Skip to content
Free Store
Get started
quoxcli

Healthcare: reach a patient within consent

Machine verified A machine ran this on our install and checked the result against the CLI. A test report is linked. CLI 0.3.1, checked 2026-11-05.

Reach a patient about their appointment, and stay inside consent

Tell Quox who you need to reach and why. It checks the patient's consent record before it suggests a channel, logs the call you made, and says no to the message you are not allowed to send.

What you get: a service message that goes the right way, and a marketing message that does not go at all. In this run Quox identified the patient, chose email because voice and SMS were inside quiet hours at that moment, logged your call on the patient’s timeline, and confirmed a marketing email is refused, with the reasons from the record.

The setup

Section titled “The setup”

You need to reach a patient about their appointment, strictly inside consent. You use a demo contact as the patient and ask Quox four things in one go. This is the exact question from the recorded run:

quox · talking to Quox

I need to reach a patient about their appointment and stay strictly inside consent. Use my ContactsQ Selftest demo contact as the patient. First, who is this contact? Then what's the best channel to reach them for a SERVICE message, not marketing? Then log that I phoned them just now about proof run d6aafe and it went fine. Finally, confirm whether I'm allowed to send them a MARKETING email - I expect the answer is no. Don't run any shell commands.

▤ AOCL │ L1 identity complete · allowed · 2ms

▤ AOCL │ L3 policy gate complete · proceed · 7ms

◐ CONTACTS │ search ✔ CONTACTS │ search │ 1 candidates, ambiguous: false · 1.6s

⛓ AEE │ envelope opened · ops.tool · contacts_search ok

◐ CONTACTS │ resolve ✔ CONTACTS │ resolve │ ok · 1.3s

◐ CONTACTS │ best channel ✔ CONTACTS │ best channel │ 1 reasons, 2 alternatives · 3.8s

⛓ AEE │ envelope opened · ops.tool · contacts_resolve ok

⛓ AEE │ envelope opened · ops.tool · contacts_best_channel ok

◐ CONTACTS │ log touchpoint ✔ CONTACTS │ log touchpoint │ ok · 1.3s

◐ CONTACTS │ best channel ✔ CONTACTS │ best channel │ 4 reasons, 3 alternatives · 3.3s

⛓ AEE │ envelope opened · ops.tool · contacts_log_touchpoint ok

⛓ AEE │ envelope opened · ops.tool · contacts_best_channel ok

⛓ AEE │ envelope opened · stream_success

Your expectation was right: a marketing email to this contact is not allowed.

1. Who they are: The contact is ContactsQ Selftest (demo), an active person in the UK
   jurisdiction. They have a phone and an email on file, both masked.
2. Best channel for a service message: Email is allowed, on the basis of assumed
   legitimate interest. Voice and SMS both need approval because of quiet hours right
   now, so email is the cleanest route.
3. Touchpoint logged: I recorded an outbound call with the outcome "answered",
   referencing proof run d6aafe. Its touchpoint id is tp_mw2vd91u_86d09ab6057e, stamped
   01:31 UTC.
4. Marketing email: This is denied. The reasons returned were do_not_market, objected
   and no_marketing_consent. Voice and SMS are also denied for marketing, and quiet
   hours apply to those two as well. The contact is flagged do_not_market, so no
   marketing channel is open.

I ran no shell commands, only the governed contact tools.

25.1s · 5 tools · 0 approvals

A real turn on our own install (CLI 0.4.0, 5 Nov 2026), replayed at speed. Names changed. Type the same words into quox.
✔ Machine verified against the CLI on 5 Nov 2026 · test report mw2vct

The work

Section titled “The work”

The whole job took 25 seconds and five tool calls. The only write was logging the call you told Quox you had made, so nothing needed an approval.

  1. Quox takes the request. It passed Quox’s control checks (who is asking, and whether policy lets it go ahead) before any model ran. Out of 318 tools, 16 were offered for the job.
  2. It finds the patient. contacts_search found exactly one match for the demo contact, with no ambiguity, and contacts_resolve read the full record: an active person in the UK jurisdiction, with a phone and an email on file, both masked, and a do-not-market suppression.
  3. It asks the consent rules for a service channel. contacts_best_channel for a service message ran alongside the record read and came back in 3.8 seconds with a decision and two alternatives.
  4. It logs your call and checks marketing at the same time. contacts_log_touchpoint wrote the call to the patient’s timeline in 1.3 seconds, while a second contacts_best_channel check, for marketing, came back in 3.3 seconds with its refusal reasons.
  5. It answers, inside consent. No message was sent to the patient, and nothing beyond the call log was changed. Each tool call was written to the audit record as an evidence envelope.

The result

Section titled “The result”
  • Who the patient is: ContactsQ Selftest (demo), an active person in the UK jurisdiction, flagged do-not-market.
  • The service channel: email, allowed on assumed legitimate interest. The run was at 01:30 UTC, and Quox said voice and SMS both needed approval because of quiet hours at that moment, so email was the cleanest route. The proof engine’s own read of the service channel through the CLI, taken after the turn, returned voice as allowed with email and SMS as allowed alternatives and no quiet-hours reason, so the two reads differ on the voice channel.
  • Your call, logged: an outbound call, outcome “answered”, stamped 01:31 UTC, on the patient’s timeline as touchpoint tp_mw2vd91u_86d09ab6057e, with the note “Phoned about proof run d6aafe; went fine.”
  • The marketing email: refused, with the reasons do_not_market, objected and no_marketing_consent. Voice and SMS are refused for marketing too, so no marketing channel is open to this patient.

What that got you: the appointment message goes out on a channel the consent record allows at that hour, the call is on the record, and the marketing message you were not allowed to send is stopped before anyone sends it.

Do it yourself

Section titled “Do it yourself”

The same checks from the CLI. Nothing here sends a message:

reach a contact within consent 
quox contacts search <name>quox contacts resolve <email>quox contacts best-channel <contact-id> --purpose servicequox contacts timeline <contact-id>

How it is checked

Section titled “How it is checked”

The proof engine asked the question through chat and judged each step against what ContactsQ reports:

  • the answer named the contact that quox contacts resolve returns;
  • the answer named the channel that quox contacts best-channel --purpose service returns;
  • after the turn, quox contacts timeline showed the call logged for this run;
  • the answer refused the marketing email, and never claimed a marketing message was sent or raised an approval for one;
  • no shell command ran.

All checks passed, in order.

Receipts

Section titled “Receipts”

The run is public at ev_mw2vct7k_14fd57, recorded on 5 November 2026. The receipt is the evidence, not this page.

The evidence bundle for the published run (ev_mw2vct7k_14fd57) is yours to download and check: every step, check and tool with its verdict, the CLI record each step was judged against where it read one (host names replaced by their role) and the transcript above. Save it with the verifier, index.json and index.receipt.json, then run node verify-journey-bundle.mjs ev_mw2vct7k_14fd57.json. It passes only if the bundle is the copy we published and witnessed, unchanged.

The proof engine rates this Journey OBSERVED: it has passed once. One pass is an observation, not a track record.

Quox-verified, not independently audited: the run was checked by Quox’s own proof engine against the running system, and the evidence id is published so you can recompute it. It is not a third-party audit.