Vertical bundles console walkthrough
The Vertical Compliance Bundles page explains
what each pack provisions and the endpoints behind it. This guide is the
operator-side walkthrough of the console UI at
Settings → Compliance → Vertical bundles — the same surface a teammate
drives with clicks instead of curl, so you can activate a pack, open its
checklist, and come back to it after a reload without writing a script.
The page is restricted to the owner, admin, and developer roles; viewer roles
see the catalog but cannot activate or toggle checklist steps.
What a bundle provisions
Each pack is a one-click bundle of draft resources for one regulated traffic
family — healthcare (HIPAA), fintech (KYC), e-commerce, or payments &
collections (PCI). Activation creates a draft compliance profile, a set of
draft campaign templates, a vertical-tuned AI agent, and a seeded double
opt-in confirmation flow, then records a go-live checklist on the profile.
The Vertical Compliance Bundles semantics
page has the full table of what each pack carries; this walkthrough covers
the console flow around it.
Everything a pack creates is a draft. Nothing is wired to a carrier and
nothing sends until you review the drafts, submit the profile for
verification, and attach your senders — activation sets your starting
defaults; the send decision is always yours.
Step 1 — open the catalog and pick a pack
Dashboard path: Settings → Compliance → Vertical bundles — the
catalog grid renders one card per shipped pack.
Each card shows the pack’s display name, its vertical badge, the draft
campaign count, the checklist step count, and the pack version. The console
reads this from GET /api/v1/compliance/vertical-bundles.
Pick the pack that matches your traffic family — for this walkthrough the
example is healthcare_hipaa. If your workspace spans two families (say,
fintech account alerts and e-commerce order messaging), activate one pack
per family; a second call for the same key duplicates the drafts rather
than reconciling them.
Step 2 — preview what activation creates
Dashboard path: on the pack card, click View pack contents — a
dialog opens with the full manifest before you commit.
The dialog lists every draft campaign template with its copy, the AI
agent’s name, type, model, and system prompt, the double opt-in
confirmation copy, and every checklist step title. The console fetches the
manifest lazily from
GET /api/v1/compliance/vertical-bundles/:key only while the dialog is
open, so the page stays cheap until you ask for a preview. A 404 on an
unknown key means the key is not in the shipped catalog.
Read the campaign copy and the agent’s system prompt here — this is the
exact text activation provisions, so review it before you click, not after.
Step 3 — activate the pack
Dashboard path: on the pack card, click Activate pack, optionally
fill in Brand name, Help contact, and Country (ISO-2), then
Confirm activation.
The console sends
POST /api/v1/compliance/vertical-bundles/:key/activate. The three
optional fields brand the seeded copy — brand_name and help_contact
substitute into the campaign templates and the opt-in confirmation, and
country_code (or a countries list) scopes the draft profile. Leave them
blank and the pack’s generic placeholders carry through.
Activation returns 201 with the full activation state: the provisioned
compliance profile id, the draft campaign ids, the agent id, and the
go-live checklist. The console stores the profile id in the page URL
(?activation=<profileId>), so a reload or a re-navigation back to the
page reopens the same checklist instead of stranding you.
Step 4 — read back the activation record
Dashboard path: the checklist panel that opens below the catalog after
activation reads back the current record.
The same read from the shell returns the record the console renders:
(The response is abbreviated — the live record carries every campaign and
every checklist step.) The record lives on the compliance profile it
created, which is why the read is keyed on the profile id rather than the
bundle key.
If you activated in an earlier session, the Resume a previous
activation card below the catalog lists every pack already provisioned
for the workspace with its done/total checklist progress; click Resume
to reopen that checklist.
Step 5 — work the go-live checklist
Dashboard path: inside the checklist panel, tick each manual step as
you complete it; provisioned steps are marked done automatically.
The checklist mixes two step kinds:
- Provisioned steps — the resources activation created (the draft
profile, draft campaigns, draft agent), marked
done automatically with
a lock badge.
- Manual steps — gates only you can clear: attach required compliance
documents, complete the US 10DLC brand and campaign registration, review
the draft agent’s prompt, review the opt-in confirmation copy, confirm
the quiet-hours window, and approve campaign copy. The healthcare pack
adds signing a Business Associate Agreement; the e-commerce pack adds
separating marketing from transactional opt-in; the PCI pack adds
confirming the hosted payment page.
Each toggle sends
PATCH /api/v1/compliance/vertical-bundles/activations/:profileId/checklist/:stepId
with { "status": "done" } or { "status": "pending" }. The progress bar
at the top of the panel tracks done/total; the console also links the
draft compliance profile so you can open it and edit the provisioned
campaigns and agent in place.
The checklist is an in-product tracker, not a send gate — it never
blocks an API call. Use it to prove the reviews happened; the draft
state of the provisioned resources is what actually holds your traffic
until you submit.
Step 6 — overlap and duplicate safeguards
Click each bundle once per use case. The
activation lifecycle semantics
page covers the exact behavior; the short version for the console:
- Activation never merges with an existing profile. Each activate
call creates a new draft profile, new draft campaigns, and a new draft
agent — even on a repeat of the same key.
- Re-activation duplicates on purpose. There is no dedupe check and
no
409; activating healthcare_hipaa twice produces two independent
checklists and two verification journeys. To fix a failed carrier
review, edit the existing profile and resubmit it — do not re-activate.
- Reclaim a duplicate by deleting the surplus drafts (the profile,
campaigns, and agent) before they enter verification; the API offers no
auto-cleanup.
The decision table on the semantics page maps each situation — seeded copy
nearly right, material revision shipped, script retry on a network blip,
failed carrier review, genuinely parallel setups — to the correct move.
Read it before you click twice.
Step 7 — version N → N+1 upgrades
An activation record pins the bundle’s version at the moment of the call.
When Orbit ships a bundle revision, the catalog version advances and your
existing activation keeps its snapshot — the version, the checklist shape,
the campaign copy, and the agent prompt are frozen on the record.
To see whether a revision applies to you:
- Open View pack contents on the pack card — the dialog header and
card footer show the live version.
- Compare with the version badge on your activation record (the read-back
step above).
For a material revision — new checklist gates, changed campaign copy, an
updated agent prompt — the upgrade path is to delete the old drafts and
re-activate through the same flow; the audit entry for the new activation
records the new version, so the org audit log shows the upgrade as a
second activation rather than a silent rewrite. Per-tenant notifications
of a revision are not sent; the changelog announces template changes.
Tenant-owned controls
Vertical bundles are a tenant-owned activation helper: the pack ships
the vertical’s reviewed starting defaults, and your workspace stays
responsible for the rest — attaching senders, confirming the copy, and
clearing the go-live checklist. Activation is an accelerator for your own
posture, not a decision by the platform that your traffic is compliant.
The pages under
Your Tenant Compliance Posture describe
the toggle map these defaults hook into.
