Compliance belongs in the platform, not in the prompt.
A worker making outbound contact operates in a regulated environment. Every obligation below is enforced before the worker is invoked, not delegated to a model and hoped for. That distinction is what makes the difference between an AI system that is interesting and one a regulated institution will actually deploy.
Automated pre-contact check against every applicable do not call registry, blocked before the worker is ever invoked.
AI identity disclosure injected by the platform into every outbound voice call, in the contact's language, non skippable.
A per contact, per purpose immutable record: what, when, through which channel, and on what basis.
No outbound contact outside the configured window for the contact's jurisdiction and timezone.
Automatic selection of the conversation record depth by jurisdiction and consent, with no override permitted below the minimum.
Automatic flagging for review and deletion at the end of the applicable retention period.
Every contact attempt, consent check, registry lookup, disclosure delivery and capture decision logged with the rule matched.
Material assertions and commitments sealed with a signed, replayable record of what was known and under whose authority.
Singapore is the first deployment jurisdiction. The framework extends to others by configuration rather than by code, which is what allows a single campaign to run correctly across several markets at once.
| Jurisdiction | Key additional requirements the engine applies |
|---|---|
| Singapore | Do not call registry checked before every attempt, AI disclosure as a mandatory step, consent recorded before personal data is collected, purpose limited usage, and configurable calling windows even where none are statutory |
| United States | AI voice treated as artificial or pre-recorded, prior express written consent for consumer contact, disclosure within the opening seconds, the national registry honoured, records retained for five years |
| European Union | Consent or legitimate interest, the right to be informed about AI processing, an impact assessment for large scale calling, opt out at every contact point, data minimisation |
| United Kingdom | Consent for automated marketing calls with a business to business exemption where relevant to the role, and both preference registries checked |
| Australia | Consent for commercial calls, the register honoured, and an unsubscribe mechanism |
| India | Preference register honoured, calling restricted to daytime hours, disclosure as best practice |
A transcript containing a person's name and statements is personal data under virtually every jurisdiction, whether or not audio was retained. Recording extends the existing ladder rather than introducing a parallel mechanism, which means it is selected per interaction and never set globally.
The retained recording, enabling prosodic and acoustic analysis. Explicit, informed and separately obtained consent, disclosed before recording begins and repeated if a third party joins.
Complete text with speaker attribution in the language spoken, plus the parallel record language rendering.
Topics, qualification elements, action items and sentiment, without verbatim quotes or personal attribution. The recommended default where full consent is difficult.
What was agreed, the next step, the follow up. Least intelligence value, but the lowest consent requirement.
"For training and review purposes" permits quality review, coaching and worker calibration. It does not by itself permit use as evidence in a commercial dispute, feeding a third party model provider, or retention beyond the stated period. Purpose is enforced at the platform, and each recording carries the basis it was collected under.
Almost every meaningful rule in this system is relational rather than positional. "A seller sees their own accounts" is not a role, it is a relationship between a person and a set of accounts. Expressing that as roles produces a combinatorial mess. Expressing it as relationships produces a small, readable policy.
Tenants, teams, accounts, contacts, conversations, recordings, worker definitions and their individual prompt layers, knowledge bases, assets, skills, transactions, coaching records, requests and approval queues.
Member of a team, owner of an account, assigned to a worker, manager of a team, administrator of a tenant, and subject of a coaching record. Authorisation runs on Permit.io and is enforced at the API, never in the interface.
Federated identity with single sign on and passwordless entry, and two factor required for all operational roles.
Public, internal, confidential and restricted, with access control enforcing the classification rather than describing it.
Enforced at the database level rather than only in the application, with credentials and configuration encrypted and stored separately.
Stateless autoscaling services, secrets in a managed store scoped to the service account, encryption at rest and in transit.
Guardrails are part of the worker definition and are enforced by the kernel prompt layer, which a customer configuration cannot weaken.
Telemetry, per interaction cost capture, entitlements and caps are what turn a governed system into an operable one.