Three redacted prompts.
The disclosure layer behind each one.
A feature, not a tax — the disclosure layer ships on every build.
Compliance posture is part of the build on Routelet — not a subscription you bolt on after launch, not "a course that keeps you safe." The same controls the audit memo writes in plain terms (data provenance legible in the n8n workflow, EU AI Act Art. 14 human-oversight gating, a memo the ledgers can defend to a regulator) land on every prompt on this page before the workflow ships. Three prompts, three disclosures, one shape.
Every card below names the disclosed fields in three columns — input classification, model/version stamp, operator override hook — and a short "why this exists" note that ties each field back to the regulator-facing audit trail. Bring your own content to the audit and we walk through the disclosure layer together.
One prompt per leak. One disclosure envelope per prompt.
Each prompt below is one of the workflows Routelet ships most often — the lead triage, the customer-reply rewrite, the review queue. Every card names the disclosed field on the response envelope (input classification, model/version stamp, operator override hook) and a short "why this exists" note that ties the shape to the EU AI Act / FTC line the audit memo defends.
~$14/lead answering service → $0/lead agent
// POST /triage
// REDACTED — operator args and tool bindings replaced
{
"input": {
"channel": "missed_call", // missed_call | web_form | referral
"service_zip": "[REDACTED]",
"urgency": "[REDACTED]"
},
"controls": {
"input_classification": "lead_type",
"model_version_stamp": true,
"operator_override_hook": "escalate_only"
},
"output": {
"decision": "[queued | page_on_call | schedule_callback | no_service]",
"envelope": {
"lead_type": "...",
"model_version": "...",
"escalation_channel": "...",
"auto_send": false
}
}
}Disclosure fields on every envelope
- input classification
- lead_type tag on the response envelope: missed_call | web_form | referral — the kind label the audit trail reads first.
- model/version stamp
- provider + model + build date embedded in the response envelope so a regulator can re-walk the decision later.
- operator override hook
- escalate_only flag + an escalation_channel key on every output — the agent never auto-sends, it routes to the named operator.
A leaked after-hours lead becomes a regulator-visible AI decision the moment a model triages it. Classification, version, and an escalation channel are the three fields an EU AI Act audit looks for before content does — each one is on the envelope before the workflow ships, not bolted on after.
~3 min draft → owner-approved send
// POST /reply-rewrite
// REDACTED — operator args and tone references replaced
{
"input": {
"thread_id": "[REDACTED]",
"owner_voice_seed": "[REDACTED]",
"policy_overrides": ["[REDACTED]", "[REDACTED]"]
},
"controls": {
"input_classification": "customer_visible",
"model_version_stamp": true,
"operator_override_hook": "await_owner_approval"
},
"output": {
"draft": "[REDACTED]",
"envelope": {
"intent_class": "customer_visible",
"model_version": "...",
"approval_state": "awaiting_owner_tap",
"auto_send": false
}
}
}Disclosure fields on every envelope
- input classification
- customer_visible tag on the envelope — Art. 14 human-oversight is set to escalate before the reply drafts, not after.
- model/version stamp
- provider + model + build date on every response envelope so the named operator can re-walk the draft on the cover window.
- operator override hook
- await_owner_approval: true default — the reply drafts, never sends; the owner reads it, taps yes, the workflow sends.
FTC endorsement-rule + EU AI Act Art. 14 require the operator (the owner) to sign their name on AI-written customer-facing reply. The override hook is the evidence trail that they did — without it, the workflow is a phantom sender and the operator is exposed the moment a review asks who wrote the message.
<4h drafted reply vs 2-week lag
// POST /review-response
// REDACTED — operator args and tone references replaced
{
"input": {
"review_id": "[REDACTED]",
"channel": "google", // google | yelp | thumbtack | other
"stars": "[REDACTED]",
"body": "[REDACTED]",
"claims": ["[REDACTED]"]
},
"controls": {
"input_classification": "public_review",
"model_version_stamp": true,
"operator_override_hook": "one_tap_approve"
},
"output": {
"draft": "[REDACTED]",
"envelope": {
"input_class": "public_review",
"fact_check_flag": "(set if review names a date or price)",
"model_version": "...",
"approval_state": "awaiting_owner_tap",
"auto_post": false
}
}
}Disclosure fields on every envelope
- input classification
- public_review tag on the envelope; a fact_check flag flips on when the review names a date or price the model is restating — escalation triggers before reply.
- model/version stamp
- provider + model + build date on every response envelope so the cover-window review can re-walk a disputed draft.
- operator override hook
- one_tap_approve default — the response drafts, nothing posts without the named operator tapping yes; the evidence trail sits on the envelope, not in a separate tool.
FTC cases around AI-shaped review responses target the queue, not the words — a monotone star average drifts down because the lag is the bottleneck, and the audit trail only works if the override hook is on the envelope. The fix is the same shape as the other two prompts: classify the input, stamp the model/version, leave the send to the named operator.
The disclosure layer on every Routelet workflow.
Every prompt above carries three of the four layers below — the fourth covers the whole envelope. Together they form the boutique compliance posture: the same controls in writing before the contract, the same answer a cover-window review can defend.
Bring your own content to the audit — we walk through the disclosure layer together.
One 30-minute screen-share, three sample prompts walked end-to-end, and a two-page audit memo you can act on whether or not you hire us after. The shape above is the shape of the build — the audit call just tells us which one to put in the contract.
Three prompts, one disclosure layer, one posture. Compliance is part of the build, not a subscription — the boutique-vs-coach axis is the same shape the audit memo cites, and the named-operator cover window is the one that closes the loop.
Three prompts, one process. The free audit is the actual deliverable — the workflow that matches your audit memo just tells us what to put in the contract. Read the posture on /about, or send the brief straight to touchflow@polsia.app.
— Routelet · TouchFlow