Case Study · AI Project Takeover · August 2026

The $900 handoff.

A seven-figure building compliance firm hired a young developer to build its AI engine. Four weeks and $1,800 later, the owner could not tell what he owned, what the developer owned, or whether anything had been built at all. Here is how the whole thing was inventoried, secured, and handed off between an 11:00 AM discovery call and a 3:00 PM continuity call on the same day.

I Need This Kind of Handoff Run the 25-Point Checklist

Engagement snapshot

Client
Gordon, founder of an LA construction consulting and building compliance firm. Seven-figure revenue, three long-tenured employees, four companies.
The contractor
A 26-year-old solo developer, engaged for one month at $1,800 to build an AI lead engine, CRM automations, and a phone system.
The problem
"He's basically telling me I have access to everything, but I don't." Nothing usable after three weeks. $900 still owed. Fear of what happens when he is cut off.
The engagement
Discovery call at 11:00 AM. Continuity call with the developer at 2:59 PM. Every access inventoried, rotated, or collected. Payment released on confirmation.
Heed fee
$399 flat, covering the audit of what existed, the handoff call, and the follow through. Standard rate is $250 per hour.
Outcome
No data lost, no domain at risk, no bridges burned. The developer and Heed booked a coffee to talk about working together. The rebuild started the following week.
The Situation

"I have too much going on for what he can do."

Gordon runs a compliance business. He finds buildings that are out of code and gets them into compliance, and he has been doing it long enough to have seven-figure years. He is also, by his own description, AI aware: he sits in a mentorship program, knows what n8n is, and was weeks away from an AI consultant certification. He was not looking for a tool. He was looking for someone to build the machine so his team could run it.

He hired a bright young developer who said he had an already built platform he could plug clients into. That was why the price was so low. Four weeks later the developer had set up Cloudflare, GitHub, twelve service landing pages, a Google Sheet that collected the form submissions, and a "command center" dashboard. What Gordon wanted was to send a campaign out of a CRM and measure what came back. He had neither.

"I screwed up by hiring a young kid to help me to scale my business. He hasn't done anything wrong. He's just not experienced. I have too much going on for what he can do."

Gordon, on the discovery call

The money was not the issue. The engagement was $1,800 and he still owed $900. He was willing to pay it, and said so repeatedly. What he could not do was pay it and walk away without knowing what would break.

"I want to give him the $900 I owe him today, but I also want to make sure that I'm safe and I can just hand it over to the professionals. If he doesn't just clean up everything, then I don't want to have to deal with that."

Gordon

"I don't know what I have access to and what he has access to. I don't think he can create any damage, but I'm not sure. That's why we're talking."

Gordon

He had researched Heed the way anyone would. The profile matched what he needed: someone who has been coming into other people's IT environments for 30 years, locking them down and verifying continuity, and who now builds AI systems for a living. He booked the call at 11:00 AM on a Friday. He wanted the relationship ended, safely, by that afternoon.

The Rule

Treat it exactly like terminating an employee with privileged access.

The first thing Michael did was reframe the situation. This was not a dispute with a vendor. It was an offboarding, and offboarding has a playbook.

"This is very similar to an employee being terminated who has access to privileged information. We want to make sure we have everything that they have access to, make sure they don't destroy anything, change anything, and make sure that we have complete access and control over everything."

Michael Bowers, Heed AI Solutions

The sequence matters. You do not deliver the news and then start changing passwords. You change what you can before the conversation, you get a backup of everything you cannot yet control, and you make the final payment conditional on a completed handoff. If the contractor owns a platform outright, that is fine too. A backup is enough to recreate it under the client's own name.

"As long as I get a backup of it, I can recreate it and then we can rebuild your platforms under your name and your control. That's really what I want to aim for: see what we're working with, see how to get the data, and get the backup first."

Michael Bowers

Then came the request that does most of the work in any takeover: forward every email you ever sent the contractor. Not a summary. The emails.

"Forward me the emails you sent to him so that I can know in detail what you sent, so I can know what he has. Because you may have given him either more than you think or less than you think."

Michael Bowers
What the Audit Found

Promised versus delivered, in one table.

Gordon shared his screen and the "engine" document the developer had produced. Michael read it line by line while Gordon confirmed what he had actually handed over. This took about 25 minutes.

What the document saidWhat actually existedRead
An AI "command center" for marketing and KPIsA read-only dashboard on the developer's own Render account, displaying Meta, Mailchimp, and JobTread data from credentials Gordon had supplied. Campaigns shown went back more than a year; none were created by the developer.Information in a new place
AI automations on Cloudflare for SEO and KPIsA weekly Cloudflare Worker that aggregated keyword and KPI data and summarized it with a small Llama model. No content produced, no ranking changes, no action taken.Reporting, not doing
Twelve service landing pages with lead captureReal. Built on a subdomain under Gordon's own GoDaddy account, with forms feeding a Google Sheet. The most useful thing delivered, and the only thing Gordon actually owned outright.Delivered, owned
"Move the database into an account in your name"The database was the Google Sheet. It was still under the developer's Google account three weeks in. Gordon could not tell whether an access request would reach his own employee or the developer.Ownership gap
Phone system, 800 number, call answering AINot built. Calls were still ringing to the office phones. A Google Voice number existed with nothing behind it.Not delivered
CRM automations and campaign sendingNot built. Gordon's one stated pain point ("monitoring and measuring") had no working solution. A GoHighLevel account had been started, then abandoned.Not delivered
QuickBooks integrationNever connected. Gordon had never supplied the credentials, which turned out to be the right call.No exposure
Seven "fully built" engine componentsAn AI generated planning document. Several sections described work that was scheduled, not done.Plan, not product

"All he's doing is just taking the credentials that you've given him and feeding you what they say. It's just information, but it's not accomplishing anything. This is just information in a new place."

Michael Bowers, reviewing the dashboard live

"You can't recreate it. You can't scale it. If you can't measure it, if you can't touch it, what is it?"

Michael Bowers

The verdict was not that Gordon had been robbed. It was more specific and, for him, more useful than that.

"He hasn't done anything wrong. I just think that he's following AI too much to guide him, not really understanding what needs to be done. I can see through everything that he's done that he's letting Claude guide him, but it's guiding him into a place he doesn't know where he needs to go. He's just literally copying and pasting whatever it's saying."

Michael Bowers

"He's basically learning on my dime."

Gordon
Access and Ownership

What the developer could touch, and what was done about each one.

Before the 3:00 PM call, Gordon changed what he could himself. It took five minutes. The rest was collected on the call.

AccountDeveloper's accessActionWho
GoDaddy (domain, DNS, subdomain hosting)Full login, plus an API key stored in his codePassword changed first, before anything else. API key rotated after the developer volunteered it was still live.Gordon, then Heed
MailchimpLoginPassword changedGordon
JobTread (job CRM)Login and API key wired into the dashboardPassword changed; key regeneratedGordon
Meta (Facebook and Instagram)One-time passcode sign-in only, no Business Manager roleOTP device removed. The dashboard's Meta feed goes dark by design.Gordon
Google (Sheets holding leads, Voice number)Sheet owned by developer's account; a Google connection to Gordon's workspaceConnection revoked; sheet exported and recreated under Gordon's WorkspaceHeed
GitHub repositoryDeveloper's repo; Gordon's code had been merged into the developer's own projectDeveloper separated it and transferred a clean copy. Payment released on receipt.Developer, then Heed
Cloudflare WorkersDeveloper's Cloudflare accountHeed added as a member of the project to export the workers before the account was closedDeveloper, then Heed
Render (dashboard hosting)Developer's account entirelyLeft with the developer. Nothing on it was worth keeping. Shut down after handoff.Developer
GoHighLevelTrial started by developerConfirmed cancelled so it would not keep billingHeed
QuickBooks, Meta Business ManagerNever grantedNothing to doNone

"That's what I was saying earlier about access and ownership. Right now he owns where this is. I can tell by the URL that it's on Render. That's his and he can own that and he's going to shut it down, which is completely fine, because this is not doing anything."

Michael Bowers

"You got to just rotate the GoDaddy API key. That one's still in the system."

The outgoing developer, on the continuity call

That last line is why the call happens with a professional on it. A client alone would never have known the key existed. A contractor who felt attacked might not have mentioned it.

The 3:00 PM Call

Firm about the handoff. Generous about the person.

Gordon did not want to make the call himself, and he should not have. Emotion was already in the text thread. The structure Heed proposed was simple: Gordon emails the developer, copies Michael, says he has changed his credentials and asks for a continuity call with Michael. Once Michael confirms he has everything, the $900 is sent immediately.

"You'd be the one that would call him up and say, 'Look, I'm taking over and we're doing a handoff.' And then you charge me a flat fee."

Gordon

The call ran an hour. Michael opened by saying what he had told Gordon: the work was not wrong, it was just not what a business at this stage needed. He asked where the AI was actually happening (Cloudflare Workers), what it did (weekly reporting), and whether Gordon needed anything from the developer's own accounts (no, as long as Gordon had his credentials). He asked for the repo, the Cloudflare project, and anything still holding a key.

"The most important things I have to give you are just the repo and the Cloudflare."

The outgoing developer

"I'm not a gatekeeper. I'm going to be transparent with you. I can see what has been done and what has not been done. There's no work being generated for you here."

Michael Bowers, to Gordon earlier that day

By the end of the call the developer was doing a sweep of the repo to separate Gordon's code from his own, had agreed to add Heed to the Cloudflare project, and had said the payment was not the point for him either. The two of them booked a coffee for Monday morning to talk about working together on other projects.

"It's kind of a blessing that we met. It's very strange."

The outgoing developer, end of the continuity call
What Came Next

"Build the car so my employees can drive it."

"I'm not asking you to do marketing for me because that's what I do. But I'm asking you to build the car so my employees can drive it and I'm going to put in the gas."

Gordon

With the accounts secured and the handoff closed, the conversation moved to the thing Gordon had wanted from the start: one place his marketing coordinator could send a campaign from, see what came back, and act on it. Not a mirror of Meta and Mailchimp. A working tool built on the accounts he already owned, with JobTread and Google Workspace connected, and with the twelve landing pages kept because they were real.

"I could have done this for you in an hour. I can do it again for you in an hour and have it be better than this, and then that next hour give you the ability to actually do something as opposed to just look at things."

Michael Bowers

Every Heed build ships with the thing Gordon never had: a page inside the app that lists every account, every key, every connection, and who holds it. That is the continuity plan. It is built in from day one because, as Michael put it to Gordon, "you need to know just like we're having this call today what you're going to do in case that happens."

"This is what I need from you, Michael. I think it's the ground floor of what every business needs to do."

Gordon
Five Lessons

What every owner should take from Gordon's Friday.

  1. 1

    The emails you sent are the inventory.

    Nobody remembers every credential they shared. The sent folder does. Forward them before you do anything else.

  2. 2

    Change the registrar first.

    Whoever controls the domain controls the website, the email, and the subdomains. GoDaddy before Mailchimp, always.

  3. 3

    "Dashboard" is not a deliverable.

    Ask what the system does when nobody is looking at it. If the answer is "shows you things," you bought a window, not a machine.

  4. 4

    Pay on handoff, not on promises.

    Make the last payment conditional on a completed transfer confirmed by someone who can read the repo. Then pay immediately. It keeps everyone honest and everyone civil.

  5. 5

    Most of these are not scams.

    Gordon's developer was bright, willing, and out of his depth. The fix was leadership, not lawyers. A professional on the call turned a termination into a referral relationship.

In the same spot Gordon was?

Send the intake form. Michael reads it personally, replies the same business day with what he sees, and if it makes sense to talk you get a call, not a pitch.

Start the Takeover Intake Or Get an Independent Audit
Keep Reading

The 25-Point Developer Red Flag Checklist

Score your own project in five minutes and know whether to relax, audit, or change your passwords tonight.

How to Part Ways With an AI Contractor Safely

The offboarding sequence, in order, with the mistakes that cost people their domain.

Who Actually Owns Your AI Project?

Five questions to ask before the next invoice. If you cannot answer three, you have a problem.