govoplan/docs/architecture/ASSISTED_AND_NON_DIGITAL_CHANNELS.md

# Assisted and Non-Digital Channels

## Purpose

GovOPlaN must support people who cannot or do not use a self-service portal.
Telephone, paper, in-person service, authorized representation, mobile staff,
interpreters, and temporary offline work are not exceptional side systems.
They are governed channels into the same service, case, workflow, record, and
decision.

The goal is equivalent institutional treatment, not forced channel identity.
The system preserves which channel was used and which evidence is available
without giving digitally confident users stronger substantive rights.

The first end-to-end journey is tracked in
[GovOPlaN #42](https://git.add-ideas.de/GovOPlaN/govoplan/issues/42).

## Actor Model

Every assisted interaction distinguishes:

- the affected person or organization;
- the real staff member or external helper entering information;
- the represented party and representation basis;
- an interpreter, witness, guardian, or support person where relevant;
- the responsible institutional function;
- the channel and location;
- the person who reviewed or confirmed the captured information.

"Entered by" is not "declared by". "Declared by" is not "verified by".
Authentication assurance, representation authority, and evidence quality are
separate fields.

## Channel-Neutral Intake Contract

All channels create the same versioned service/form submission contract with
additional provenance:

- service, form, schema, language, and accessibility version;
- valid and recorded time;
- channel (`portal`, `counter`, `telephone`, `paper`, `email`, `mobile`,
  `representative`, `offline_import`, or configured extension);
- affected and represented parties;
- capture actor and responsible function;
- consent, notice, purpose, legal basis, and information source;
- field-level source and confidence where staff transcribed or inferred data;
- attachments, scans, originals, signatures, recordings, and attestations as
  governed evidence references;
- read-back/confirmation result and correction path;
- receipt and chosen return channels;
- duplicate/matching assessment and any manual resolution.

Forms Runtime owns the submission lifecycle. Parties owns procedural capacity
and representation. Identity/Addresses own subject and contact references.
Cases owns the matter. Records owns filing and retention. Audit preserves the
action/effect evidence.

## Assisted Session

An assisted session is a resumable work item, not a privileged bypass. It:

1. selects service, language, channel, affected party, and represented capacity;
2. shows the staff member only fields and evidence relevant to the service;
3. explains why sensitive data is requested and what evidence quality is
   required;
4. records source per value when information comes from speech, paper, an
   existing register, or staff observation;
5. validates and previews consequences before submission;
6. supports read-back, correction, confirmation, and a second-person check
   where policy requires it;
7. generates an accessible receipt through the requested channel;
8. creates follow-up tasks when original documents, signatures, translation,
   or verification remain outstanding.

The first executable slice is implemented in Forms Runtime for authenticated
assisted sessions. Administrators enable an exact published Form revision;
operators then record channel, party and representation references, authority,
purpose, notice, responsible function, language, accessibility needs, and
field-level source/confidence provenance. Read-back outcomes are append-only and
payload-bound. A draft correction changes the Form revision and invalidates the
prior confirmation for submission. The resident-parking-permit fixture proves
resume and submission enforcement; browser accessibility and target archive
evidence remain acceptance work.

The helper's normal account and represented function remain in the audit
chain. Assistance never grants access to unrelated records about the person.

## Paper And Scanning

- Register receipt before scanning so custody and deadlines do not depend on
  successful OCR.
- Store the original scan or external archive reference with digest, pages,
  capture device/provider, time, operator, and quality assessment.
- Treat OCR and extracted fields as derived data with confidence and source
  coordinates. A person confirms consequential values.
- Support separation, ordering, missing-page, duplicate, malware, and
  readability review.
- File the resulting document and submission into the appropriate eAkte;
  retain or return the physical original according to policy.
- Produce cover sheets, barcodes, and return instructions through Templates,
  not a separate print domain.

## Telephone And In-Person Handling

- Show a scripted but adaptable interview from the same Form definition.
- Record how identity and representation were checked; do not equate caller ID
  with identity proof.
- Require explicit confirmation of consequential declarations and capture the
  method (read-back, signed summary, one-time code, witness, later letter).
- Record call audio only when a lawful, declared profile permits it; an
  interaction note is the default.
- Make interrupted sessions resumable without exposing prior answers to an
  unauthorized caller or visitor.

## Offline And Mobile Work

Offline packages are encrypted, device-bound, time-limited, purpose-limited,
and contain only the required forms/reference data. Synchronization uses
idempotent intents and exposes conflicts rather than last-write-wins. Device
loss, expiry, revocation, duplicate submission, clock drift, and outcome
unknown have explicit recovery paths.

## Outbound Non-Digital Delivery

Campaign and Postbox model one delivery intent with channel choices and policy:

- portal/postbox delivery;
- email;
- print and postal fulfillment through a managed provider or local handoff;
- in-person collection;
- telephone notification followed by durable confirmation;
- accessible or language-specific variants.

Distribution preferences are purpose- and service-specific, effective-dated,
and may be overridden only by a documented legal or urgent-delivery rule. A
fallback occurs only before a channel has accepted the effect unless policy
explicitly authorizes duplicate delivery. Receipts distinguish creation,
provider acceptance, dispatch, delivery, return, and acknowledgement.

## Accessibility And Equality

- The person can request language, easy-language, large-print, screen-reader,
  sign-language, relay, interpreter, or representative support without those
  preferences becoming a general-purpose profile visible everywhere.
- Staff interfaces support keyboard-only capture, clear focus, error summary,
  read-back, and printable/offline alternatives.
- Channel choice and need for assistance must not be used as an adverse risk
  signal.
- Reports compare completion, wait, correction, abandonment, and outcome by
  channel only under a declared equality/service-quality purpose and with
  privacy thresholds.

## Security And Abuse Controls

- purpose-aware field access and session timeout;
- current authority checks for every read and effect;
- dual control for high-risk identity, payment, address, or representation
  changes;
- immutable source/attestation evidence and correction history;
- rate and anomaly controls that do not silently reject a person;
- explicit safe handling of domestic-abuse, protected-address, witness, or
  sealed-record cases;
- no secret answers or full documents in ordinary operational logs.

## First Reference Journey

Implement the permit-to-payment/service-to-decision journey through three
equivalent starts:

1. self-service portal submission;
2. staff-assisted counter/telephone submission;
3. paper receipt, scan, extraction, confirmation, and filing.

All three must create the same Case and Workflow contract, preserve different
provenance, support correction, produce a receipt, file an eAkte, reach the same
decision rules, and prove accessibility, privacy, recovery, and channel
fallback in browser and operator tests.