The agent on the telephone
Three weeks after cataract surgery, thousands of NHS patients take a phone call from Dora, an autonomous clinical assistant built by Oxford spin-out Ufonia. It asks about the five symptoms that matter and recommends discharge or a clinician callback. It acts alone, inside a boundary drawn by clinicians and licensed by published evidence.
Worked case · public-source reconstruction Autonomy: execute · the follow-up callWhy this case matters
The interesting choice is not giving an AI a phone line. It is the order of operations: a validation study in which an ophthalmologist supervised every call, peer-reviewed publication, a regulatory mark, and only then routine autonomy. Dora executes because the design proved it could, on the record, before it was allowed to act alone.
Why execute rather than prepare? Assign the rung to the action, not to the agent. Dora's consequential action here is the follow-up call itself: it places the call, holds the conversation, judges which symptoms matter and routes the outcome, with no person in the loop while it does so. That is execution. Confirming discharge is a separate action that sits lower, and it stays with a clinician. An agent that merely drafted the call for a person to make would sit at prepare; Dora makes the call. See the full autonomy ladder →
The case
Cataract surgery is one of the most common operations in the world, and most follow-up appointments confirm what everyone expected: the patient is fine. Those appointments still consume clinic slots, and the few patients who are not fine must be caught reliably. That is the workflow Dora handles. About three weeks after an uncomplicated operation, it telephones the patient and holds a natural conversation about the five symptom domains that matter: redness, pain, vision, new floaters, and flashing lights.
A clear call ends in a discharge recommendation, which a clinician reviews and signs off. Any flagged symptom routes to a clinician callback within 48 hours. In the validation study, run with an ophthalmologist supervising every call, Dora caught 93.75 percent of the patients who needed review, agreed with the supervising clinicians symptom by symptom, and completed 96.5 percent of calls without human help. In routine deployment across two NHS trusts, covering 1,636 consultations, only 0.3 percent of patients judged clear later needed an unplanned change in care.
Oxford University Hospitals went on to make Dora the default follow-up pathway for thousands of cataract patients and extended it toward pre-operative assessment; a third trust reports more than 2,100 calls and hundreds of nursing hours returned to patients. The design is why the autonomy holds: the loop is five questions wide, two outcomes deep, and a clinician on every discharge.
Why it matters
Execute-level agents usually alarm people because their loop is open: they can decide, act, and keep going. Dora's loop is closed. It conducts a real clinical conversation end to end, but it cannot prescribe, cannot book theatre time, and cannot do anything with a worrying answer except hand the patient to a human, fast. The autonomy is real, and so is the subtraction that makes it safe.
Read through the Agent Operating Model: cognition is the conversation; control is the protocol, the 48-hour callback rule, and clinician sign-off on every discharge; reach is a telephone and a structured summary. Power is the product of the three, and here each one was chosen, published, and regulated before the agent was trusted alone with a patient.
The filled canvas
The entries below are intentionally compact. A canvas should not read like a requirements document; it should make the load-bearing choices visible enough for a team to argue about them.
Worked example
What business outcome should this agent's work ultimately contribute to?
Return scarce ophthalmology capacity to the patients who need it by safely discharging routine cataract patients after surgery.
Which workflow is it part of, and what contribution is the agent responsible for making within it?
Workflow: follow-up about three weeks after uncomplicated cataract surgery. Role: conduct the routine post-operative review conversation and identify the patients who need a clinician to look again.
01Who uses it directly, and who else is affected by what it does?
Direct users: post-operative patients on the telephone, and the ophthalmology team receiving flags and summaries. Affected: waiting-list patients who gain the freed capacity, and the trusts.
02What measures will show that the workflow improved, and what performance standards must the agent meet?
Measures: sensitivity to patients needing review, and unplanned care after a clear call. Standards, published first: 93.75% sensitivity, 96.5% of calls unaided.
03What information may it use, and which sources should take priority when they disagree?
The cataract pathway and the five symptom domains that matter after surgery: redness, pain, vision, new floaters, and flashing lights. Restricted to uncomplicated surgeries by design.
07What should it remember across interactions, what must it forget, and how should it learn and improve over time?
Each call becomes a structured record in the patient's pathway. Improvement is audited in public: a supervised validation study first, then a published evaluation of deployment.
08Who owns the workflow outcome, who is accountable for how the agent operates, and how will it be reviewed?
Clinicians review every summary before discharge and call back every flagged patient; the trusts own the pathway; named investigators published the results that license the autonomy.
09What to notice
Full autonomy over a five-question call; zero autonomy beyond it. The rung is high precisely because the task is narrow.
Published sensitivity, clinician agreement, and a regulatory mark came before routine use. The standards were numbers on the record, not adjectives on a slide.
Any flagged symptom routes to a clinician, and emotionally complex situations are excluded on purpose. The boundary says what the agent must not try to handle.
The value is counted in clinician time returned to the patients who need it, and in missed problems that stay near zero, not in calls handled.
Coach audit
Not as an outside fact-checker, but as a clinical-operations lead preparing a governance review. Dora is the most autonomous agent in these cases and the most carefully bounded, and the coach still found a load-bearing gap in it. Here is what came back.
“Should some flags trigger urgent, same-day action rather than a 48-hour callback, and how would Dora tell them apart on the call?”The coach, on Rules & Boundaries (Cell 06)
Sources
Only public-source claims are treated as facts. The performance figures come from the two peer-reviewed evaluations; operational details beyond them should be read as design implications unless the trusts or Ufonia confirm them.
More worked cases