govoplan/docs/architecture/ASSISTED_AND_NON_DIGITAL_CHANNELS.md

Assisted and Non-Digital Channels

Purpose

GovOPlaN must support people who cannot or do not use a self-service portal. Telephone, paper, in-person service, authorized representation, mobile staff, interpreters, and temporary offline work are not exceptional side systems. They are governed channels into the same service, case, workflow, record, and decision.

The goal is equivalent institutional treatment, not forced channel identity. The system preserves which channel was used and which evidence is available without giving digitally confident users stronger substantive rights.

The first end-to-end journey is tracked in GovOPlaN #42.

Actor Model

Every assisted interaction distinguishes:

• the affected person or organization;
• the real staff member or external helper entering information;
• the represented party and representation basis;
• an interpreter, witness, guardian, or support person where relevant;
• the responsible institutional function;
• the channel and location;
• the person who reviewed or confirmed the captured information.

"Entered by" is not "declared by". "Declared by" is not "verified by". Authentication assurance, representation authority, and evidence quality are separate fields.

Channel-Neutral Intake Contract

All channels create the same versioned service/form submission contract with additional provenance:

• service, form, schema, language, and accessibility version;
• valid and recorded time;
• channel (portal, counter, telephone, paper, email, mobile, representative, offline_import, or configured extension);
• affected and represented parties;
• capture actor and responsible function;
• consent, notice, purpose, legal basis, and information source;
• field-level source and confidence where staff transcribed or inferred data;
• attachments, scans, originals, signatures, recordings, and attestations as governed evidence references;
• read-back/confirmation result and correction path;
• receipt and chosen return channels;
• duplicate/matching assessment and any manual resolution.

Forms Runtime owns the submission lifecycle. Parties owns procedural capacity and representation. Identity/Addresses own subject and contact references. Cases owns the matter. Records owns filing and retention. Audit preserves the action/effect evidence.

Assisted Session

An assisted session is a resumable work item, not a privileged bypass. It:

1. selects service, language, channel, affected party, and represented capacity;
2. shows the staff member only fields and evidence relevant to the service;
3. explains why sensitive data is requested and what evidence quality is required;
4. records source per value when information comes from speech, paper, an existing register, or staff observation;
5. validates and previews consequences before submission;
6. supports read-back, correction, confirmation, and a second-person check where policy requires it;
7. generates an accessible receipt through the requested channel;
8. creates follow-up tasks when original documents, signatures, translation, or verification remain outstanding.

The first executable slice is implemented in Forms Runtime for authenticated assisted sessions. Administrators enable an exact published Form revision; operators then record channel, party and representation references, authority, purpose, notice, responsible function, language, accessibility needs, and field-level source/confidence provenance. Read-back outcomes are append-only and payload-bound. A draft correction changes the Form revision and invalidates the prior confirmation for submission. The resident-parking-permit fixture proves resume and submission enforcement; browser accessibility and target archive evidence remain acceptance work.

The helper's normal account and represented function remain in the audit chain. Assistance never grants access to unrelated records about the person.

Paper And Scanning

• Register receipt before scanning so custody and deadlines do not depend on successful OCR.
• Store the original scan or external archive reference with digest, pages, capture device/provider, time, operator, and quality assessment.
• Treat OCR and extracted fields as derived data with confidence and source coordinates. A person confirms consequential values.
• Support separation, ordering, missing-page, duplicate, malware, and readability review.
• File the resulting document and submission into the appropriate eAkte; retain or return the physical original according to policy.
• Produce cover sheets, barcodes, and return instructions through Templates, not a separate print domain.

Telephone And In-Person Handling

• Show a scripted but adaptable interview from the same Form definition.
• Record how identity and representation were checked; do not equate caller ID with identity proof.
• Require explicit confirmation of consequential declarations and capture the method (read-back, signed summary, one-time code, witness, later letter).
• Record call audio only when a lawful, declared profile permits it; an interaction note is the default.
• Make interrupted sessions resumable without exposing prior answers to an unauthorized caller or visitor.

Offline And Mobile Work

Offline packages are encrypted, device-bound, time-limited, purpose-limited, and contain only the required forms/reference data. Synchronization uses idempotent intents and exposes conflicts rather than last-write-wins. Device loss, expiry, revocation, duplicate submission, clock drift, and outcome unknown have explicit recovery paths.

Outbound Non-Digital Delivery

Campaign and Postbox model one delivery intent with channel choices and policy:

• portal/postbox delivery;
• email;
• print and postal fulfillment through a managed provider or local handoff;
• in-person collection;
• telephone notification followed by durable confirmation;
• accessible or language-specific variants.

Distribution preferences are purpose- and service-specific, effective-dated, and may be overridden only by a documented legal or urgent-delivery rule. A fallback occurs only before a channel has accepted the effect unless policy explicitly authorizes duplicate delivery. Receipts distinguish creation, provider acceptance, dispatch, delivery, return, and acknowledgement.

Accessibility And Equality

• The person can request language, easy-language, large-print, screen-reader, sign-language, relay, interpreter, or representative support without those preferences becoming a general-purpose profile visible everywhere.
• Staff interfaces support keyboard-only capture, clear focus, error summary, read-back, and printable/offline alternatives.
• Channel choice and need for assistance must not be used as an adverse risk signal.
• Reports compare completion, wait, correction, abandonment, and outcome by channel only under a declared equality/service-quality purpose and with privacy thresholds.

Security And Abuse Controls

• purpose-aware field access and session timeout;
• current authority checks for every read and effect;
• dual control for high-risk identity, payment, address, or representation changes;
• immutable source/attestation evidence and correction history;
• rate and anomaly controls that do not silently reject a person;
• explicit safe handling of domestic-abuse, protected-address, witness, or sealed-record cases;
• no secret answers or full documents in ordinary operational logs.

First Reference Journey

Implement the permit-to-payment/service-to-decision journey through three equivalent starts:

1. self-service portal submission;
2. staff-assisted counter/telephone submission;
3. paper receipt, scan, extraction, confirmation, and filing.

All three must create the same Case and Workflow contract, preserve different provenance, support correction, produce a receipt, file an eAkte, reach the same decision rules, and prove accessibility, privacy, recovery, and channel fallback in browser and operator tests.