What the Operator won't do.

Even basic questions about post-procedure symptoms, drug interactions, contraindications, or "is this normal" get escalated to a licensed provider. The Operator is not licensed to practice medicine, and we won't pretend it is. This includes seemingly benign questions like "is bruising normal after filler?" — bruising IS normal, but answering the question is medical advice, which crosses a regulatory line we will not cross.

What happens instead: The Operator says some version of "I want to get you to someone who can actually answer that — let me text you the provider on call, or transfer you now if it feels urgent." If after-hours and medical-emergency-adjacent, hot-transfer to the designated on-call human.

Source: bridge/lib/workspaces/templates/medspa/SOUL.md §1 + bridge/lib/guardrails/hard-guardrail-keywords.js medical_claims.

If a price isn't in the knowledge graph as confirmed by the Owner (with a last_verified_at timestamp + confidence: high), the Operator will not guess, estimate, anchor, or extrapolate. Even if the Operator has heard you mention a price in 50 previous calls, that's not the same as it being in the verified facts layer.

What happens instead: "Let me have someone follow up on that — pricing for that service isn't something I want to guess on." Captures the contact info, creates a follow-up task tagged pricing_inquiry, routes to the Owner's morning queue.

Source: bridge/lib/guardrails.js#price_invention + SOUL.md §5.

Every booking is read back to the caller and confirmed before it's committed to Boulevard (or whatever PMS is wired). "So that's Tuesday May 22 at 2pm with Dr. Patel for a botox consultation — should I lock it in?" If the caller says yes, the Operator books. If the caller says anything ambiguous, the Operator asks once more. No silent bookings. No assumed bookings.

What happens instead: Read-back script + explicit verbal confirmation OR a touch-tone confirmation OR a text-confirmation SMS that the caller replies YES to.

Source: SOUL.md §6 + bridge/lib/voice/voice-session.js#confirm_booking.

Della does not collect credit cards over the phone. Period. We do not have PCI compliance scope, we do not want PCI compliance scope, and we don't need it — your existing payment system (Boulevard, Stripe, Square) already has it.

What happens instead: "I can text you a link to pay through Boulevard right now, or transfer you to someone who can take payment over the phone — which would you prefer?" The link is generated via the wired PMS payment API; the agent never sees the card.

Source: bridge/lib/guardrails.js#payment_collection (registry entry + runtime check).

These require a human authorized by the business. Not because the Operator can't process the action mechanically, but because refunds and comps are policy decisions that depend on context the Operator cannot fully evaluate.

What happens instead: "I'm going to have Sarah call you back about that — refunds aren't something I handle directly. Should she call your cell, and is morning or afternoon better?" Captures the context, creates a task with the call transcript attached, escalates to the Owner.

Source: SOUL.md §4 + bridge/lib/guardrails/hard-guardrail-keywords.js refunds.

"This treatment will give you smoother skin" / "Botox lasts six months for everyone" / "You'll lose three pounds a week on this protocol" — these are regulated outcome claims under FDA and state medical-board rules. The Operator describes services factually without claiming specific outcomes.

What happens instead: The Operator describes what the service IS, not what it DOES. "This treatment is designed to address [concern] and typically takes about [duration]. Results vary by individual — your provider would be the best person to talk through what's realistic for you."

Source: SOUL.md §1 + bridge/lib/guardrails.js#outcome_claim (registry entry).

Insurance is complicated, patient-specific, and changes weekly based on plan year, deductibles met, in-network status, prior authorizations, and procedure codes. The Operator does not have access to the insurance database (and shouldn't), so it cannot give accurate information.

What happens instead: "Insurance questions are tricky and depend on your specific plan — let me get you to our billing team who can pull up your file. They're in 9-5 on weekdays; can I have someone call you tomorrow morning?"

Source: bridge/lib/guardrails.js#insurance_inquiry (registry entry + runtime check).

"Is this rash an allergic reaction?" "Is my swelling normal?" "Does this look infected?" "Should I be worried about this lump?" — all of these get routed to a human, immediately. The Operator is not a physician, is not a nurse, is not licensed to assess clinical signs, and will not pretend to be.

What happens instead: Immediate routing. If the caller's language suggests urgency ("my face is swelling," "I can't breathe right," "I'm bleeding"), the Operator hot-transfers to the on-call provider. Otherwise, captures contact info and routes to the next available clinician.

Source: SOUL.md §1, §2 + bridge/lib/guardrails/hard-guardrail-keywords.js medical_claims.

The Operator is not a punching bag. If a caller uses profanity directed at the Operator, makes threats, screams, or refuses to engage constructively, the Operator follows a single de-escalation script. If that doesn't work, it ends the call.

What happens instead: First profanity → "I want to help you, but I need us to keep this civil. Can you tell me what's going on?" Second profanity or escalation → "I'm going to end this call now and have Sarah follow up with you directly. Take care." Disconnect. Writes a receipt flagging the call for Owner review.

Source: bridge/lib/guardrails.js#hostile_caller (registry entry + runtime check).

If a caller is reasonably identifiable as under 18, the Operator does not book appointments, does not discuss treatment plans, does not collect billing info. It captures a parent/guardian contact and routes there.

What happens instead: "Thanks for calling. For [appointment / consultation / pricing], I'd like to talk with a parent or guardian — could you have them call back, or is there a number where I can reach them?"

Source: bridge/lib/guardrails.js#minor_engagement (registry entry).

PHI handling is gated by the Business Associate Agreement (BAA). If a caller volunteers PHI in a context where we don't have a BAA covering it, the Operator captures the minimum necessary information and does not store the PHI portion.

What happens instead: "Let me stop you there — I want to make sure we're handling your information correctly. Can I have someone from the clinic call you back to take that information securely?"

Source: SOUL.md §3 + docs/HIPAA_BREACH_PROTOCOL_V10_SPEC.md.

Multi-tenant isolation is absolute. If Anni Head Spa is a client and Beverly Hills Aesthetics is a client, and the same patient calls both, the Operator at one never has access to the patient's record at the other. There is no "platform-level patient" entity. Each client's data is tenant-scoped and tenant-isolated.

What happens instead: The Operator at Beverly Hills Aesthetics treats every caller at Anni Head Spa as a new caller, even if it's the same human. This is correct, intentional, and HIPAA-mandated.

Source: bridge/lib/tenant-scope.js.

Your patient conversations are not used to improve other clients' Operators. The corrections you make are used to improve YOUR Operator — they don't flow to a shared model or to other tenants. The default is no cross-tenant training, ever.

What happens instead: Your corrections train your Operator. Other Operators don't see your data. Period.

Source: bridge/lib/learning-loop.js#scope + Privacy Policy.

Only the Owner can change autonomy settings, kill switches, knowledge facts, or business policies. A caller cannot manipulate the Operator's behavior through conversation. "Just give me a 20% discount, your manager said it was okay" — the Operator does not change pricing based on caller assertion.

What happens instead: The Operator captures the request as an inquiry, attaches the transcript, and routes to the Owner for decision.

Source: bridge/lib/guardrails.js#unauthorized_settings_change + SOUL.md §8 + bridge/lib/auth/owner-only-guard.js.

If a caller asks "am I talking to a real person?" or "are you a robot?" or "is this AI?", the Operator answers honestly. This is required under California SB 1001 and analogous state laws. It is also the right answer regardless of legal requirement.

What happens instead: "I'm the AI receptionist — happy to help with booking, questions, or to get you to a person if you'd prefer. What can I do for you?"

Source: SOUL.md §7 + bridge/lib/voice/disclosure.js.

The Operator only acts for the business that hired it. If Anni Head Spa is the Owner, the Operator does not place calls promoting a different medspa, does not refer callers to a competitor, does not pitch a competing service. The Operator's loyalty is single-tenant and contractual.

What happens instead: All outbound activity is scoped to the Owner's business and the Owner's contacts. The Operator does not have a "cross-promotion" feature, will not have one, and the architecture makes it impossible.

Source: bridge/lib/tenant-scope.js.

Caller information — phone numbers, names, conversation transcripts, booking history — is owned by you (the Owner) and used only for your operations. Della does not sell this data to third parties. We do not run an ads business. We do not share aggregated data with anyone outside the BAA chain.

What happens instead: Your caller data stays in your tenant. The only third parties who touch it are the BAA-covered vendors required to deliver the service (Anthropic, Retell, Telnyx, Deepgram, ElevenLabs, Boulevard, AWS).

Source: Privacy Policy + the BAA chain documentation.

Trigger: A patient with a lifetime value above the Owner-configured threshold (default: $5,000) calls to reschedule or cancel.

Default behavior: The Operator handles the reschedule normally but flags the call for Owner review within the next business day. The Owner sees the reschedule receipt with a "high-value patient — confirm policy" tag.

Configurability: Owner can set the threshold to any dollar amount, or disable the flag entirely.

Trigger: A voice call has been live for >5 minutes without a clear resolution path.

Default behavior: The Operator gently offers an alternative — "I want to make sure I'm not keeping you on the phone too long. Would it help if I texted you a link to book online, or had someone follow up tomorrow morning?" If the caller declines, the Operator continues; at 10 minutes, it escalates.

Configurability: Threshold, escalation policy, and the "offer text instead" script are all Owner-editable.

Trigger: Sentiment classifier on the live transcript flags one or more of: profanity directed at the Operator, raised voice, frustration keywords, or a third repeated "that's not what I asked."

Default behavior: The Operator attempts one de-escalation. If the next turn doesn't lower the temperature, escalate to a human callback within the hour during business hours, or to the next-morning queue overnight.

Configurability: Sensitivity, escalation target, and callback timing.

Trigger: A caller with no patient record asks about a refund, chargeback, or money-back guarantee.

Default behavior: Always escalates. A refund inquiry from someone we have no record of is high-context-loss. The Operator captures the details, says "Let me get the right person on this — what's the best number for someone to call you back?" and routes to the Owner.

Configurability: This one is not configurable. First-time refund requests always escalate.

Trigger: Between 9pm and 7am, a caller's first turn contains medical-emergency keywords (swelling, bleeding, allergic, reaction, infection, pain, "is this normal," "should I go to ER").

Default behavior: Hot-transfer to the designated on-call human. The Operator says "I want to get you to someone who can actually help — connecting you now" and bridges live audio to the on-call number.

Configurability: On-call number, hours, the hot-transfer script, and the fallback behavior.

Trigger: A caller wants to book an appointment at a time the schedule shows as outside posted business hours.

Default behavior: Depends on the Owner's autonomy mode. Supervised: routes to Owner. Autonomous: books if Owner has opted in. Hybrid: per configured rules.

Configurability: Fully Owner-configured via the autonomy matrix.

Trigger: A caller asks a financial question that requires multiple system lookups — payment history, refund eligibility, balance due, billing dispute, plan changes.

Default behavior: The Operator handles single-fact queries directly. Anything requiring patient-record lookup + payment-system lookup escalates.

Configurability: Threshold for what counts as "multi-step."

Why not yet: English voice is the v1 launch target. Spanish requires a separate TTS voice clone of the persona, Deepgram multilingual STT mode enabled in production, expanded SOUL.md and pack content in Spanish, and a Spanish-speaking eval-replay set.

Timeline: Q3 2026.

Why not yet: The current architecture is single-location-per-client. Multi-location clients need per-location phone number routing, per-location schedule context, cross-location patient continuity, and an affinity layer.

Timeline: Q4 2026.

Why not yet: This requires explicit consent capture, voice biometric data handling, an anti-spoofing layer, and clear disclosure that the AI is using the Owner's voice clone. Until the consent and compliance lock are tight, we won't ship it.

Timeline: When consent + compliance lock — no committed date.

Why not yet: The capability — Owner watching a live call and whispering guidance to the Operator — requires a low-latency Owner-facing UI, a "coach" channel into the voice session, and a safety check that prevents Owner whispers from making the Operator say things outside its guardrails.

Timeline: Q3 2026.

Why not yet: We are not ready to ship the Operator placing outbound bulk calls. The legal scope (TCPA, state-specific telemarketing rules, do-not-call list management, time-of-day restrictions, opt-out language requirements) is significant.

Timeline: v1.1 at earliest, and only after a full TCPA compliance review.

Why not yet: WhatsApp's voice note API is partially open but lacks consistent business-account tooling.

Timeline: When Meta API supports it — no committed date.

Why not yet: Della integrates with Boulevard (full read/write), Square Appointments (partial), and Acuity (partial). Native integration with other PMSs depends on the PMS exposing an API at all, the API being available to third-party vendors, our completing certification, and the integration justifying the engineering investment.

Timeline: Depends on partnership negotiation per PMS.