Approval mode & graduation.

Approval Required is the default for new tenants — the safety wheel that lets you hear the AI on real customer calls without it making commitments without you. Here's what the approvals look like, when graduation unlocks, and how to step back down if you ever want to.

Two equivalent control surfaces. Every mode action — graduate, switch back, status — works both on the dashboard (Account → Onboarding mode card) and via SMS (GRADUATE, APPROVAL, MODE). Both paths write the same audit-log entry, so it doesn't matter which one you use — pick whichever's in arm's reach. Each dashboard control surfaces the equivalent SMS keyword inline.

The three modes at a glance

Mode	AI books	Your involvement	Default for
Approval Required	Provisionally — confirmed after your YES	SMS per booking, tap YES / NO / link	New tenants, days 0–30
Monitored	Directly	Daily SMS digest + 10% spot checks	Most tenants
Autonomous	Directly	Weekly digest + 2% spot checks	Opt-in only

What an SMS approval looks like

When the AI takes a booking in Approval Required mode, you get an SMS within a few seconds. They're designed to be actionable in one tap on a phone:

SMS · from your control number

Booking pending. Sarah just took a hot water service booking from Maria Lopes (recurring customer, 14 Park St) for Thu 14 May 9–10am. Reply YES to confirm or NO to reschedule. Or tap office-voice.com/b/x4k2… to review the call.

What each reply does

YES — Booking is confirmed in ServiceM8. The provisional hold becomes a real booking. The customer is not notified (they already heard the AI confirm).
NO — Booking is cancelled. The AI rings the customer back within 5 minutes: "Hey Maria, Sarah again — quick update. Mike's got a clash at 9 Thursday; can we shift to 11, or another day?" — with full context from the first call so it doesn't start from scratch.
Tap the link — Opens a redacted transcript with the outcome chip and the linked job. Approve, reject, or leave a note for the team. Same effect as YES / NO, with more context for borderline cases.

Audit trail. Every approval is logged with the conversation id, the booking it relates to, who replied (which staff mobile), and when. Visible in Dashboard → Approvals.

Where approvals show up

SMS to your on-call mobile — the default, and the fastest path.
In-app inbox— full audit trail, bulk actions, useful when you've been off-grid for a few hours.
Email— fallback if SMS delivery fails or you've disabled SMS notifications.

You can choose which staff mobile(s) get the SMS in Dashboard → Approvals → Notifications. Multiple recipients are fine — the first YES wins.

When the Graduate prompt appears

Two thresholds combine into a soft suggestion that you're ready to graduate:

30 days since the last mode change
20 or more bookings approved

Once both are true, the approval SMS appends a one-line hint ("You've approved 20+ bookings — reply GRADUATE to switch to direct booking" ), and the Graduate to Monitoredbutton on Account marks itself as "Ready to graduate".

Graduation is opt-in, any time

The 20 bookings / 30 days is a suggestion, not a hard gate. The Graduate button works any time you're in Approval Required mode — including on day 1 if you want. Same for the SMS command. We never auto-promote.

Two paths to graduate

Surface	What to do
Dashboard	Account → Graduate to MONITORED button. Card shows current count, days remaining, and eligibility.
SMS	Text `GRADUATE` to your Twilio number from a phone on the allow-list. Both paths write the same audit-log entry.

Autonomous mode

Autonomous is defined in our enum as a terminal opt-in state past Monitored (lighter monitoring, weekly digest, 2% spot checks). It's not surfaced as a user-clickable option yet — we'll add a Take off the training wheels button when the data tells us tenants are asking for it. High-severity flags will continue to surface at 100% regardless.

Switching back to Approval Required

You can step back to Approval Required any time. Two paths, same effect — immediate, next call will go through the approval loop, and the 30-day graduation clock resets:

Dashboard — Account → Switch back to APPROVAL_REQUIRED button (only shown when you're currently in Monitored).
SMS — text APPROVAL to your Twilio number.

Reasons people step back

You've just made a meaningful prompt or knowledge-base change and want to review the first batch of calls before trusting it autonomously.
Seasonal: a busy or unusual period (post-storm callout surge, holiday handover) where you want eyes on every booking.
Quality regression: a couple of borderline calls and you want a few days of explicit oversight before re-graduating.

Automatic demotion (planned)

In the future, the system will demote you back to Approval Required automatically if the AI's quality regresses. Planned triggers:

Three consecutive calls flagged at high severity
Disclosure verification fails (AI line or recording line missing from the opener)
A customer is detected saying "stop calling me" — that customer is flagged across channels for the tenant

Not active today. For now, quality flags surface on the dashboard for review, and you decide whether to step back manually. The audit log + the 100% post-call quality flag detection are both in place — auto-demotion is the next layer on top, due when we've calibrated the flag-detection false-positive rate.

What doesn't change between modes

Disclosure. Every call still discloses AI identity and recording, in every mode.
DNCR. Outbound calls still check the Do Not Call Register before dialling (except service/job calls to existing customers).
Compliance audit log. Every AI decision affecting a customer is logged, in every mode.
Kill switches. Master toggle, SMS keywords, scheduled blackouts, panic forward — all identical across modes. See Compliance & privacy.

Workflows — what each workflow can book without approval.
Compliance & privacy — the kill switches that work in every mode.
Onboarding guide — the long-form context on Approval Required.