# Phase 23: Classification Disposition + Per-Client Automation Gate - Discussion Log

> **Audit trail only.** Do not use as input to planning, research, or execution agents.
> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.

**Date:** 2026-07-16
**Phase:** 23-classification-disposition-per-client-automation-gate
**Areas discussed:** Gate granularity, Default state, Verdict behavior, Gate page location, Acknowledge-user delivery path, Auto-approval carve-out

---

## Gate granularity

| Option | Description | Selected |
|--------|-------------|----------|
| One master toggle per company | Single on/off switch controlling parse+classify+report together | |
| Separate toggles per stage | Three independent switches (parse / classify / report-to-ticket) per company | ✓ |

**User's choice:** Separate toggles per stage.
**Notes:** More flexible than a single switch — a company can have auto-parse+classify without auto-report, keeping a human review point before anything reaches the client's ticket.

---

## Default state

| Option | Description | Selected |
|--------|-------------|----------|
| Off by default, opt-in per client | A client only gets automation once explicitly enabled | ✓ |
| On by default, opt-out per client | Every client automated immediately unless explicitly disabled | |

**User's choice:** Off by default, opt-in per client.
**Notes:** Matches Phase 20's "proposed-only" safety posture — nothing client-facing happens automatically without deliberate enablement.

---

## Verdict behavior

| Option | Description | Selected |
|--------|-------------|----------|
| New 4th verdict, same warn_user action | New disposition label, unchanged downstream action | |
| New verdict + no action needed | New disposition, empty/no-op recommended action | |
| New 4th verdict, new acknowledge_user action | New disposition + new action: professional thank-you message | ✓ (user's own answer, not a listed option) |

**User's choice:** New 4th verdict with a new `acknowledge_user` recommended action — "a professional message letting them know we appreciate their attention in keeping the company secure."
**Notes:** Neither preset option captured this — the user wanted active positive reinforcement, not just a relabeled no-op. Became D-01/D-02 in CONTEXT.md.

---

## Acknowledge-user delivery path

| Option | Description | Selected |
|--------|-------------|----------|
| Publish-visible Autotask ticket note | Customer-visible note via existing TicketNotes write path, visibility flag flipped | ✓ |
| Direct reply-email to the reporter | New delivery mechanism, independent of the ticket | |

**User's choice:** Publish-visible Autotask ticket note.
**Notes:** Reuses Phase 21's existing internal-note write path, just customer-visible instead of internal-only, so the reporting employee sees it via their normal ticket notification/portal.

---

## Auto-approval carve-out

| Option | Description | Selected |
|--------|-------------|----------|
| Skip approval for acknowledge_user only | Thank-you message auto-posts for opted-in companies; all other actions (quarantine, block, warn_user) still always require manual approval | ✓ |
| Still require manual approval for everything | Automation gate only controls parse+classify; report-to-ticket still needs an explicit Approve click | |

**User's choice:** Skip approval for acknowledge_user only.
**Notes:** A narrow, explicit carve-out from Phase 20's proposed-only model — applies only to this one non-security, non-destructive action type.

---

## Gate page location

| Option | Description | Selected |
|--------|-------------|----------|
| New /admin/phishing-automation page, admin role | Dedicated page mirroring /admin/client-scope's exact pattern | ✓ |
| Same page, super-admin only | Same UI, gated to super-admin instead | |

**User's choice:** New /admin/phishing-automation page, admin role.
**Notes:** Consistent with other /admin/* pages — this is a service-delivery toggle, not billing/security config.

---

## Claude's Discretion

- Exact new verdict string value and its StatusBadge color/variant.
- Exact acknowledge_user message copy (tone direction given, wording open).
- Automation-gate settings table schema (adapt company_scope's precedent to 3 booleans, opt-in).
- Whether automatic pipeline stages run inline in the webhook handler or via a queued worker.
- Whether to add audit logging (who/when) for gate toggle changes, per the integration_settings precedent.

## Deferred Ideas

None — discussion stayed within phase scope. The webhook fix and the confidence
display bug that surfaced during the same investigation were resolved as
separate quick tasks (260716-n46, 260716-pgr) prior to this discussion, not
folded into this phase.
