The phone rings and the agent answers with the disclosure you wrote - the AI or recording notice your rules require - and then asks how it can help. It works out which one of four things the caller wants: book, move, cancel, or just check an appointment they already have. Because this is a phone call, everything that matters gets read back. Names, spellings, email addresses, dates and times are repeated once, in words, and the agent waits for a yes before anything happens. If the line is poor or it did not catch something, it says so and asks again rather than guessing - a wrong email address means a confirmation nobody receives, and a wrong date means somebody turns up on the wrong day. AVAILABILITY IS NOT THE AGENT'S DECISION. When the caller asks for a time, a separate guarded workflow reads your real free/busy, checks that exact slot against your working hours, and either books it or comes back with the times that genuinely are free. The agent never looks at your diary and cannot work out whether a slot is open - it may only repeat what the check returned, and every alternative it offers is one that came out of that arithmetic. If nothing fits, it says so and offers a callback instead of nudging the caller towards a time it made up. Moving and cancelling go through the same guard, and it refuses more than it accepts. Every appointment this agent books carries a marker line in its description; the guard reads the appointment first and leaves alone anything without that marker, so an entry somebody else put in your diary is never touched, however confidently it is asked for. The move path sends the new times and nothing else, which means it structurally cannot turn a reschedule into a deletion. The caller never has to know or say an appointment reference - the workflow finds their appointment from the email address they booked with. When it cannot finish the job - no suitable time, an appointment it may not touch, a question that is not about appointments, or a caller who simply wants a person - it takes a number and emails your team a callback request with the actual reason written out, not "needs assistance". And it tells the caller that is what it has done. The agent holds no calendar write of its own and no ability to email anyone. Every booking, change, cancellation and message goes through the one guarded workflow. That is a property of how it is built rather than a promise about how it behaves.