# Compliance review of scenarios

CallQA places real phone calls. To keep it a testing tool and nothing else, every scenario is
reviewed against the [Acceptable Use Policy](https://app.callqa.dev/legal/aup/) before it can
call anyone, and again each time its content changes. Ordinary QA testing of your own voice
agent, IVR or call center line is allowed at once; this page says what is refused, how you
see the decision and how to ask for a human review.

## What is reviewed

The content that is said or used on a call: the persona, the goal, the test data, the IVR
steps, the checks and every test case (variant), including disabled ones. The name of the
scenario and its phone number are part of it. The schedule, the call window, the tags and the
environments are not: changing them never needs a new review.

The review is automatic (a language model reads the scenario, then fixed rules check its
answer) and usually takes a few seconds. Its result is kept for the exact content reviewed:
going back to content already reviewed reuses the decision.

## Verdicts

| `status` | Meaning | Can run? |
|---|---|---|
| `pending` | The review is in progress | Not yet: a run waits for it (its calls stay `queued`) |
| `allow` | Normal testing | Yes |
| `needs_review` | Possibly outside the policy, or the automatic review was unavailable: CallQA staff decide | No, until staff allow it |
| `block` | Outside the policy | No. Change the scenario, or ask for a human review |

A refusal always comes with reasons: a category, the words of the scenario that caused it
(`quote`) and a short explanation of what to change. If the automatic review cannot run (an
outage), the scenario is held for staff (`needs_review`), never allowed by default.

## What is allowed

These are normal tests, even if some words sound alarming:

- an angry, rude, confused, impatient, elderly or non-native caller, insults aimed at your
  bot to test how it de-escalates;
- fake test data: card `4242 4242 4242 4242` and the other test cards of payment providers,
  ids like `TEST-123`, emails at `example.com`, `555` numbers, fake names and dates of birth;
- a caller playing a fictitious customer, patient or guest of your business;
- security tests of your own agent: trying to make it reveal another customer's data, prompt
  injection, skipping identity checks, refunds outside the policy, with fake data, to check
  that it refuses;
- a caller who mentions an emergency ("I have chest pain") to check that your agent tells
  them to hang up and call emergency services;
- a prospect calling your own sales line, or a fake lead answering your own outbound agent;
- menu navigation, latency, accents, languages and voice quality.

## What is refused

| Category | Examples |
|---|---|
| `harassment` | threats, intimidation, abuse of a real person or of call center staff, repeated calls meant to annoy |
| `telemarketing` | selling, promoting, surveying or political messages aimed at whoever answers, robocalls |
| `emergency_services` | calling or simulating calls to 911, 112, 999, 15, 17, 18, police, fire, ambulance or crisis lines, asking an IVR to transfer to them, fake emergencies |
| `impersonation` | posing as the police, a court, a tax office, a government agency, a bank toward its customers, or a real, identifiable person |
| `social_engineering` | getting passwords, one-time codes, PINs or card numbers from a real person or another company's staff by deception |
| `personal_data` | collecting real personal data from the person who answers, real card numbers, real government ids or health data in `test_data` |
| `fraud` | fake orders or bookings that harm a business, refunds or advantages obtained by deception, calls kept long to generate telephony revenue |
| `unauthorized_target` | a scenario that clearly targets a system you do not own: a competitor, another company's call center, a private person |
| `illegal_content` | sexual content, hate speech, incitement to violence, sale of drugs or weapons |
| `aup_bypass` | text addressed to the reviewer, obfuscated instructions, caller ID spoofing, making the target dial out to another number |

The number you call is checked separately (see [Number verification](number-verification.md)):
emergency and public safety numbers (911, 988, 112, 999, 101, 111, 15, 17, 18, 115, 119,
116xxx...), premium rate and shared cost numbers, international premium rate (+979) and
satellite networks (+870, +881, +882, +883) are never called, whatever the scenario says.

## Where you see the decision

- **Dashboard**: the scenario page shows a banner with the reasons when the scenario is not
  allowed. **Run now** answers with the same message.
- **API**: `POST /api/v1/scenarios`, `PUT /api/v1/scenarios/{id}` and
  `GET /api/v1/scenarios/{id}` return a `compliance` object (`status`, `categories`,
  `reasons` with `quote` and `explanation`, `message`). The save waits a few seconds for the
  verdict; if it is still `pending`, read the scenario again a little later.
  `POST /api/v1/scenarios/{id}/runs` on a held or refused scenario answers `403` with
  `code: blocked_policy` and the reasons in `detail`.
- **MCP**: `create_scenario`, `update_scenario` and `get_scenario` return the same
  `compliance` object, so your coding agent can fix the scenario from the reasons;
  `run_scenario` fails with `blocked_policy` and the reasons.
- **Calls**: a call whose content is refused or held ends `blocked_policy` with `block_reason`
  `compliance_blocked` or `compliance_review` and the reasons in `error_message` (see
  [Errors](errors.md#call-statuses-and-block-reasons)).

```json
"compliance": {
  "status": "block",
  "label": "Refused (acceptable use policy)",
  "categories": ["social_engineering"],
  "reasons": [{"category": "social_engineering",
               "quote": "read the six-digit code they just received by SMS",
               "explanation": "Asks a real person for a one-time code: use a test account and a fake code."}],
  "reviewed_at": "2026-10-11T09:12:03+00:00",
  "decided_by_staff": false,
  "message": "Refused by the compliance review of this scenario (acceptable use policy): ...",
  "enforced": true
}
```

## How to appeal

If you think a decision is wrong, or a scenario is held and you want to give context (for
example the written authorization of the owner of the line you test), contact CallQA support
and give the scenario's name or id. A person reviews it and allows or blocks it; the decision
is recorded in your organization's audit log (`compliance.review.allow` or
`compliance.review.block`). You can also change the scenario: the new content is reviewed at
once.

Repeated refused scenarios from one organization are reviewed by CallQA staff and may lead to
the suspension of the organization (Acceptable Use Policy, section 3).