| DoT, Telecommunications Act 2023 | The licensing and authorization framework for telecom services, with security and user protection duties. | Partner APIs and agents are part of the authorized service and governed like it. |
| DoT, Telecommunications (Telecom Cyber Security) Rules, 2024 | A cyber security policy, a chief telecommunication security officer, and reporting of security incidents to DoT within hours. | Every partner call and agent action is logged so an incident report can say what happened, through which interface, and when. |
| TRAI, Telecom Commercial Communications Customer Preference Regulations, 2018 (as amended) | Consent and preference registration for commercial messages and calls, registered headers and templates, and action against unsolicited communication. | Messaging agents check consent and approved templates before they send, and the record shows both. |
| Digital Personal Data Protection Act 2023 and DPDP Rules 2025 | Consent and purpose limits for subscriber data, breach notice. | Network APIs release only the subscriber attributes the purpose and consent allow. |
| CERT-In directions (April 2022) | Cyber incidents reported within six hours; ICT logs kept for 180 days in India. | Gateway and agent logs stay in India on synchronized time. |
| Ministry of Information and Broadcasting, IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Part III | A code of ethics, content classification and a grievance process for online curated content publishers | Recommendation and service agents respect the classification and age settings on each title, and every viewer complaint they touch is logged for the grievance officer. |