Watchtower: supervising an autonomous voice agent during a live call

The problem: a takeover toggle is the only control most products ship

Autonomous voice agents now act on their own across voice, text, and payments, in verticals where the wrong move is expensive: a charge over the limit, a disclosure without consent, a promise the business can't keep. The only human control most of these products ship with is a switch that lets a person jump into the chat.

A switch answers can a human step in. It doesn't answer the questions that decide the outcome of a live call.

What is the agent about to do, before it does it? What is it allowed to touch on this call? And can I stop it in the two seconds I have, without the caller hearing a seam?

Confirmation prompts don't scale to an agent that runs for minutes across many steps. By the time a human reads the prompt, the money has moved.

Without a control surface, an agent can't be trusted to send a payment or read protected information on its own, so those actions stay manual. The Act Window makes them safe to delegate. The organization moves from an agent that only drafts to an agent that acts inside a boundary a human governs. That raises the ceiling on what can be automated, instead of shaving cost off what already was.

Measure: the share of consequential actions cleared for agent execution before and after, and the volume that share unlocks.

Every breach the surface prevents is a cost that never lands. A charge over the limit avoids a chargeback, a dispute, and a refund. A disclosure on a flagged line avoids regulatory exposure. Fail closed and the consent hard block turn an open-ended tail risk into a bounded, logged event with a default that protects the business.

Measure: expected loss per incident times incident rate times call volume, tracked as prevented cost rather than a claimed reduction.

A confirmation prompt on every action ties one supervisor to a fraction of one agent. Pulling a human in only at the boundary lets one supervisor govern many agents at once. That ratio is the real unit economics of a supervised agent fleet, and it's what carries the automation past breakeven.

Measure: concurrent agents a single supervisor can hold safely, and the interruptions per supervisor hour under each model.

Scope isn't a settings page three clicks away. It sits beside the transcript as the agent works, so the boundary the agent is pressing against is always in view. When the agent crosses it, the relevant capability flips to a breach state in real time.

Underneath, every intervention writes to a tamper-evident audit trail with a wall clock timestamp: scope tightened, charge held, override approved, control handed to a human. The record is a byproduct of using the tool, not a report someone remembers to file.

A confirmation prompt on every consequential action