Governors and Privacy

Two governors

Both governors end a call gracefully - the caller hears a goodbye rather than a sudden drop.

StandIn-side (tier limits)

When a StandIn tier limit is reached (a sandbox/free daily cap or a subscription max-minutes governor), StandIn sends an assistant.say with the goodbye text. The bridge speaks it and StandIn tears the call down. If StandIn ever fails to hang up afterwards, the bridge’s own backstop ends the call after the goodbye grace plus a hard cap - a call can never sit open with the agent muted.

Bridge-side (MAX_CALL_MINUTES)

Because OpenAI knows nothing about your budget, the bridge can enforce its own hard cap. Set MAX_CALL_MINUTES (fractional allowed; 0 disables it). At call start the bridge arms a timer; on expiry it flushes playback, speaks GOODBYE_TEXT, and ends the call with reason time-limit.

The 60-minute Realtime ceiling

The OpenAI Realtime API caps a session at 60 minutes server-side, with no migration or continuation. A call that reaches it drops abruptly with reason agent-disconnected - no goodbye. Set MAX_CALL_MINUTES below 60 so the bridge governor always fires first; the bridge logs a startup warning when it would not.

Deterministic goodbye

Set OPENAI_TTS_VOICE and the goodbye is synthesized as the exact GOODBYE_TEXT via the standalone TTS endpoint (OPENAI_TTS_MODEL, default gpt-4o-mini-tts) - the agent is muted while it plays, and the real audio duration is used for the grace. Without it, the goodbye is delegated to the agent via an injected user turn, and GOODBYE_GRACE_MS covers the unknown duration.

Note

The goodbye can never wedge a call open. The bridge arms a hard-bounded teardown deadline before waiting for the goodbye (on both governor paths), and the goodbye-TTS fetch is itself time-bounded, so a slow or hung endpoint still ends the call on time.

Recording gate

StandIn reports the Teams recording state (recording.status). The bridge honors it:

• Transcripts are never logged or persisted unless LOG_TRANSCRIPTS=true and recording is active (user-side transcripts additionally need OPENAI_TRANSCRIPTION_MODEL).
• Vision path 1 (attaching the raw frame to the Realtime conversation) is refused unless recording is active.
• Video frames are buffered in memory only and dropped at teardown.

Vision path 2 descriptions are ungated by design - see the trade-off in Vision and Tools.

Data residency and retention

Caller audio, transcripts, any vision content, and MCP tool traffic transit OpenAI’s cloud and are retained per your OpenAI organization’s data controls (including any zero-data-retention agreement you hold). For deployments that must not retain caller data with a third party:

• Review your OpenAI data-retention configuration for the Realtime API.
• Keep LOG_TRANSCRIPTS off and vision unconfigured if they are not needed.
• Disclose that an AI is on the call - a spoken OPENAI_FIRST_MESSAGE is the simplest way, and follows most tenants’ call-recording/AI-disclosure policy.

This is the same “customer data leaves the tenant” conversation as any hosted agent; surface it to your stakeholders explicitly.