Nimbus Desk. A voice agent you can call right now.

The 20 EUR credit cap and the rule that escalation ends account actions are enforced in the billing service, not requested in the prompt. Models follow instructions probabilistically; an intermittent eval failure proved it when the agent applied a credit after handing the case to a human, sometimes. A prompt line is a suggestion. A service-layer check is a guarantee.

Voice, chat, and the eval harness execute the same agent instructions, the same seven typed tools, and the same billing service. Behavior must not fork between channels: when a live call exposed a bug, the fix shipped once and voice, chat, and evals all inherited it the same hour.

The voice loop runs a realtime speech-to-speech model with semantic voice-activity detection, because conversation latency is the product. Chat and evals run a small, fast text model, because they do not need audio and cost matters. The guardrails are model-independent, they live in code, so the cheap text model is a faithful proxy of the voice agent minus the audio path.

The server mints 60-second ephemeral client secrets, with the model, voice, instructions, and tools baked in server-side. A public voice demo is an open faucet to an API key; an ephemeral secret keeps the blast radius to one minute and the configuration out of the caller's hands.

Calls hard-cap at 3 minutes with a visible countdown. Per-IP and global daily caps plus a reconnect cooldown protect a public demo's token budget. When a cap is hit, the page says the demo is asleep instead of erroring mysteriously, and every failure state offers the chat channel as the fallback, which costs roughly a hundredth of a voice call.

The server logs operational metadata only: outcome, duration, turn counts, tool names and latencies. That is exactly what the ops dashboard needs for containment rate and handling time, and nothing else. Voice content is not stored because the metrics do not require it.

The first live call failed because the speech model heard Fisher when the caller said Fischer, and exact-match verification refused a legitimate customer twice. The fix went into the integration layer, not the prompt: exact match on the account digits, which are the credential, and edit-distance tolerance on the spoken name, scaled to name length. Strict on what the caller proves, tolerant on what the transcriber guesses.

The eval harness plays LLM-simulated personas with hidden goals against the agent, then checks invariants by reading the tool-call log: identity gates account data, credit never exceeds authority, escalation fires with the right reason and is terminal. Real bugs from live calls are frozen as regression cases, like the post-escalation credit and the agent re-asking for identity a caller had already volunteered. A capture script turns any failing conversation into a new case. That loop is what separates a deployment from a demo.