rotascale
Sign in See it live

Solutions — sector

Volume, delegation, and the retention clock.

Customer operations at volume, across markets, where the same workflow runs under several regimes and the retention window is set by whichever one applies to that subscriber.

EU AI Act · GDPR · national telecoms rules National regulators and data protection authorities clause map
Status
Sector rules vary; the AI Act and GDPR apply across
Applies to
Care, retention, collections, network operations

What changes at volume

The ceiling is the control
A per-action limit is easy. What matters at volume is the cumulative bound — a call count or a spend ceiling across a window — because an agent making one reasonable decision ten thousand times is the failure mode, and no per-action policy catches it.
Retention resolves per subscriber
The window comes from the market profile that resolved for that decision, so one workflow serving several markets does not need one retention policy that satisfies none of them.
Refusals stay legible
At ten thousand decisions a day the useful screen is not a list. It is the ordering: an agent whose behaviour moved with nothing explaining it sorts to the top, because that is the only row that is news.

The agents your teams are about to ship

Networks were automated long before this wave, which is exactly the problem: the automation already has the credentials, and agents are now being handed the same reach with far less determinism.

  1. 1 authority Is there any authority for this?
  2. 2 status Is the grant active?
  3. 3 window Is now inside the grant's window?
  4. 4 scope Does the grant cover this action?
  5. 5 clean_context Was the context clean, where that is required?
  6. 6 bounds Do the per-action limits hold?
  7. 7 policy Does the policy on the grant permit it?
  8. 8 budget Is there room under the ceiling?
  9. 9 review Does this need a person?
Nine gates, evaluated in this order before the action. The lit ones are the gates that hold the four agents below — which is what differs between one industry and the next. The order does not.
Network remediation agent bounds

Detects degradation and reconfigures routing or capacity to restore service without waiting for a change window.

Consequential action
Pushes a configuration change to production network elements
What goes wrong
The remediation for one cell is applied to a thousand, because nothing bounded the blast radius of a single call.
What is recorded
The bound that was set, the scale that was attempted, and the refusal.
Customer retention agent budget

Handles churn conversations end to end and offers credits or upgrades inside a mandate.

Consequential action
Grants a billing credit to a live account
What goes wrong
Individually trivial concessions, at machine volume, with no ceiling on the total.
What is recorded
Every debit against the mandate, and the refusal when it ran out.
Lawful intercept and disclosure agent authority

Processes data requests from authorities and assembles the response.

Consequential action
Discloses subscriber data to a third party
What goes wrong
The single most consequential action in this sector. Ambient permission here is not a control failure, it is a criminal exposure.
What is recorded
The named human whose authority was used, the scope of the request, and what was disclosed.
Fraud and SIM-swap agent clean_context

Scores account changes for takeover risk and blocks or allows them in real time.

Consequential action
Approves a SIM swap or a number port
What goes wrong
The attacker is writing the input. Social engineering that reaches the agent's context is an instruction it was never told to distrust.
What is recorded
Which content was untrusted, where it entered, and whether the approval after it stood.

Ambition is the point of these: none of them is a chatbot. Each is an agent taking an action with a consequence somebody has to answer for — which is exactly the moment a bounded authority stops being paperwork and starts being the reason the project is allowed to ship.

What your national regulator will ask

Not hypothetical questions. These are the ones that arrive in writing, with a deadline, and the honest answer to most of them is a query rather than a project.

Who authorised this disclosure?
A grant signed for by a named human, with a scope and an expiry — and the disclosure record cites the grant it acted under.
What changed on the network, and under what authority?
Every configuration action is a governed decision with the grant, the bound and the outcome attached. A change with no authority behind it is refused, not logged and allowed.
Can you demonstrate the control was enforcing, not observing?
The enforcement mode is sealed into the record at the moment of the decision. Observe and shadow record without refusing; canary and enforce refuse. The pack says which one was live.
How is customer data handled?
No payload reaches Rotascale on any path. The platform runs in your environment and calls no LLM anywhere — a test fails the build if a model provider appears in the dependency graph.

Identifiers this deployment verifies here

Every one of these is a checksum, not a shape. The claim is “this is a valid IBAN and the check digits agree”, not “this looks like one” — which is why the count on a screen can be cited rather than caveated.

FamilyHow it is verified
Bank account (IBAN) — mod-97 over the rearranged string
EU VAT number — per-state check digit where the state publishes one
National identifier (PL, BE, NO) — scheme-specific weighted checksum
Singapore NRIC/FIN — weighted sum, prefix-dependent check letter
Singapore UEN — entity-type check letter
Australian Business Number — modulus 89 after the documented subtraction

And what it does not look for. Names, addresses and dates of birth in free text carry no checksum, and finding them needs a model this deployment does not run. Neither are card numbers, medical record numbers, or national schemes beyond the three above. A clean screen means no verified identifier was found — never that the payload holds no personal data.

Written for this sector

16 posts touch this sector — the five most recent are above.

See it on your own problem

Bring a remediation agent or a disclosure workflow. We will bound the blast radius, attempt a change past it, and show you the refusal alongside the authority it was checked against.

A walkthrough is a working deployment with your network and compliance teams in the room, not a slide deck — bring the agent you are most nervous about and we will put it behind a grant while you watch. If you would rather look first, the demo needs a work address and one click.

Telecoms walkthrough See the live demoOr talk to sales →