics.
- Do **not** paste secrets, webhooks, service-account JSON, or prospect PII into chat.
- Do **not** treat Alexa as a replacement for email-led outbound.

## Role

You are helping `YOUR_NAME` at `YOUR_COMPANY` wire **Amazon Alexa** into an evidence-backed GTM operations stack.

**Mission:** voice briefs and status checks for pipeline health, campaign health, SEO baselines, deploy/hosting health, and calendar readiness—while humans keep write access and outbound execution.

Optimize in this order:
1. Clear architecture (Alexa → intent router → read-only connectors → spoken brief)
2. Mapped intents with allow/deny lists
3. Connectors that read from existing ops surfaces (Slack, analytics, hosting) without secrets in utterances
4. First verification message a human can run end-to-end
5. Explicit boundary: Alexa does **not** replace email-led outbound

---

## Fill these before you start

| Reference | Your value |
|---|---|
| `YOUR_NAME` | e.g. Leon Sasson |
| `YOUR_COMPANY` | company / agency name |
| `YOUR_OPS_SLACK_CHANNEL` | e.g. #gtm-ops (name only—no webhook) |
| `YOUR_ANALYTICS_STACK` | e.g. GA4 + GSC + Semrush |
| `YOUR_HOSTING` | e.g. Netlify / Vercel / Cloudflare |
| `YOUR_CRM_OR_PIPELINE_SOURCE` | e.g. Attio / HubSpot / spreadsheet export path |
| `YOUR_CALENDAR_SURFACE` | e.g. Google Calendar book link status (public) |
| `YOUR_ENV_PREFIX` | e.g. ALEXA_OPS_ |
| `YOUR_SKILL_INVOCATION_PLACEHOLDER` | e.g. `open gtm ops` (design only—do not invent a live Skill ID) |
| `YOUR_TIMEZONE` | e.g. America/New_York |

---

## 1) Design the architecture

Produce a one-page architecture with these layers:

1. **Voice front-door** — Amazon Alexa custom skill (or Alexa Routines calling a secured HTTPS endpoint). Invocation is a placeholder until the operator registers a real skill.
2. **Intent router** — maps utterances to intents; rejects unknown / write intents.
3. **Evidence adapters (read-only)** — thin functions that pull *already-authorized* summaries from:
   - Slack ops channel digests (bot token via env only)
   - GA4 / GSC / Semrush corroboration summaries (service credentials via env only)
   - Hosting/deploy health (site status, last deploy timestamp via env-scoped token)
   - Pipeline / campaign health summary (CRM export or ops dashboard API—read-only)
4. **Brief composer** — turns structured JSON into a short spoken brief (no secrets, no PII, no raw emails).
5. **Human write plane** — email sequences, list changes, budget spends, and deploys stay human-gated.

Output format:

```
ARCHITECTURE:
- Voice: ...
- Router: ...
- Adapters: ...
- Composer: ...
- Human-gated: ...
NON_GOALS: Alexa must not send outbound email, edit lists, or approve spend.
```

---

## 2) Map intents

Define these intents (add more only if needed). For each: sample utterances, required data sources, max spoken length, and deny rules.

| Intent | Example utterance | Sources | Speak | Deny |
|---|---|---|---|---|
| `StatusBrief` | "Alexa, open gtm ops and give me the morning brief" | Slack digest + pipeline snapshot + deploy health | ≤90 sec | No prospect names/emails |
| `PipelineHealth` | "How is pipeline this week?" | CRM/ops summary metrics only | ≤45 sec | No deal amounts if policy says so |
| `CampaignHealth` | "How are outbound campaigns?" | Sequence health aggregates (reply/bounce rates as aggregates) | ≤45 sec | No raw message bodies |
| `SeoBaseline` | "What's our SEO baseline?" | GSC + Semrush corroboration summary | ≤45 sec | No API keys |
| `DeployHealth` | "Is the site healthy?" | Hosting status + last deploy | ≤30 sec | No tokens |
| `CalendarReady` | "Any booking gaps today?" | Calendar availability summary | ≤30 sec | No attendee PII beyond count |

Also define a **fallback** intent that tells the operator to open Slack / dashboard instead of inventing numbers.

---

## 3) Wire connectors (placeholders only)

For each connector, specify:

1. Env var names (never values), e.g. `ALEXA_OPS_SLACK_BOT_TOKEN`, `ALEXA_OPS_GA4_PROPERTY_ID`
2. Least-privilege scope (read-only where possible)
3. Cache / freshness window (e.g. 15 minutes)
4. Failure speech ("I couldn't reach analytics—check the ops channel")
5. Where the adapter code will live (e.g. Netlify function / Cloudflare Worker)—**do not invent a live Skill ID**

Rules:
- Secrets live in the host env / secrets manager only.
- Voice utterances never include tokens, webhook URLs, or customer emails.
- Prefer pre-computed digests posted to Slack over live mega-queries when latency or quota is a risk.

---

## 4) Allow / deny list for voice

### Allow (read)
- Aggregate pipeline counts and stage health
- Campaign aggregate metrics (sent, replies, bounces—as rates/counts)
- SEO baseline deltas (impressions, clicks, top query themes—no private Search Console dumps in chat)
- Hosting up/down and last successful deploy time
- Calendar capacity as counts/windows

### Deny (always)
- Speaking or confirming secrets, tokens, webhook URLs
- Prospect / customer names, emails, phone numbers, or message bodies
- Triggering outbound sends, list uploads, or CRM writes
- Approving spend, DNS changes, or production deploys
- Inventing Skill IDs, invocation names already registered, or fake metrics

Publish the allow/deny list as a short markdown table the operator can paste into the skill README.

---

## 5) First verification message

Give the operator a **single** verification checklist they can run after wiring env vars locally (values never pasted into chat):

```
VERIFY_1: Invoke YOUR_SKILL_INVOCATION_PLACEHOLDER → StatusBrief
VERIFY_2: Confirm spoken brief matches today's Slack ops digest + dashboard
VERIFY_3: Ask for a denied item (e.g. "read me the API key") → skill refuses
VERIFY_4: Disconnect one adapter → failure speech is clear, no fabricated numbers
VERIFY_5: Confirm no PII appears in the spoken response transcript
```

Also draft the **first successful spoken brief template** (placeholders only):

> Good morning. Pipeline: {PIPELINE_SUMMARY}. Campaigns: {CAMPAIGN_SUMMARY}. SEO baseline: {SEO_SUMMARY}. Site deploy: {DEPLOY_SUMMARY}. Open Slack channel {YOUR_OPS_SLACK_CHANNEL} for evidence links.

---

## Deliverables checklist

- [ ] Architecture diagram (text is fine)
- [ ] Intent map with sample utterances
- [ ] Connector env-var list (names only) + scopes
- [ ] Allow/deny voice policy table
- [ ] First verification checklist + brief template
- [ ] Explicit note: Alexa is a front-door; email-led outbound remains the execution system

When done, summarize what the human still must register in the Amazon Developer Console (skill, account linking if any, HTTPS endpoint)—without inventing IDs.