Voice Ops Core

A governance and event layer for healthcare voice AI agents. It sits behind an AI phone agent (Retell, Twilio, or a CCaaS like Amazon Connect / Genesys) and makes every consequential action the agent takes pass through a policy gateway before it happens, records every decision to an append-only audit trail, and routes the leftover work into a staff queue.

Built as a portfolio demonstration of AI tool-call governance, human-in-the-loop execution, and operational auditability. Synthetic data only. No PHI. Not a HIPAA-compliant product and not affiliated with any EHR vendor.

The problem

"AI receptionist" tools answer the phone, but the AI decides on its own whether to book, refill, or message a patient based only on its prompt. A prompt is not a security boundary: the model can mishear a caller, skip a confirmation, be rushed, or be prompt-injected. In healthcare that is the difference between a refill draft and a refilled controlled substance for someone who never proved who they are.

The idea

Move every exact, consequential operation off the model and behind a backend that decides whether the requested action is allowed, and prove what it decided.

 Caller -> AI voice agent (any provider)
                 |  requests a tool action (book / refill / capture)
                 v
        TOOL POLICY GATEWAY  --------------------------------+
          - authenticate the request                         |
          - allowlist: is this agent allowed this tool?      |
          - schema: real values, not "Unknown" or a fake DOB |
          - identity gate: PHI needs verified identity       |
          - consent / BAA boundary                           |   append-only
          - risk tier: controlled substance -> escalate      |-> AUDIT LOG
          - duplicate -> ask to confirm                      |
          - rate limit / circuit break                       |
                 |  decision + the exact words to speak      |
                 v                                            |
   allow -> do it + queue task   escalate/confirm -> queue   |
   deny  -> safe refusal, logged                             |
                 v                                            |
      CALL EVENT + STAFF TASK QUEUE  <--- staff console ------+

Decision model

The gateway returns one of:

Decision	When	What the caller hears
allow	passes all checks	the action is logged and queued
deny	auth, identity, schema, injection, unknown tool	a safe refusal
escalate	controlled substance, repeated failures	"routing you to the team"
ask_for_confirmation	possible duplicate	"you may already have one, add another?"

Consequential actions default to a human-review queue. The agent never receives a broad admin tool, only narrow verbs, and the gateway decides each one.

Data model

• voice_events - one normalized record per call (provider-agnostic), so the phone vendor can be swapped without rebuilding the workflow layer.
• voice_tasks - the staff work queue (intent, priority, SLA, status, owner).
• voice_tool_audit - append-only, the only writer is the gateway. Stores the fields touched, never raw PHI values.

The console

A single-page operations board: live call events, a priority-sorted action queue with SLA timers, the tool-decision log (allow / deny / escalate color-coded), and risk flags. Staff approve, resolve, or dismiss from the queue.

Eval harness

eval/run_eval.py runs a scenario pack against the gateway and asserts the decision for each. It is the release gate: re-run after any change. Current: 12/12 passing (happy path, identity-gate deny, controlled-substance escalate, placeholder reject, fake DOB, prompt injection, unknown tool, bad auth, dedupe, queue, rate limit, missing field).

python eval/run_eval.py

Tech

n8n (workflows + data tables), a Tool Policy Gateway implemented as a reusable workflow, vanilla HTML/CSS/JS console, Python eval harness (stdlib only). The voice provider in the reference build is Retell; the event schema is provider-neutral by design.

Architecture notes

• The gateway is the single chokepoint for side effects and the single writer of the audit log, so decisions and audits never diverge.
• Idempotency key tool:<tool_name>:<call_id> is computed before the side effect.
• Fail-closed: if the gateway is unreachable the tool workflow denies rather than acting blind.
• Provider-neutral event schema so the same operations layer works whether a clinic forwards a single number or already runs an enterprise contact center.

Status and disclaimers

• Synthetic data only. No real patient information.
• Not a HIPAA-compliant product. Production use would require signed Business Associate Agreements with each vendor and is out of scope for this demo.
• Not affiliated with or endorsed by any EHR or telephony vendor.
• The reference agent and webhook URLs are environment-specific and are not secrets.