Main site

Telecom AI agent · Provisioning & eSIM

Provisioning, Activation & eSIM AI Agent

Assemble an activation or an eSIM profile transfer from the identity evidence your market requires, run the configured checks, and hold — a provisioning person decides whether the profile moves.

Typical delivery
4–6 weeks
Deployment
Your stack
Desk approval
Evidence-bound
After launch
Agent Care

What this agent does

Does the activation work, not the identity call

In

  1. 01

    Ingest the activation request and the market rules from supported ordering or CRM sources.

  2. 02

    Normalise the identifiers the activation turns on and carry each forward with its record.

Reason

  1. 03

    Assemble the identity evidence the market configuration requires, and name what is missing.

  2. 04

    Apply the carrier's configured authentication, eligibility and registration rules for that market.

  3. 05

    Bind each check to the evidence it ran against, and mark what the account leaves unresolved.

Decide

  1. 06

    Recognise that a code sent to the number being changed cannot authenticate the change to it.

  2. 07

    Route any transfer that would move a number to a different device to the provisioning desk.

Out

  1. 08

    Retain the request, the evidence, the checks, the timestamps and the approval.

  2. 09

    Execute write actions only inside the approval boundaries agreed during implementation.

Product statement

The agent assembles and checks; a provisioning person decides whether a profile moves, and the carrier stays the party the CPNI rules bind.

Example workflow

One activation, request to approval

  1. 1Activation request receivedRetail counter, app self-service, care system or a device-initiated profile transfer
  2. 2Evidence assembledAccount record, the identity evidence that market requires, device and eUICC identifiers
  3. 3Activation preparedProfile, evidence, checks and confidence
  4. 4Controls appliedAuthentication checks, market registration rules, transfer checks and confidence threshold

No human action required

Stages 1 to 4 run unaided and no profile moves at any of them — the agent is preparing, and the desk's lane opens at the confidence gate.

5DecisionBranches at the confidence threshold
High confidence

Goes to the provisioning desk to approve.

Low confidence

Adds an identity check first.

Provisioning approval

The activation is held with its evidence, its flags and the confidence.

Approve · Correct · Send to identity review

Approved — profile released

  1. 6Provisioning systems updatedOnly where write access and approval policy allow it
  2. 7Outcome evaluatedEvidence completeness, desk corrections, customers left without service and later reversals

Corrections

Every desk correction is counted in the evaluation.

What should not run autonomously

Human approval stays in control

Outside the boundary — human approval required

8 items

  • Completing a transfer without the configured evidence.
    • Using a code sent to the number being changed alone.
    • Changing the authentication rules an officer certifies.
    • Lifting an identity hold another team has placed.

  • Automation boundary

    Agent acts unaided

    • ✓Assemble the activation from the configured identity evidence.
    • ✓Carry each piece of evidence forward with the record it came from.
    • ✓Run the identity and eligibility checks configured.
    • ✓Flag what a person must decide, hold there, and show.

    Any write happens inside the boundaries agreed at implementation, never ahead of an approval.

    • Deciding which identity documents a market requires.
    • Treating eUICC certification as proof of key custody.
    • Barring, suspending or restoring a line in service.
  • Changes to identity, market or approval rules.

Example output

One activation, annotated

Everything the agent proposes is attached to the evidence it was read from.

Activation output · single subscription

Illustrative example
Request
eSIM transfer
Action
Profile moved from the registered device to a new handset
Market
US · no ID mandate
Evidence set
Configured for this market
Confidence
93%
Authentication
Not a code sent to this number

As received

Taken from the account record and the evidence captured with the request.

Evidence used

  • Account record match
  • Photo ID seen in store
  • Registered device identifiers

Why this evidence

The carrier's configuration sets it — the federal SIM-change rules carry no compliance date.

What the score decides

Below the configured threshold the activation picks up an identity check before.

Action

ApproveCorrectSend to identity review

Value

Where AI adds value

The same four claims, placed at the point in the workflow where each one applies.

Where the value lands

Value 01 – 04

Every activation request

From the request and the record

03Preparation

Build from the evidence

Use the account record, the identity evidence that market requires and the carrier's configured authentication rules.

01Approved path

Provision what was authorised

Routine activations arrive assembled, checked and ready to approve.

02Human review

Send the desk to what needs deciding

Flagged transfers and low-confidence requests are marked, so the desk's time goes where a decision is actually owed.

04

Build an evidence trail

The activation, the identity evidence behind it and the person who released it stay on the subscription.

Integrations

Typical integrations

Five system groups connect to the same agent. Which of them are in scope is decided in discovery.

  • Provisioning and OSS

    • HSS / UDM
    • HLR
    • Provisioning gateway
    • activation APIs

  • eSIM platform

    • SM-DP+
    • SM-DS
    • LPA
    • eUICC estate
    • IoT eIM

  • CRM and care

    • Salesforce
    • Dynamics 365
    • Zendesk
    • ServiceNow

Agent

Provisioning & activation

  • Reads the evidence
  • Prepares the activation
  • Stops for approval

  • Identity and registration

    • Document capture
    • ID checks
    • Market registration systems

  • Observability & evaluation

    • OpenTelemetry
    • Langfuse
    • Supported monitoring/evaluation sources

Integration availability depends on the client's existing systems and API access.

Agent controls

Six layers between the model and the profile

Each layer contains the next. What gets past the set is listed in the map below.

L6 · Outermost — last line of defence

Inward → L1 · closest to the model

L6Rollback / safe modeNarrow the agent to preparing and reporting when evaluation or production signals degrade.Roll back
L5Version monitoringTrack model, prompt, identity-rule and market-configuration changes.Track
L4TraceabilityRecord the request, the evidence, the checks, the flags and the approval.Record
L3Provisioning approvalA person decides whether a profile moves; it governs who decides, not whether the evidence was sound.Gate
L2Identity guardrailsTest the request against the configured evidence rules; a failure returns it to the desk.Restrict
L1Confidence thresholdsRoute low-confidence activations to an identity check; confidence is not a reading of intent.Require review
Model coreActivation prepared — profile, evidence, checks and confidence
L1 – L2
Test whether an activation may stand
L3
Puts the release in a person's hands
L4 – L5
Keep the activation and the evidence behind it
L6
Reduces to status lookup when signals degrade

How Nestack evaluates it

Evaluate the whole activation workflow — not only the profile that installed.

Coverage runs the whole depth of the workflow, and every layer is cut by slice.

Surface — the activation the customer gets

  1. E1Final-output evaluationDid the activation carry the evidence that market requires?
  2. E2Step-level evaluationDid the agent read the right account, market rules and identity configuration?
  3. E3Tool evaluationDid it read and write the correct subscription and the correct profile?
  4. E4Confidence calibrationDo low-confidence activations actually attract more desk corrections?
  5. E5Slice evaluationHow does performance change across specific request types?
  6. E6Business outcomeHow many activations needed a desk correction, and how many customers lost service they should have kept?

Floor — whether the right person got the line

Failure modes

Where each failure originates in the agent

Seven failure modes, placed at the stage each one originates.

Agent lifecycle

Direction of processing →

  1. 01 · Retrieval

    1 mode

    • WZ-03

      Stale identity evidence

      Evidence read from a superseded account record.

    Stage gathers

    Account record, identity evidence

  2. 02 · Reasoning

    2 modes

    • WZ-04

      Circular authentication

      A code sent over the number being changed is accepted as the factor.

    • WZ-06

      Wrongful lockout

      A legitimate customer is left without their own number.

    Stage proposes

    The activation, its evidence and the confidence

  3. 03 · Tool / write

    2 modes

    • WZ-02

      Transfer without evidence

      A profile moves while required identity evidence is missing.

    • WZ-05

      Duplicate profile issued

      The same subscription is provisioned onto two profiles.

    Stage writes

    Only where write access and approval policy allow it

  4. 04 · Output

    1 mode

    • WZ-01

      Certification read as assurance

      Certified hardware is treated as proof of key custody.

    Stage returns

    The activation the desk approves and

  5. 05 · Change / Version

    1 mode

    • WZ-07

      Silent identity regression

      A model or rule change loosens what evidence the agent accepts.

    Stage tracks

    Model, prompt, identity rules and market config

  • Sev-1 · moves outside the boundary
  • Sev-2 · a customer is locked out
  • Sev-3 · evidence degrades, activation routes to the desk
See the complete Telecom failure-mode catalogue

Affected slices

Overall accuracy can hide one bad cohort

The slice an aggregate hides is the customer locked out of their own number: they cannot receive the code that would prove who they are The cohorts that carry it are named, not averaged away..

Slice performance — reported separately, not only in aggregate

Illustrative example
SliceFailure rateLiftLift vs. thresholdStatus
Transfers that locked a customer out7.2%3.2×Review
Device-to-device profile transfers5.2%2.3×Review
Activations in registration markets3.1%1.4×Watch
Standard in-store activations1.8%0.8×Normal

Bar: desk-correction-rate lift vs. the all-activations baseline · scale 0–4.0× · tick marks the 2.0× review threshold

2 of 4 slices over threshold

Evidence-linked improvement

The cycle ends in a case, not a note

Nothing closes because it was understood. It closes when the next release has to pass a case, and that suite is what the next activation is measured against.

Improvement cycle · five stages

Switchback — the path turns at Improve and returns at Learn

  1. 01

    Detect

    Desk-correction rate rises in an activation slice.

  2. 02

    Diagnose

    Which evidence did the agent accept? The desk reads the activations behind the rise until the cause narrows to one.

  3. 03

    Improve

    Changes ship against a version with the activations that caused them.

  4. 04

    Verify

    A failing case blocks release until it clears.

  5. 05

    Learn

    The case is permanent, and the identity rules move with it.

  6. Learn → Detect

    The return edge. The next cycle is measured against a suite one case longer.

Typical build scope

Twelve workstreams across six weeks

The build scope read against the delivery timeline. Week structure follows the six-week plan — discovery, sources, activation workflow, evaluation, integration, then production validation and handover.

Workstream

Week 1Week 2Week 3Week 4Week 5Week 6

  1. 01Activation workflow discovery and automation-boundary definition.Week 1
  2. 02Provisioning and eSIM source assessment.Week 1, Week 2
  3. 03Per-market identity-evidence and authentication mapping.Week 1, Week 2
  4. 04Request ingestion and normalisation.Week 2
  5. 05Evidence assembly and check logic.Week 2, Week 3
  6. 06Confidence scoring and desk routing.Week 3
  7. 07Provisioning approval workflow.Week 3, Week 4
  8. 08Provisioning and eSIM platform integration.Week 5
  9. 09Profile-transfer regression cases.Week 4, Week 5
  10. 10Guardrails and identity controls.Week 4
  11. 11Activation-trail instrumentation.Week 5, Week 6
  12. 12Deployment, documentation and Agent Care handover.Week 6

12 workstreams · 6 weeks · bar shows the weeks a workstream is active — several run in parallel

Final scope and sequence confirmed in discovery

Engagement tiers

What each tier includes

Rows are the capabilities named in each tier's scope. Higher tiers include everything below them.

Capability✓ in scope · — not at this tierPilotOne market, one activation pathProductionProduction provisioning systemsAdvancedMultiple markets / brands
Introduced at Pilot
Activation prepared on your rules✓✓✓
Provisioning approval✓✓✓
Activation-accuracy baseline✓✓✓
Introduced at Production
Reporting by activation channel—✓✓
Desk workflow in your systems—✓✓
Approved write-back—✓✓
Provisioning-stack integration—✓✓
Introduced at Advanced
Multi-market activation rules——✓
Multi-stage provisioning approvals——✓
High activation volume——✓
Multi-market identity controls——✓
Build priceFrom $5,000From $8,000Custom quote
Final build price
Confirmed after discovery based on integrations, workflow complexity, transaction volume, approval controls and deployment requirements.
Separate from build
Build pricing is separate from recurring Agent Care, which covers managed monitoring, evaluations, incidents and verified improvements after launch.

What we need from you

What you bring, and what we build with it

Each input maps to a piece of build scope and a week in the delivery timeline.

  1. 01Your activation paths and account record structure

    Request ingestion and identifier mapping

    Week 1

  2. 02Representative completed activations and transfers

    Check baseline, evidence extraction and record binding

    Week 2

  3. 03Your per-market identity and authentication rules

    Per-market identity and authentication rule mapping

    Week 1

  4. 04Access to relevant APIs, feeds or exports

    Provisioning and eSIM assessment, then integration setup

    Week 2

  5. 05Activations you would not want completed

    Transfer cases and failure-mode testing

    Week 4

  6. 06What must reach a person before a profile moves

    Confidence scoring, desk routing, guardrails and identity controls

    Week 3

  7. 07Named provisioning staff to approve activations

    Provisioning approval workflow, then pilot and production validation

    Weeks 5–6

Nothing else is required

Deployment, documentation and Agent Care handover are ours.

Delivery timeline

Four phases across six weeks

Each band covers the weeks it genuinely occupies, so the fifth week holds two kinds of work.

Phase

W1

W2

W3

W4

W5

W6

  1. DiscoveryW1
  2. BuildW2 – W3
  3. EvaluateW4 – W5
  4. Pilot & LaunchW5 – W6

Week focus

W1Activation workflow discovery, identity mapping and the automation boundary

W2Provisioning and eSIM integration and the check baseline

W3Activation workflow, confidence logic and approval controls

W4Evaluation suite, lockout cases and failure-mode testing

W5Provisioning integration, pilot activations and targeted corrections

W6One activation cycle run under the provisioning desk, then handover

Reading the band
Each band spans only the weeks its work is named in. The fifth week genuinely carries two kinds of work.
At the end of W6
Live activations close the validation and monitoring moves to Agent Care.
Duration
Six-week plan shown · typical delivery 4–6 weeks depending on scope confirmed in discovery.

Next step · Telecom AI agent

Build a provisioning agent around the evidence your markets require.

Show us your activation paths, your market identity rules and who approves a transfer. An officer of your company signs your authentication procedures every year, so the agent works inside that configuration and never changes it.

Typical delivery
4–6 weeks
Deployment
Your provisioning stack
Desk approval
Evidence-bound
After launch
Agent Care available

Nestack Agents · Provisioning & activation

AGT-TL-07 · Agent Care available after launch

Build a provisioning agent

Four questions so the call starts from your actual setup — then pick a time that suits you.

About you
Your activations

No obligation. We’ll map the workflow, name the automation boundary and tell you if an agent is the wrong answer.