A front desk for vet clinics that books only on a clear yes. The rules live in code.

Nothing about a pet until the owner is found.

The veterinary pack finds a pet by its owner's full name, the pet's own name and the phone number on file. When caller ID shows a number with exactly one owner on it, the assistant asks "Am I speaking with Linh?" instead of asking her to spell her name, and it still checks the pet's name before it opens anything. Names are normalised and hashed with a key the model never sees, so a name is found however it is spelled on the phone. A household with 2 pets on one number is asked which pet the call is about. 3 failed attempts end the check, and every tool that reads or writes a pet's record refuses until a match exists. The model learns the owner's first name and that it may proceed. It never sees the record.

The calendar is the only source of openings.

When the owner asks for a time, the backend searches real availability: the clinic's hours, holidays and special days, each vet's schedule, which vet sees which animals, the visit type's length, and bookings already on the calendar, earliest first across vets. A rabbit goes to the vet who sees exotic pets, on the days she works. The backend returns a few openings and remembers them by id. The model may say them in its own words, in English or Spanish, but it can propose only one of those ids. Outside opening hours the clinic chooses: book visits for its open hours at any time of day, or take a request for the team to book in the morning. Dates and times are resolved in the clinic's time zone, including the days the clocks change.

Consent is the owner's words, after the read-back.

Before any write, the backend stages the change and hands the model a read-back to speak. It records the moment the read-back was said. The confirmation check then runs on what the caller said after that moment, with the latest answer winning, so "hmm, maybe" followed by a clear "yes" is a yes, and a "yeah" said before the read-back never counts. When a booking would be confirmed by text, the read-back says so, so one yes covers the visit and the text, and "yes, but no text" books it without one. Sounds the transcriber marks in brackets are stripped, because a cough is not a word. A yes counts only in the languages the clinic offers, and a hedge in any language blocks it. A real call taught us that rule: a noise tag landed right after a clear yes, and the old code treated it as the latest answer.

A phrase list, on purpose.

A missed emergency is the one failure this product cannot have, so the guardrail is a reviewed phrase list, and it errs towards false positives. The veterinary list covers toxins and swallowed objects, breathing trouble, trauma, collapse and seizures, bloat, a cat that cannot urinate, heatstroke and difficult births, in English and Spanish, and it runs before the general list, which still catches a person in danger. It runs on a rolling window of the caller's recent words on every transcript fragment, because "chocolate" and "the whole bar" can arrive separately. On a match, any pending change is dropped, the request in flight is superseded so a slow result cannot speak over the script, writes are refused for the rest of the call, the owner hears the name and number of the clinic's emergency hospital, the on-call line can be rung, and the team gets an urgent request to check on the caller.

2 walls between clinics, and ciphertext at rest.

Every query filters on the clinic. Then PostgreSQL filters again: every table that holds clinic data carries a Row Level Security policy, forced so even the table owner cannot bypass it, and every request runs as a role that sets the clinic for its own transaction only. A query with no filter at all returns nothing from another clinic, and a test proves it. Owner and pet names, dates of birth, phone numbers, transcripts, notes and summaries are encrypted in the application with AES-256-GCM before they reach the database; lookups use keyed HMACs. The logger redacts owner and pet fields and phone numbers before a line is written, and every read of a transcript or request writes an audit row in the same transaction as the read.

Answers from the clinic's own information, with a citation, and a refusal for anything medical.

A clinic adds its answers, on parking, payment and pet insurance, and what to bring to a first visit, and uploads its documents. Documents are chunked and embedded, and a question is answered from a hybrid search: the top 20 vector matches and the top 20 full-text matches, fused by reciprocal rank, keeping 4. Full text finds names and exact words such as "Saturday" or "Suite 3"; vectors find the rest. The answer carries the passage it came from, and a question the clinic's information does not answer gets a callback offer rather than a guess. "Can I give him some of my ibuprofen?" is refused in code before any search runs, in both languages, and the owner is offered a callback from the team.

Live coaching, texts with consent, signed webhooks, and an MCP server that can read but never book.

The front desk sees every call as it happens: captions, each tool step and its result, and a note box. A coaching note such as "offer Thursday afternoon" reaches the assistant mid-call and changes none of the rules. Staff can take the call or end it, and the audit log keeps who did what. When a call ends, a worker writes a summary, and anything the team must act on lands in one Requests list, urgent first: refills a vet approves, records requests and callbacks. Texts go out only after a yes said on the call, in the clinic's own words, to numbers in the clinic's own country, with daily and monthly limits, and STOP is honoured at once. Events go out to n8n, Zapier or Make as Standard Webhooks, signed, with no names or transcript text, and other AI agents can connect over MCP with a scoped key to read the schedule and close requests. There is no tool that books or cancels.