Cabinet Resolution 56/2024, applied to real-estate outbound.

Why this matters. And why nobody wants to touch it

Buyer callbacks from Bayut and Property Finder are inbound. the owner initiated the interaction, so it falls outside the telemarketing rules. That's the easy half of proptech AI, and it's where every wrapper is competing.

Cold outreach to a property owner who never enquired, the actual sourcing activity that fills a brokerage's inventory pipeline, is outbound telemarketing under UAE law. It's regulated. It requires TDRA-registered numbers, an approved calling window, a DNCR check, permission before marketing, and a complaint-handling record. Get it wrong and RERA can suspend the brokerage.

That's why the supply side of the market is empty. And that's the wedge. But only if you can prove your controls are real.

Cabinet Resolution 56/2024 in sixty seconds

The Resolution consolidates rules across TDRA (telecoms) and the Central Bank / RERA sector regulators. For a real-estate outbound call the load-bearing obligations are:

1. Register the DID with TDRA and only call from an approved number.
2. Call only within the approved window (09:00–18:00 GST).
3. Screen against the National Do-Not-Call Registry before every dial.
4. State the caller's identity and the reason for the call up front.
5. Disclose that the call is recorded, before any marketing content.
6. Ask permission before proceeding.
7. Honour a removal request in real time and permanently.
8. Cap contact frequency: one call per owner per 20-hour rolling window across all campaigns.
9. Never call a number that has already opted out, for any reason, in any campaign.
10. Keep a per-call audit trail the regulator can subpoena.

A large-language model can be prompted to say the right things. It cannot be trusted to enforce any of the ten items above. That is the design brief.

Where the LLM decides nothing

The single most important invariant of this architecture is that the LLM cannot be the last thing between a controlled action and the caller. Every regulated decision is made in Postgres and reviewed against a check constraint before the call ever begins:

• -- who to call: selected by claim_due_calls(), a SQL function that only returns rows that pass the window / DNCR / suppression / 20-hour / whitelist gates.
• -- when to call: the calling window is checked against organizations.timezone in SQL, at claim time. If the LLM tries to schedule a callback outside the window, the row is rejected before it reaches the dialer.
• -- what to say first: the opening sentence is a locked template. Its SHA-256 hash is asserted on every deploy. Legal changes to this line require a code review, a hash bump, and a CODEOWNERS approval, not a prompt edit.
• -- what to do on removal: the “remove me” response is a state-machine terminal state (suppress_and_end); the row is inserted into a workspace-scoped suppression table with RLS, and every future claim_due_calls() filters it out. There is no path back.

The state machine

A single-prompt LLM is a bag of instructions. It can skip a step, answer an objection in the wrong stage, or fire end_call mid-qualification if the owner sounds annoyed. A state machine cannot. Andrew, the reference agent, runs on seven explicit states with enumerated transitions:

opening ─permission_yes─▶ qualification ─ready─▶ handoff ─booked─▶ recap ─▶ end_call_tool
   │                            │                   │
   │─permission_no─▶ soft_bow   │─not_interested─▶ objection_handling ─recovered─▶ qualification
   │                            │                                     └─final_no─▶ suppress_and_end
   └─(intent: robot / how_got_number / remove_me at any point)──▶ objection_handling

Every non-terminal state has an unconditional edge to objection_handling . The compliance objections always reachable. Return edges are enumerated per source state so an owner who asks “where did you get my number?” mid-qualification cannot end up accidentally in the handoff state. The end_call_tool itself is scoped only to the three terminal states, so the model cannot hang up during qualification.

The three locked handlers

These are the responses that must never be paraphrased, softened, or improvised on. The state prompt embeds them verbatim; a unit test on every build asserts they appear character-for-character in the compiled prompt sent to the voice provider.

The dialer gate

This is the function the dialer must call before every outgoing call. If it returns zero rows, no call is placed. regardless of what the LLM, the dashboard, the API, or the campaign owner would prefer.

-- claim_due_calls(org, campaign) - simplified
select o.id, o.phone_e164
from   owners o
join   campaigns c    on c.id = $2 and c.org_id = $1
where  now() at time zone o.timezone
       between (date_trunc('day', now()) + interval '9 hours')
           and (date_trunc('day', now()) + interval '18 hours')  -- window
  and  not exists (select 1 from suppression s
                   where s.org_id = $1 and s.phone_e164 = o.phone_e164)  -- opted-out
  and  not exists (select 1 from calls k
                   where k.owner_id = o.id
                     and k.created_at > now() - interval '20 hours')     -- 20h cap
  and  (c.is_demo = false
        or o.phone_e164 = any(c.demo_whitelist))                          -- demo mode
  and  o.phone_e164 not in (select number from dnc_registry)              -- DNCR
order  by random()
for update skip locked
limit  $3;

The audit trail

A regulator does not want a marketing slide about compliance. They want a per-call trace they can subpoena. Every EstateCaller call writes rows in five tables that together answer the questions RERA / TDRA are trained to ask:

What this doesn't cover

Two honest caveats worth stating. The reference implementation covers what happens between placing a call and closing it. It does not, on its own, solve:

• Carrier reputation. A UAE-mobile recipient may still see “Spam Likely” on a US-registered DID, regardless of your controls. The mitigation is bring-your-own-SIP via the brokerage's registered local operator (Etisalat / du), supported, but a client setup step.
• PDPL data residency. Recordings and transcripts contain personal data. The default deployment stores them in Supabase's Middle East region; brokerages with stricter data-residency policies can configure a local Postgres deployment behind the same API.

How to evaluate this

The fastest way to pressure-test the controls is to try to break them. On the live browser demo you can:

• Ask “where did you get my number?”. The removal offer is spoken verbatim, then the turn ends.
• Say “remove me”. The call terminates and the number is written to the suppression table.
• Ask “are you an AI?”. The agent confirms it without softening.
• Try to push the agent into skipping qualification. The state machine will not allow the transition.