1. 1Status strip at the top of the record, next to the RM. Off is grey, On is green. This is what the dealer reads in the two seconds before picking up: if it says Off, the recorded-line script is “I’ll send you a quote in the app”, not “I can book that for you”.
2. 2One Enable button. It opens the evidence form in step 2. There is no shortcut that enables without evidence, and no shared “trading support” login; what gets created is Tom’s own authorised-user account on this client.
3. 3Context for the call: how the client has been trading so far. A client who books online happily may not want this at all; the dealer should ask, not assume.
4. 4The old “Request authorised user access” link is retired. It emailed the client for approval and was used 9 times in 2026. The new row shows the same fact (Off, no events) and points at the button, so nobody goes looking for the old link.

Validation states (static)

1. 1Channel is a radio, not free text, so the consent history can be filtered and the dealer script matches: Recorded call, Email, WhatsApp. Nothing else counts as an instruction.
2. 2The evidence is a link, required. An Aircall recording URL, an email thread link or a WhatsApp chat link. The form soft-warns on anything that does not look like one of those hosts (see 9) but does not block, because Front/Gmail/Outlook links vary.
3. 3Impersonation check. The “Instruction came from” selector only lists the phone number and email already on file (for a business account, the registered contact). If the caller’s number is not on the account there is nothing to pick, and the help text tells the dealer what to do instead. This is the check that turns “someone rang and asked” into “the account holder asked”.
4. 4T&C version is read-only and pulled from the client’s acceptance, so the record says which terms the client had agreed to when this was enabled.
5. 5Plain summary of what Tom’s AU can do, in the same words the client will read in the email. Dealer and client see the same promise.
6. 6One green button. Disabled until channel, link and contact are all present. On click: AU #113889 is created for Tom, the consent event is written, the FYI email is queued, and the client record status flips to On.
7. 7Side panel inside the form shows exactly what will be written and what the client will get. It updates as the dealer types, so there is no surprise about what is being recorded.
8. 8Empty state: button disabled with a one-line reason under it.
9. 9Soft warning for a link that does not match aircall.io, mail.google.com, outlook, front.com, wa.me or whatsapp.com. Amber, not red; the dealer can proceed.

1. 1From the person, not the brand. “Tom Radford at CurrencyTransfer” on the trading@ address the client already knows. Subject says what happened in plain past tense; the preheader says why and how to undo before the email is opened.
2. 2Can / never / off, three lines. Same promise as the admin summary. “Only when you tell me to” is the sentence compliance asked for; “never … pay a new recipient” closes the question every client actually has.
3. 3One primary button into the logged-in app, deep-linked to the checklist item (/dashboard#complete-setup), where the client’s own confirmation is captured.
4. 4Turn it off is a real, visible link, in a bordered box under the button, not buried in the footer. It is a signed URL like an unsubscribe: no login, one click, lands on step 4. Because it needs no login it works for exactly the clients who struggle with the app.
5. 5Footer states the legal position honestly: the recorded call was the instruction, the email is the notice. That is what makes “we turned it on” defensible under Consumer Duty: the client asked, was told in writing, and was given an exit that costs one click.

1. 1Already done on arrival. The GET on the signed link performs the off (idempotent, single-use token, 90-day expiry). No “are you sure” page: a client who wants us out should not have to argue.
2. 2Date and time on the page, the same value written to the consent history as turned_off · by client · email link. If the client forwards a screenshot, it matches the record.
3. 3Where to turn it back on, named exactly as the breadcrumb reads in the app. Turning it back on from Settings is a fresh consent event with source settings.
4. 4Login link, not a login wall. The page never asks for a password; the token proves the email was received by the account’s address.

Reset this frame

Both outcomes, card only

1. 1Progress counts it as pending, not done. “1 of 3 done · 1 to confirm”: the dealer’s enable is real but the client has not spoken yet, so the segment stays grey until they do.
2. 2Same item box, light-blue tint and an On pill. It reads as “this is on, please look”, not as a warning and not as an error. It is the second item in the list, in the slot Verification used to hold.
3. 3Who and when, in one line: “Tom turned this on after your call on 10 Sep 2026.” The client can place it: a person they spoke to, on a day they remember. No “we” hiding behind the brand.
4. 4Keep it on (primary) / Turn off (outline), equal size. Turn off is a proper outlined button, not a grey text link, because refusing must be as easy as agreeing. Either click writes a consent event: confirmed · client · dashboard or turned_off · client · dashboard, with user, IP and T&C version. The item does not nag: if the client ignores it, it stays until answered, and the dealer can still book because the Stage 0 consent stands.
5. 5Names the Settings row exactly (“Trading Support · Tom Radford”) so what the client sees here matches what they will find there.
6. 6After Keep it on: collapses to a done row, tick, “Confirmed by you · date”, link to Settings. Progress moves to 2 of 3.
7. 7After Turn off: collapses to an “Off · turn on any time” row and drops to the bottom of the list. Tom’s AU is suspended on the same request; he sees Off on the admin strip before his next call.

1. 1Named, not anonymous. “Trading Support · Tom Radford”, because the AU is Tom’s own login (tom+113883@), not a shared trading@ account. If the RM changes, this row is suspended and a new one appears for the new dealer, with fresh evidence behind it.
2. 2Staff badge so a business client with colleagues on the account can tell which row is us.
3. 3Inline toggle, shared component. Off is immediate and writes turned_off · client · settings; on writes enabled · client · settings. No confirmation dialog either way.
4. 4Consent history under the row, in the client’s words: who enabled it and on what channel, then the client’s own confirmation. Flipping the toggle adds a line live (“Turned off by you · just now”). This is the same log the admin sees in step 7, minus the evidence links.
5. 5Permission pills say what Tom can do in plain words (book on your instruction; allocate to existing recipients; view recipients only) rather than Approver/Admin. Same three rows as any other AU, so the page stays consistent.

Same evidence form, second use: “Book for client” from the admin app

1. 1Status On in the strip, green, with the two dates that matter (enabled, confirmed) and the contacts an instruction may come from. Suspend replaces Enable; suspending needs a reason and is logged as a staff event.
2. 2Consent history table with When / Event / By / Channel / Evidence / Contact used / T&C. One row per event, newest last, never edited. This is the document compliance hands to the FCA or to a disputing client.
3. 3Evidence is a link that opens. Aircall recording for calls, the message or thread for email and WhatsApp. Aircall retention must be at least as long as the consent (set to 7 years in the Aircall plan).
4. 4The client’s own confirmation from step 5, highlighted, with session and IP. Two independent consent points, two channels, two days apart: this is what “multi-point consent” means in practice.
5. 5Consent column on the AU table, readable in one glance before a call. A CT-staff AU with an empty Consent cell is a data error and cannot be created under this design.
6. 6One evidence discipline covers both paths. Today 176 trades for 15 clients (£1.9M gross profit) were booked from the admin app with no consent toggle and no evidence field. The same three fields (channel, link, contact on file) become mandatory on “Book for client”, so every admin-booked trade points at the instruction it came from.

1. 1Same item, off. Title is the feature name; body is the offer and the honest mechanism in two sentences. Clients who were enabled by a dealer never see this state; clients who were not see it once verified.
2. 2Turn on / Not now. Turn on writes enabled · client · dashboard and creates the RM’s AU (or a queue item if the client has no RM yet). Not now collapses the item to “Off · turn on any time”. No Save, no second page.
3. 3Mop-up email, sent once to activated clients with no consent event, after Stage 0 has been live long enough that dealers have enabled their active books. It is a nudge, not the consent record, and says so.

1. 1Third of four steps, after verification, in the existing wizard style. It never blocks: Continue is enabled with nothing selected, and Skip is always visible.
2. 2“I’ll book online myself” is the default expectation and is framed as fully supported, so choosing it does not feel like refusing help.
3. 3“Also let a dealer…” is framed as a benefit with the mechanism in one sentence, and says explicitly that confirmation happens on the dashboard. The word “Also” makes clear it is additive, not either/or.
4. 4Skip for now leaves the checklist item in its Stage 1 OFF state. Choosing the dealer card pre-sets it to a “Ready to confirm” variant on the dashboard; it does not create an AU and it is not a consent event.
5. 5The note says what this is and is not. Preference here, consent on the dashboard (or on a recorded call with a dealer). Two separate records, so the onboarding tap can never be mistaken for the consent.

1. 1Same copy, no truncation. The tinted ON item, the On pill and the “Tom turned this on” line all survive at 390px; the title wraps to two lines.
2. 2Stacked buttons, 44px minimum, full width. KEEP IT ON above TURN OFF, both real buttons. A thumb cannot hit the wrong one.
3. 3Subject and sender read in the inbox list before opening: what happened and who did it.
4. 4Turn it off sits directly under the button, in its own box, inside the first screen of the email on most phones. No login means it works on the phone the client is actually holding.