Direct answer: Dental appointment automation guardrails are deterministic controls that limit what voice AI may write into the diary. Language understanding is probabilistic; booking permission is not. Safe systems separate “what the caller said” from “what the practice allows,” then validate against live availability before confirming.
This page is Clero’s detailed guide to dental scheduling rules for AI, safe automated booking and booking controls. Related: automated appointment booking, PMS integration, human escalation, safe-by-design emergencies.
Guardrails vs language understanding
| Layer | Nature | Job |
|---|---|---|
| Speech / NLU | Probabilistic | Interpret intent, entities, interruptions |
| Business rules | Deterministic | Allow / deny / constrain bookable actions |
| Live system checks | Deterministic + external truth | Availability, overlaps, hours, identity, PMS reject |
| Confirmation | Policy | Speak success only after a successful write (or honest failure) |
If you only “prompt harder,” the model may still invent slots or over-promise. Guardrails belong in configuration + API checks + escalation defaults, with prompts explaining behaviour—not replacing validators.
Capability honesty: Some controls below are verified in Clero’s booking path today; others are conceptual practice-policy dimensions you should still design even when software enforcement is partial. The verification table at the end lists both.
Rule taxonomy (what to define)
Illustrative dimensions—not a claim that every practice encodes every row the same way, or that every row is a product toggle.
| Dimension | What it constrains | Notes |
|---|---|---|
| Patient type | New vs existing; membership/label flags where used | Identity gates matter before chart actions |
| Appointment / treatment type | Which intents may auto-book | Map each bookable type to a PMS target |
| Clinician | Who may be offered | Allow-lists / routing targets per treatment×clinic |
| Site / clinic | Which diary | Wrong site is a common multi-location failure |
| Duration | Slot length | Must match the real appointment length |
| Chair / resource | Operatory or room where the PMS uses one | Not all dental PMS models use chairs |
| NHS / private status | Pathway-specific bookability | Often policy + process; not a universal Clero pathway engine |
| Age | Paediatric vs adult types | Practice policy; enforce via type mapping / escalate |
| Prerequisites | Prior imaging, referral, consents | Usually human / prompt—not a clinical decision engine |
| Deposit | Pay-before-book rules | Often post-book payment links or desk process—not a universal pre-book gate |
| Time windows | Hours, holidays, min notice, OOH | Hours + notice are common software checks |
| Urgent / complex routing | Stop auto-book; escalate | Administrative routing—not clinical triage |
Precedence and conflicts
When two rules disagree, practices need an explicit order. An illustrative precedence (customise and document yours):
| Priority | Rule class | Example conflict resolution |
|---|---|---|
| 1 | Safety / urgent-language stop | Overrides any booking offer |
| 2 | Identity / verification gates | No cancel/reschedule on wrong chart |
| 3 | Site + treatment routing exists | Unmapped type → refuse auto-book |
| 4 | Hours / holidays / min notice | Slot outside window → refuse |
| 5 | Live PMS availability / overlap | Diary truth wins over cached offers |
| 6 | Clinician / duration / resource mapping | Offer only mapped combinations |
| 7 | Commercial policy (deposit, pathway) | Desk/task if not software-enforced |
Missing or contradictory rules
| Situation | Safe behaviour |
|---|---|
| Type not mapped to a PMS target | Do not book; clarify or task |
| Two mappings could apply | Fail closed until owner picks one |
| Hours in one system ≠ hours in another | Single source of truth for AI writes; reconcile |
| Policy says “deposit required” but software cannot gate | Do not pretend; task or human path |
| Prompt says bookable; API refuses | Trust API; never invent success |
| Urgent language + bookable FAQ in same call | Safety stop wins |
Missing rules are not “permissive by default.” Prefer do not book until an owner maps the type.
Safe defaults (when unsure)
Ordered fail-safes for automation:
- Do not book — no false confirmation.
- Ask a clarifying question — only within an approved question set (identity fields, which site, which type).
- Create a task — structured callback / booking_issue / escalation for the desk.
- Escalate / transfer — when policy requires a human on the line (escalation mechanics).
Never use the model to invent clinical eligibility, NHS entitlement or urgency category. For risk language, follow safe-by-design.
Live availability, write confirmation, duplicates, audit
Validation against live availability
A careful path: resolve clinic + treatment routing → query PMS availability for mapped clinician/duration/resource → filter by practice time rules (hours, notice) → offer only remaining slots → re-check or accept PMS reject at write time. Stale mirrors and “remembered” free slots are a known collision risk (PMS integration).
Write confirmation
Confirm to the caller only after the create (or update) succeeds and returns an appointment reference. On structured refusal (outside hours, min notice, need phone/DOB, slot taken, lead-capture-only), re-offer or task—do not treat as “system down” theatre that invents a booking.
Duplicate prevention
Patient search before create reduces duplicate charts; identity gates reduce wrong-chart changes. True write idempotency (one confirmation → at most one appointment under retries) should be asked for in procurement; do not assume every connector blocks double-posts on timeout. Reconciliation remains necessary.
Audit and reconciliation
Keep call outcomes and, where available, PMS ids. Spot-check AI-confirmed calls against the diary. Corrections belong in a weekly QA loop—not only at go-live.
Versioning, ownership and regression testing
Treat the rule pack like production config:
- Owner — practice manager + clinical lead for bookable-type scope; IT/integration for mappings.
- Version — date, author, what changed (types, hours, notice, clinicians).
- Approval — no silent prompt edits that widen bookable scope.
- Regression pack — re-run the testing checklist below after PMS upgrades or mapping changes.
- Rollback — disable a type (unmap / prompt deny) faster than debating a bad day in the diary.
Change-control mini-example: widening “new patient exam” from one clinician to three is a versioned change—update routing, run availability checks for each clinician, test one live write in a sandbox or supervised window, then release. Shrinking scope (removing a type from AI) should be possible the same day without a vendor ticket if mappings and prompts are under practice control.
Multi-location note
Where multiple clinics exist, treat site as a first-class rule: resolve location before availability, keep hours/mappings per site honest, and fail closed on ambiguous site names. Dashboard location filters for reporting are not a substitute for correct booking routing to the right PMS clinic target.
Illustrative examples (not universal policies)
Labelled illustrative—not Clero-mandated rules and not clinical advice.
Example A — Hygiene rebook (illustrative) Existing patient, hygiene type mapped, within hours and min notice, identity satisfied → offer live slots → write → confirm. If slot taken at write → apologise and re-offer.
Example B — Unmapped implant consult (illustrative) Caller wants a complex consult with no routing row → do not invent a clinician block → task or escalate.
Example C — Same-day request inside notice window (illustrative) Policy min notice 24h → refuse that slot → offer later openings or task for desk exception (humans may override; AI should not silently bypass unless you built an exception path).
Example D — Urgent language during a booking ask (illustrative) Stop booking; run safety script / escalate. No “squeeze them in” clinical judgement by the model.
Example E — Wrong site name (illustrative) Multi-clinic org; caller says Site B but routing unresolved → clarify site or task—do not book Site A “because it was free.”
Testing checklist
- Mapped type: availability matches PMS UI for that clinician/duration.
- Unmapped type: no confirmation; task/escalate path works.
- Outside hours / holiday: write refused.
- Inside min-notice window: refused or filtered.
- Slot stolen between offer and write: honest failure + re-offer.
- Identity gate (where configured): mismatch does not alter wrong chart.
- Missing phone/required fields: create blocked with clear next step.
- Urgent language: booking stopped.
- Multi-site: correct clinic diary only.
- After a mapping change: regression of A–C still passes.
- Reconciliation sample: five AI confirms visible in PMS same day.
Verified vs conceptual (Clero-oriented)
| Capability | Status in product engineering (summary) |
|---|---|
| Treatment × clinic routing to PMS targets (type/clinician/duration) | Verified where connectors + mappings exist |
| Live availability query + create/cancel/reschedule via book API | Verified on supported handlers |
| Business-hours / bank-holiday checks on writes | Verified (agent business hours source of truth for book path) |
| Optional min-notice filtering | Verified as org setting (confirm whether exposed in your UI) |
| Identity/DOB gates on some PMS change paths | Verified on specific handlers |
| CareStack chair/operatory and dentist free-at-slot checks | Verified on that connector |
| Lead-capture-only refuse (no live book) | Verified where flagged on target |
| Task + transfer tools as safe defaults | Verified as capabilities; invocation is policy/prompt-driven |
| “Draft hold then human approve” as standard inbound mode | Not claimed as a universal product mode here |
| Native “read all PMS block-scheduling logic” automatically | Not claimed—mapping + PMS availability truth |
| Deposit pre-book gate / NHS–private dual engine / clinical prerequisites | Conceptual / process—not a universal enforced rule engine |
| Perfect create idempotency on all retries | Not assumed—design reconciliation |
Supported dental booking handlers today include Dentally, CareStack, Semble, Aerona and Exact (via Exact Online Booking when enabled), plus calendar-style connectors where configured. Confirm yours before treating write-back as ready.
Claims changed from earlier versions of this URL
| Previous | Now |
|---|---|
| Draft/pending reservation as core product story | Removed as universal claim |
| Flawless native honouring of all PMS block logic | Reframed as routing + live availability + practice rules |
| “Any PMS” autonomous lock | Limited to verified connectors + mappings |
| Diary clutter fear addressed by marketing absolutes | Addressed via taxonomy, fail-safes, testing, reconciliation |
Frequently asked questions
What are guardrails?
Deterministic allow/deny constraints on automated booking—distinct from probabilistic NLU.
Does NLU replace rules?
No. Rules and live checks decide permission to write.
Does Clero enforce every policy?
No—see verified vs conceptual table. Design process for gaps.
Rule blocks a book—what then?
Do not book; clarify, task or escalate.
Clinical eligibility / urgency?
Not an AI decision. Safety/escalation scripts only.
How to prevent drift?
Versioning, owner approval, regression tests, PMS reconciliation.
Related reading?
Booking · PMS · Escalation · Emergencies.
Guardrails turn “smart conversation” into safe diary behaviour: mapped types, live checks, fail-closed defaults and change control. If you want help turning your bookable list into a versioned rule pack before go-live, use the CTA below.