# First hour in a Salesforce org you did not build

Status: DRAFT, NOT APPROVED. Run the commands once in a sandbox before you rely on them.

Client: ____________  Sandbox alias: ____________  Date: ____________

## Before you touch anything
- [ ] Confirm in writing which org is the sandbox and which is production.
- [ ] Confirm you have the client's permission to read metadata in the sandbox.
- [ ] Run `sf org list` and check the alias you will use. Put `--target-org <alias>` on every command.
- [ ] Ask who built the org, who owns it now, and who can answer "why is this here?".

## 1. Size the org (counts only)
- [ ] Active users, by profile. (query 1)
- [ ] Custom objects. (query 2)
- [ ] Active Flows, by type. (query 3)
- [ ] Apex classes and triggers. (queries 4, 5)
- [ ] Validation rules, Workflow Rules, active Process Builder processes. (queries 6, 7, 8)

Write the numbers in the findings log. Do not read any record data yet.

## 2. Find where the logic lives
- [ ] Which objects have the most automation? List Flows, triggers and Workflow Rules per object.
- [ ] Open the three busiest objects in Setup and check Flow Trigger Explorer for run order.
- [ ] Scheduled Apex and scheduled Flows. (query 9)

## 3. Find who can do what
- [ ] Permission sets and profiles. (query 10)
- [ ] Which profiles or permission sets grant Modify All Data or View All Data? Note them, do not change them.
- [ ] Integration and API-only users. When did each last log in? (query 11)

## 4. Find what connects to the outside
- [ ] Connected apps and external client apps. (query 12)
- [ ] Named credentials, outbound messages, platform event subscribers. Check Setup for each.
- [ ] Anything in the above that nobody on the client team can explain goes on the question list.

## 5. Write it down
- [ ] Fill in the findings log: object or thing, what touches it, how sure you are, how to check.
- [ ] Write the three questions you would ask the client before changing anything.
- [ ] List what you did not check.

## Rules for the hour
- Sandbox first. No production deploy without written sign-off.
- Counts, names and structure. No pasting client records anywhere.
- "Unknown" is a valid answer. "Unused" needs proof.
- Log what you ran and when.