Read-Only or Write Access: Helpline AI Scope

Executive Summary

"Start read-only" is the standard advice for putting a voice layer in front of a grievance portal. It is sound, and it answers only the first question. The nodal grievance officer or state IT department that owns the portal still has to say what the layer may do after the pilot: register cases, add to them, route them, close them. Each is a separate permission with a separate owner.

Executive Callout Grant access in five tiers, not two: no record, read one case, create a case, append to a case, change a case's state. A voice layer should hold the first four at most. The fifth, disposal and closure, stays with the grievance officer, and the portal should enforce that with credentials. A line in a prompt is not enough. The designs here are recommendations, not measurements from any Indian deployment.

Introduction: Read-Only Is Not a Decision

A helpline today routes a call to a seat. The operator opens the portal, types the complaint or looks up the status, and reads the answer aloud. The operator's login is the integration, and it carries every permission the operator has, because a person is trusted to use them with judgement.

A voice layer has no such judgement to rely on. OWASP's list of risks for LLM applications calls the failure "excessive agency": "damaging actions" performed in response to "unexpected, ambiguous or manipulated outputs" from the model. Its three causes are excessive functionality, excessive permissions and excessive autonomy, and its remedy is to limit each to "the minimum necessary". MeitY's India AI Governance Guidelines aim at the same result: that AI systems "remain within defined bounds", with audit trails and monitoring in critical sectors.

For a grievance portal, the bounds are the integration scope. Earlier guides on the voice layer for an existing portal and on status calls put read access first. This one covers what comes after.

The Scope Ladder

Tier	The layer may	Example on a call	Standing grant?
0	Answer from the approved knowledge base; touch no record	Documents required, office hours, how to appeal	Yes, from day one
1	Read the caller's own case, through allow-listed fields	Stage, owning office, last action, next date	Yes, at pilot start
2	Create a new case in the system of record	Register a complaint; read the returned reference back	Yes, once Tier 1 has passed its tests
3	Append to an existing case; never overwrite	Add a missing document detail; log that the caller disputes a disposal; record a callback request	Yes, field by field
4	Change a case's state: route, answer, dispose, close, decide an appeal	Mark disposed; file the action-taken report	No. Officer only

Two points about the ladder. Tier 3 is append-only: the layer adds an entry labelled as system-originated, with the call ID, and cannot edit or delete what an officer or citizen wrote. And Tier 4 has a middle path. The layer may write a proposal, such as a suggested category or routing, into a field that does nothing until an officer accepts it. The officer then sees the layer's judgement without being bound by it.

AiSewak's call-centre automation page describes the same shape: status lookups over an API or a read-only connector, and complaints created in the system of record with the reference read back on the same call, "never a second register that has to be reconciled later".

What the Grievance Rules Reserve to an Officer

DARPG's Office Memorandum of 23 August 2024 on handling public grievances is guidance for CPGRAMS, and a state portal may follow its own rules. It still shows which actions carry a duty that an officer must answer for.

Closure carries obligations. After redressal the Grievance Redressal Officer (GRO) "shall file a detailed Action Taken Report" (para 7.3), must upload the document relied on, and must give "valid and speaking reason" when a request is not accepted (para 7.4).
Some closures are barred. No grievance may be closed by stating that it does not pertain to the receiving office; efforts "shall be made to transfer" it to the right authority (para 7.1). Closing a grievance because a document is missing is flagged as a problem, since the portal has a mechanism to ask the citizen for it (para 7.2).
Disposal is not the end. A disposed grievance is treated as closed unless the citizen files an appeal, and then only after the appeal is disposed of (para 7.5). Appellate authorities must examine appeals "independently" (para 6).
Timelines need judgement. The advised maximum is 21 days, with an interim reply where longer is needed (para 5.1).

Every one of these is a Tier 4 action. A layer that can write "disposed" has been handed a duty with no one accountable for it. Tier 3 covers the useful part: the layer can collect the missing information that para 7.2 says the GRO may seek, and attach it to the case.

Enforce the Limit in the System, Not the Prompt

The prompt tells the model what it should do. The credential decides what it can. Five controls turn the ladder into something a contract can test.

One credential per tier. Read and write use separate service accounts, so the department can revoke write access without stopping status calls.
Endpoints named, not queries. The layer calls "get status for this reference" and "create case". It gets no tool that runs a free-form query or edits arbitrary fields. Fields returned follow how well the caller was identified, as in the status call matrix.
Idempotent creation. A line that drops mid-registration and is redialled must not produce two cases. The call ID serves as the dedupe key.
No reference, no claim. The layer says "registered" only after the portal returns a reference. If the portal times out, it says so and logs a callback request.
A kill switch the department holds. Revoking the write credential must not need the vendor's cooperation.

The portal, not the model, should decide whether a given call is allowed. OWASP's guidance is to implement authorisation in the downstream system and not rely on the model to police itself.

Controls the Rules Already Ask For

Once the layer touches personal data, several obligations follow, whatever its tier.

Control	Source	Applies
Encrypt, mask or tokenise personal data	DPDP Rules, rule 6(1)(a)	Rules 3 and 5 to 16 commence 13 May 2027
Control access to the systems that process it	Rule 6(1)(b)	Same
Keep logs, monitor and review who accessed data	Rule 6(1)(c)	Same
Retain those logs and data for one year, unless another law requires otherwise	Rule 6(1)(e)	Same
Put security safeguards in the contract with a processor	Rule 6(1)(f)	Same
Enable ICT logs, keep them 180 days within India, report cyber incidents within 6 hours	CERT-In directions, 28 April 2022, under section 70B(6) of the IT Act	Service providers, data centres, body corporate and Government organisations

The DPDP Act is only partly in force. The Rules' text, rule 1(4), brings rules 3, 5 to 16, 22 and 23 into force eighteen months after the 13 November 2025 gazette, which is 13 May 2027. The CERT-In directions are already issued. Which party is the Data Fiduciary, and which a processor, is for the department's counsel. The practical point is that each Tier 1 read and each Tier 2 or 3 write generates a log line. A vendor default that keeps those for 30 days fails both periods.

What Changes in the Helpline's Workflow

The buyer is the department or state IT unit that owns the portal, and the grievance cell that works in it. The change is in who holds what permission.

	Today	After
Who looks up a status	An operator in the portal	The layer, Tier 1; the operator takes exceptions
Who registers a phone complaint	An operator, typing	The layer, Tier 2; reference read back
Who adds a missing detail	The operator, or the GRO by calling	The layer, Tier 3, labelled with the call ID
Who disposes	The GRO	The GRO. Unchanged
What the vendor holds	Nothing; no integration	Named credentials, named endpoints, log retention terms
What the contract specifies	Seat count, answer rate	Tiers granted, endpoints, revocation, log period

The GRO's inbox now contains entries the GRO did not type. Flag them, show the call ID, and let the GRO filter them, or the first week will produce complaints about phantom edits.

Tests Before Widening Scope

Run each test against the API logs. A transcript shows what the layer said, and the log shows what it did.

Wrong-caller test. Quote someone else's reference. The layer discloses only what the matched-caller rules allow.
Overreach test. In each language, ask it to close, delete, re-categorise or "mark solved" a case. No write call may appear in the log.
Redial test. Drop the line mid-registration and call back. One case exists.
Portal-down test. Take the endpoint offline. The layer must not say "registered".
Revocation test. Revoke the write credential. Status calls continue.
Reconstruction test. Take one call and rebuild, from logs alone, who called, which endpoint, which record, and when.

Tier n+1 opens only when tier n passes and the nodal officer signs. The pass thresholds belong in the pilot plan, written before launch. Repeated failures at one tier are also an input to the quality audit.

Risks and Mitigation

Risk	Mitigation
The write credential is broader than the tier granted	List endpoints and fields in the contract; review at each tier change
Duplicate cases from redialled calls	Call ID as dedupe key; the redial test
Stale nightly extract reports a case as open	State the extract's age to the caller; use live reads for same-day action
Officers distrust entries they did not type	Flag system-originated entries; show the call ID and transcript
Vendor logs expire before the review period	Contract the retention period; check it against rule 6(1)(e) and the CERT-In period
Pressure to "just let it close the easy ones"	Closure is a Tier 4 duty; offer the proposal queue instead

Key Takeaways

Read-only versus write is five decisions, not two. Name the tier for every integration.
The layer stops at Tier 3 on a standing basis. Disposal, closure and appeal decisions stay with the officer.
Enforce the tier with credentials, named endpoints and revocation. A prompt is not a control.
Judge the layer by its API logs, not its transcripts.
Each tier opens by test, not by calendar.

Conclusion

A department does not need to decide how much of its portal an AI may touch before starting. It needs the list of actions its officers take today, a tier for each, and a signature from the nodal officer. That turns "the AI will integrate with our portal" into a scope a contract can state and a log can verify.

Government leaders exploring AI-powered citizen engagement can begin with a focused pilot in one department or constituency to validate impact before scaling statewide. Aisewak helps public institutions deploy multilingual Voice AI solutions designed specifically for Indian governance. For a layer that sits beside a portal you already run, the AI call centre automation for government page sets out the integration decisions in order.

FAQ

Should an AI voice agent have read-only or write access to a government portal?

Neither alone. Read one case at first, then create cases, then append to them, each after tests. Changing a case's state, meaning routing, disposal, closure and appeals, should stay with the officer.

Can an AI voice agent register a complaint on CPGRAMS or a state portal?

Technically, that depends on the interface the portal exposes to third parties, which this guide has not verified for any specific portal. As a design, creation is the lowest-risk write because it adds a case and changes none. The reference must come back from the portal before the layer says "registered".

Why not let the agent close simple complaints?

DARPG's guidelines attach duties to closure: an Action Taken Report, a relied-upon document and a speaking reason where a request is declined. They also leave a disposed case open to appeal. Those duties sit with the GRO, so closure is an officer's act.

What is the difference between appending and editing a case?

Appending adds a labelled entry and leaves everything already recorded untouched. Editing changes or deletes existing fields. A layer limited to appending cannot silently alter what a citizen or officer wrote.

How do we stop the AI doing more than we granted?

Enforce it in the portal. Give the layer separate credentials per tier, expose named endpoints and no free-form queries, and let the department revoke write access on its own. Then test it by asking the layer to overreach and checking the API log.

What logs should we require from the vendor?

A log line for every read and write: call ID, caller match level, endpoint, record, time and result. The DPDP Rules, once in force on 13 May 2027, ask for access logs retained for a year under rule 6(1)(e). CERT-In's 2022 directions ask for ICT logs held 180 days within India.

Is the DPDP Act in force for these integrations?

Only partly. The consent and penalty sections and rules 3 and 5 to 16 commence on 13 May 2027. Design to them now, and have the department's counsel confirm how they apply to the grievance function.

How long does it take to move from read-only to write access?

No benchmark exists for this in an Indian grievance cell, and this guide offers none. Set the criteria before the pilot, and let the test results, not a calendar date, open each tier.

Schema Markup Suggestions

Article: headline, description, datePublished and dateModified of 2026-10-28, publisher AiSewak.
FAQPage: the eight Q&A pairs above.
Table: the scope ladder, controls and workflow tables, stated as design guidance and not as measurements.

Suggested External References

OWASP GenAI Security Project, LLM06:2025 Excessive Agency — genai.owasp.org, definition, three causes and least-privilege guidance, read 28 October 2026
MeitY, India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation — static.pib.gov.in, 5 November 2025, audit trails and human-in-the-loop recommendations, read 28 October 2026
DARPG, Office Memorandum on handling public grievances, 23 August 2024 — pgportal.gov.in, paras 5.1, 6, 7.1 to 7.5 and 8.1, read 28 October 2026
MeitY, Digital Personal Data Protection Rules, 2025 — meity.gov.in, rules 1(4) and 6, read 28 October 2026
CERT-In, Directions under sub-section (6) of section 70B of the IT Act, 28 April 2022 — cert-in.org.in, six-hour reporting and 180-day logs, read 28 October 2026

"Start read-only" answers the first question about putting AI in front of a grievance portal. A guide for nodal officers on the next one: five access tiers, what stays with the officer, and the log-based tests that open each tier.

LinkedIn Executive Summary

Most plans for adding an AI voice layer to a grievance portal say "read-only first". They stop there, and the harder decision comes after the pilot: may the layer register a case, add to one, route it, close it?

Those are separate permissions. This guide sorts them into five tiers. The layer holds the first four at most. Disposal, closure and appeal decisions stay with the Grievance Redressal Officer, because DARPG's guidelines attach duties to them: an Action Taken Report, a relied-upon document, a speaking reason, a path to appeal.

The limit has to live in the portal. Separate credentials per tier, named endpoints instead of free-form queries, a revocation switch the department holds, and tests judged on API logs rather than transcripts. The DPDP Rules on security safeguards commence on 13 May 2027, and CERT-In's log-retention directions already apply.

This is a design guide, not a report from a deployment. It gives a nodal officer a scope a contract can state and a log can verify.

AI Search Optimization Summary

Entities: DARPG, CPGRAMS, Grievance Redressal Officer, Action Taken Report, MeitY, India AI Governance Guidelines, DPDP Act, DPDP Rules 2025, CERT-In, OWASP, Aisewak

Topics: AI voice agent access to government systems, read-only versus write integration, least privilege for AI agents, grievance portal API scope, who may close a grievance, audit logs for AI agents in government

Semantic keywords: scope ladder, append-only entries, proposal queue, credential per tier, idempotent case creation, call ID dedupe key, revocation switch, excessive agency, system-originated entries, log retention period