> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deepblocker.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Before you test anyone: authorisation and consent

> Who must authorise a campaign, what consent a cloned voice and a member of staff need, and what the platform refuses to do.

A simulated scam call is still a call to a real person. DeepBlocker only places it when someone with authority has said so in writing, the people called are your own staff, and any cloned voice belongs to someone who agreed. This page explains each gate in plain words.

> [!WARNING]
>
> Calls go to your own staff only. Your licence does not allow calls to anyone outside your organisation.

## Who must authorise a campaign

Every campaign ends with an authorisation block on the **Authorise and launch** step. The server refuses to launch without it, so it cannot be skipped.

| Field | What to enter | Required |
| - | - | - |
| **Authorized by** | The full name of the person who approved this test | Yes |
| **Authorizer email** | Their work email | Yes |
| **Engagement / SOW reference** | Your own reference, for example a ticket or a statement of work number | No |

Below the fields are two tick boxes. Both must be ticked:

* **I understand that this campaign will initiate automated phone calls to the selected contacts and that all applicable TCPA regulations have been followed.**
* **I have reviewed all campaign settings and confirm they are correct. I understand that campaigns cannot be modified once launched.**

Some campaign kinds add one more tick:

| Campaign kind | Extra tick |
| - | - |
| Help desk test | **The help desk is in scope for this test**, plus a note naming the help desk and who agreed |
| Any campaign that sends a warm-up text or email | **Messages to staff phones and inboxes are in scope for this engagement.** |

The record is stored with the campaign and appears in the auditor pack. See [Authorise and launch](https://docs.deepblocker.ai/vishing/campaigns/authorise.md).

## Consent for a cloned voice

A voice is cloned only with the consent of its owner. The console records that consent in one of two ways.

> [accordion] An executive records their own consent
>
> On the **Voices** page, **Invite an executive** sends the person a one-use link by email. The link lasts 7 days. They read the consent text, record the consent sentence in their own voice, then record or upload about two minutes of speech. The clone is made only after that. From the same link they can withdraw later: the clone is deleted and every campaign using it is blocked. See [Clone an executive's voice with consent](https://docs.deepblocker.ai/vishing/executive-voice-consent.md).

> [accordion] You attest consent for another voice
>
> For a voice you cloned yourself, the **Attest consent** button records that you confirm the person agreed. The console shows the words: **Confirm this person consented, so campaigns can call with this voice.** A voice with no consent cannot be used in a campaign.

Your licence adds two rules: a voice is cloned for the named campaign only, and voice samples are treated as biometric data.

## Consent for the people you call

Each person in **People** carries consent fields. The CSV import has a `tcpaConsent` column, and the wizard only counts people whose consent is recorded. The fields are:

| Field | Values |
| - | - |
| Consent | Yes or no |
| Consent scope | Testing, training or awareness |
| Consent method | Written, verbal, imported or electronic |
| Opt-out | Yes or no, with a date |
| Do not call until | A date |

See [Add the people you will call](https://docs.deepblocker.ai/vishing/people.md). The [Fair testing rules](https://docs.deepblocker.ai/vishing/fair-testing.md) page adds cooling-off days, quiet hours and a limit on calls per quarter.

## What the platform refuses

* A launch with no named authoriser, no authoriser email, or an unticked box.
* A campaign whose voice has no recorded or attested consent.
* A call to a person with no consent, an opt-out, or a do-not-call date in the future.
* A launch when the workspace kill switch is on. See [Pause, resume, stop everything](https://docs.deepblocker.ai/vishing/controls.md).
* A launch when the workspace has no simulated-call minutes left. See [When you run out](https://docs.deepblocker.ai/vishing/minutes-exhausted.md).

> [!NOTE]
>
> A simulation measures how people respond on the day. It does not promise to find every weakness. This is written into your licence, and it is true.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.