The agent on the telephone
Three weeks after cataract surgery, thousands of NHS patients take a phone call from Dora, an autonomous clinical assistant built by Oxford spin-out Ufonia. It asks about the five symptoms that matter and recommends discharge or a clinician callback. It acts alone, inside a boundary drawn by clinicians and licensed by published evidence.
Design-before-build caseWhy this case matters
The interesting choice is not giving an AI a phone line. It is the order of operations: a validation study in which an ophthalmologist supervised every call, peer-reviewed publication, a regulatory mark, and only then routine autonomy. Dora executes because the design proved it could, on the record, before it was allowed to act alone.
The case
Cataract surgery is one of the most common operations in the world, and most follow-up appointments confirm what everyone expected: the patient is fine. Those appointments still consume clinic slots, and the few patients who are not fine must be caught reliably. That is the workflow Dora owns. About three weeks after an uncomplicated operation, it telephones the patient and holds a natural conversation about the five symptom domains that matter: redness, pain, vision, new floaters, and flashing lights.
A clear call ends in a discharge recommendation, which a clinician reviews and signs off. Any flagged symptom routes to a clinician callback within 48 hours. In the validation study, run with an ophthalmologist supervising every call, Dora caught 93.75 percent of the patients who needed review, agreed with the supervising clinicians symptom by symptom, and completed 96.5 percent of calls without human help. In routine deployment across two NHS trusts, covering 1,636 consultations, only 0.3 percent of patients judged clear later needed an unplanned change in care.
Oxford University Hospitals went on to make Dora the default follow-up pathway for thousands of cataract patients and extended it toward pre-operative assessment; a third trust reports more than 2,100 calls and hundreds of nursing hours returned to patients. The design is why the autonomy holds: the loop is five questions wide, two outcomes deep, and a clinician on every discharge.
Why it matters
Execute-level agents usually alarm people because their loop is open: they can decide, act, and keep going. Dora's loop is closed. It conducts a real clinical conversation end to end, but it cannot prescribe, cannot book theatre time, and cannot do anything with a worrying answer except hand the patient to a human, fast. The autonomy is real, and so is the subtraction that makes it safe.
Read through the Agent Operating Model: cognition is the conversation; control is the protocol, the 48-hour callback rule, and clinician sign-off on every discharge; reach is a telephone and a structured summary. Power is the product of the three, and here each one was chosen, published, and regulated before the agent was trusted alone with a patient.
The filled canvas
The entries below are intentionally compact. A canvas should not read like a requirements document; it should make the load-bearing choices visible enough for a team to argue about them.
Worked example
What business outcome must this agent ultimately achieve?
Return scarce ophthalmology capacity to the patients who need it by safely discharging routine cataract patients after surgery.
Which workflow will it improve, and which metrics will show it worked?
Workflow: follow-up about three weeks after uncomplicated cataract surgery. Metrics: sensitivity in catching patients needing review, calls completed autonomously, unplanned care after a clear call.
01Who uses it directly, and who is affected by what it does?
Direct users: post-operative patients on the telephone, and the ophthalmology team receiving flags and summaries. Affected: waiting-list patients who gain the freed capacity, and the accountable trusts.
02What role should it play, and where should its autonomy stop?
Role: autonomous clinical caller. Autonomy: execute, inside a tight loop. It conducts the call end to end and recommends discharge or callback; a clinician reviews the summary before discharge is confirmed.
03What accuracy, explainability, speed, and cost standards must it meet?
Regulator-grade bars, published before routine use: 93.75% sensitivity for patients needing review, strong symptom-level agreement with ophthalmologists, and 96.5% of calls completed unaided.
04What information is available to support its work, and which sources should it trust?
The cataract pathway and the five symptom domains that matter after surgery: redness, pain, vision, new floaters, and flashing lights. Restricted to uncomplicated surgeries by design.
05Which tools or systems can it read from, write to, or act through?
Telephony: it places real calls and converses in natural language, then writes a structured summary into the clinical record. It cannot prescribe, book theatre time, or act beyond routing a callback.
06What must it always do, and what must it never do, even when asked?
Only uncomplicated cataract cases. Any flagged symptom routes to a clinician callback within 48 hours. Emotionally complex situations and non-verbal cues are excluded; those belong to humans.
07What should it remember, what must it forget, and how will it improve over time?
Each call becomes a structured record in the patient's pathway. Improvement is audited in public: a supervised validation study first, then a published evaluation of routine deployment.
08Who oversees it, when must it hand off to a person, and who owns the outcome?
Clinicians review every summary before discharge and call back every flagged patient; the trusts own the pathway; named investigators published the results that license the autonomy.
09What to notice
Full autonomy over a five-question call; zero autonomy beyond it. The rung is high precisely because the task is narrow.
Published sensitivity, clinician agreement, and a regulatory mark came before routine use. Performance needs were numbers on the record, not adjectives on a slide.
Any flagged symptom routes to a clinician, and emotionally complex situations are excluded on purpose. The boundary says what the agent must not try to handle.
The value is counted in clinician time returned to the patients who need it, and in missed problems that stay near zero, not in calls handled.
Coach audit
Not as an outside fact-checker, but as a clinical-operations lead preparing a governance review. Dora is the most autonomous agent in these cases and the most carefully bounded, and the coach still found a load-bearing gap. That is the point: the stronger the design, the sharper the question it has earned. Here is what came back.
"Which symptoms should trigger immediate or same-day action rather than a 48-hour callback, and how does the agent tell them apart on the call?"The coach, on Rules & Boundaries (Cell 07)
Sources
Only public-source claims are treated as facts. The performance figures come from the two peer-reviewed evaluations; operational details beyond them should be read as design implications unless the trusts or Ufonia confirm them.