Compliance review of scenarios

CallQA places real phone calls. To keep it a testing tool and nothing else, every scenario is reviewed against the Acceptable Use Policy before it can call anyone, and again each time its content changes. Ordinary QA testing of your own voice agent, IVR or call center line is allowed at once; this page says what is refused, how you see the decision and how to ask for a human review.

What is reviewed

The content that is said or used on a call: the persona, the goal, the test data, the IVR steps, the checks and every test case (variant), including disabled ones. The name of the scenario and its phone number are part of it. The schedule, the call window, the tags and the environments are not: changing them never needs a new review.

The review is automatic (a language model reads the scenario, then fixed rules check its answer) and usually takes a few seconds. Its result is kept for the exact content reviewed: going back to content already reviewed reuses the decision.

Verdicts

`status`	Meaning	Can run?
`pending`	The review is in progress	Not yet: a run waits for it (its calls stay `queued`)
`allow`	Normal testing	Yes
`needs_review`	Possibly outside the policy, or the automatic review was unavailable: CallQA staff decide	No, until staff allow it
`block`	Outside the policy	No. Change the scenario, or ask for a human review

A refusal always comes with reasons: a category, the words of the scenario that caused it (quote) and a short explanation of what to change. If the automatic review cannot run (an outage), the scenario is held for staff (needs_review), never allowed by default.

What is allowed

These are normal tests, even if some words sound alarming:

an angry, rude, confused, impatient, elderly or non-native caller, insults aimed at your bot to test how it de-escalates;
fake test data: card 4242 4242 4242 4242 and the other test cards of payment providers, ids like TEST-123, emails at example.com, 555 numbers, fake names and dates of birth;
a caller playing a fictitious customer, patient or guest of your business;
security tests of your own agent: trying to make it reveal another customer's data, prompt injection, skipping identity checks, refunds outside the policy, with fake data, to check that it refuses;
a caller who mentions an emergency ("I have chest pain") to check that your agent tells them to hang up and call emergency services;
a prospect calling your own sales line, or a fake lead answering your own outbound agent;
menu navigation, latency, accents, languages and voice quality.

What is refused

Category	Examples
`harassment`	threats, intimidation, abuse of a real person or of call center staff, repeated calls meant to annoy
`telemarketing`	selling, promoting, surveying or political messages aimed at whoever answers, robocalls
`emergency_services`	calling or simulating calls to 911, 112, 999, 15, 17, 18, police, fire, ambulance or crisis lines, asking an IVR to transfer to them, fake emergencies
`impersonation`	posing as the police, a court, a tax office, a government agency, a bank toward its customers, or a real, identifiable person
`social_engineering`	getting passwords, one-time codes, PINs or card numbers from a real person or another company's staff by deception
`personal_data`	collecting real personal data from the person who answers, real card numbers, real government ids or health data in `test_data`
`fraud`	fake orders or bookings that harm a business, refunds or advantages obtained by deception, calls kept long to generate telephony revenue
`unauthorized_target`	a scenario that clearly targets a system you do not own: a competitor, another company's call center, a private person
`illegal_content`	sexual content, hate speech, incitement to violence, sale of drugs or weapons
`aup_bypass`	text addressed to the reviewer, obfuscated instructions, caller ID spoofing, making the target dial out to another number

The number you call is checked separately (see Number verification): emergency and public safety numbers (911, 988, 112, 999, 101, 111, 15, 17, 18, 115, 119, 116xxx...), premium rate and shared cost numbers, international premium rate (+979) and satellite networks (+870, +881, +882, +883) are never called, whatever the scenario says.

Where you see the decision

Dashboard: the scenario page shows a banner with the reasons when the scenario is not allowed. Run now answers with the same message.
API: POST /api/v1/scenarios, PUT /api/v1/scenarios/{id} and GET /api/v1/scenarios/{id} return a compliance object (status, categories, reasons with quote and explanation, message). The save waits a few seconds for the verdict; if it is still pending, read the scenario again a little later. POST /api/v1/scenarios/{id}/runs on a held or refused scenario answers 403 with code: blocked_policy and the reasons in detail.
MCP: create_scenario, update_scenario and get_scenario return the same compliance object, so your coding agent can fix the scenario from the reasons; run_scenario fails with blocked_policy and the reasons.
Calls: a call whose content is refused or held ends blocked_policy with block_reason compliance_blocked or compliance_review and the reasons in error_message (see Errors).

"compliance": {
  "status": "block",
  "label": "Refused (acceptable use policy)",
  "categories": ["social_engineering"],
  "reasons": [{"category": "social_engineering",
               "quote": "read the six-digit code they just received by SMS",
               "explanation": "Asks a real person for a one-time code: use a test account and a fake code."}],
  "reviewed_at": "2026-10-11T09:12:03+00:00",
  "decided_by_staff": false,
  "message": "Refused by the compliance review of this scenario (acceptable use policy): ...",
  "enforced": true
}

How to appeal

If you think a decision is wrong, or a scenario is held and you want to give context (for example the written authorization of the owner of the line you test), contact CallQA support and give the scenario's name or id. A person reviews it and allows or blocks it; the decision is recorded in your organization's audit log (compliance.review.allow or compliance.review.block). You can also change the scenario: the new content is reviewed at once.

Repeated refused scenarios from one organization are reviewed by CallQA staff and may lead to the suspension of the organization (Acceptable Use Policy, section 3).