Level 1 Authentication

Never impose security checks. Always request explicit user consent before initiating the authentication flow.

If consent is denied, apply a soft nudge explaining the benefits of authentication, or gracefully fall back to limited functionality.

Maintain the bot's character (e.g., a helpful service desk agent) throughout the security check to keep the experience human-centric.

Proactively design for "not-so-happy" paths: clarify what is needed, explain where to find it, accommodate "hold" requests, and reassure users if they simply forget.

Log precise exit statuses for every drop-off point. This provides instant visibility into conversation outcomes without requiring deep data mining.