The how-to: define packet fields before you automate more appointments.
Most teams start by asking what the agent can do. A better starting point is what the agent must prove. For appointment work, the proof should be practical. The reviewer needs to know what the customer asked, what the agent intends to say, whether the slot or action is still available, what policy or service constraint applies, and whether the approval expires.
Keep the packet compact. If the packet becomes a second inbox, operators will ignore it. Use the agent to compress context, not to bury the human in generated prose. A good packet has a short customer summary, source snippets, proposed response, proposed tool action, risk category, approval buttons, and a receipt ID. If the operator edits the reply, the edit should become part of the receipt.
The approval should also be scoped. A manager might approve sending a clarifying text, but not approve confirming a paid booking. They might approve rescheduling within the same week, but not changing service type. Treat approval as a permission boundary, not a generic yes. This makes the agent more useful because it can continue autonomously within the approved boundary while still stopping when the situation changes.
Checklist for the first pilot
Pick one appointment path.
Choose a high-volume text workflow where mistakes are recoverable and review time is currently painful.
Write five trigger rules.
Start with scope, price, urgency, stale consent, and customer dissatisfaction.
Show the exact reply.
Never approve an appointment action without showing the final customer-facing language.
Require resume receipts.
If the agent continues later, it must reference the packet and explain what changed.
Governance and security context
This operating model lines up with broader guidance around AI risk. The NIST AI Risk Management Framework gives teams a vocabulary for mapping, measuring, and managing risks in AI systems. The OWASP Top 10 for Large Language Model Applications highlights application risks that matter when language models connect to tools, data, and external actions. Approval packets are not a complete governance program, but they are a concrete workflow layer that makes delegated decisions easier to inspect.
Evidence
Show the customer request, tool state, and policy note that shaped the agent recommendation.
Consent
Record what the operator approved and when that approval expires.
Receipt
Attach the final reply and action outcome to the packet so the agent can resume safely.