The collection floor is changing.
Your system of record hasn't.

Because there is no path, not because there is a rule. Each agency's book lives in its own database — your facts, your documents, your configuration are not rows co-mingled in a shared table with a tenant column; they are physically yours. Inside it, every record still carries its tenant and every read is still scoped in the query itself — defense in depth, not the only defense — and there is no "all tenants" read in the working system.

The isolation goes further than the data. Every tenant holds its own AI provider keys in its own encrypted vault — there is no shared platform key your traffic silently rides on. Your admin agents run in your own dedicated container, with their own memory on their own storage: your System Specialist has never seen another agency's book and has no route to it. And documents live in per-tenant custody, reachable only through your own attachment records. If one tenant's key were ever compromised, it is one tenant's key.

By making sure the agents that untrusted people can talk to have nothing to give up. A consumer on a phone call is untrusted input speaking directly into a model — so the phone agent has zero access to the data store. It works inside a bounded envelope the system hands it for that one call. The portal's concierge holds nothing until right-party verification passes. Talk either of them into anything you like; there is nothing behind them to reach.

For every agent, the tools, the loop, and the record belong to code — the model only decides. A model cannot call a tool it wasn't given, widen its own negotiation envelope, or skip the record. And the compliance gate in front of every outbound channel is not a model at all: it is deterministic code, and it cannot be argued with. What a visitor types is treated as data, never as instruction — including on this page: the agent below holds a public knowledge pack and nothing else, and it will tell you so itself.

Not by chatting. Hand-offs between agents are structured, recorded work products: the strategist publishes an approved plan; the outreach planner picks from a menu the gate has already screened; the account specialist hands the phone agent a bounded envelope — "you may offer down to this, stop if they mention an attorney"; the background specialists come back with evidence attached to a review request a human answers.

The permanent record is the medium. Each hand-off lands as facts in the event log — who produced it, under which approved version, on what evidence — so "why did the AI do that?" is a query, not a mystery. And because authority originates only in configuration a named human applied, one agent cannot grant another agent power that no human ever clicked.

Nothing is edited and nothing is deleted — the log is append-only, and each event is hash-chained to what came before, so tampering breaks the chain visibly. Corrections are new events that point at what they correct: a reversed payment shows the payment, the reversal, and the link between them, permanently. Retiring a client or removing a policy is a recorded act, not an erasure.

It works the way the notes on an account have always worked — you never go back and edit what happened last March; you add today's entry. We apply that rule to everything: every letter, every call, every payment, every rule change, every configuration a human approved. That is why "prove what happened" is a replay, not an argument.

Replay is the headline: reconstruct exactly what the system knew and believed about any account at any moment in the past — through the rules as they stood that day. Dispute substantiation inside the 60-day clock, a client's "show me everything you did in Q2," a regulator's "why was this account called at 2:14pm" — each is a query, not a project.

Stale status becomes structurally impossible, because nothing stores a status: workability is calculated from the facts every time. Each client's status codes are views over the same facts — no parallel fields drifting out of sync. New kinds of facts don't need new columns, so thirty years of field sprawl never happens. And because configuration changes live in the same log, "what were your contact-frequency rules the day this call was placed" has a provable answer.

Voice in and out — AI agent or your own collectors, with the AI copilot beside them — SMS, email, printed letters, and the consumer portal, where consumers verify, chat, pay, set up plans and autopay, and view their documents. One notice is one template with per-channel renderings, so the email, the text, and the letter never drift apart; treatments can escalate by engagement — email unopened, text with a secure link, then paper.

Two constants across every channel: everything outbound passes the compliance gate — consent, quiet hours, frequency caps, legal state, checked at send time — and everything sent lands in evidence custody at the moment it happens. The letter in the archive is byte-for-byte the letter that mailed.

Not to start. Carriers, print and mail, payment processing — the platform runs them under its own negotiated accounts by default, so a new agency brings zero vendor contracts to go live. If you have your own relationships and your own rates, bring them: your credentials go into your tenant's vault and your traffic runs on your account instead.

Either way, two rules hold. Every counterparty is certified before it carries live traffic — an uncertified adapter does not run. And vendors are transient sources, never the warehouse: the evidence of every interaction lands in your custody at the moment it happens, so no vendor's retention window ever decides what you can prove.