Voice in layers
Connectivity, control, numbering and operation, built as separate layers with boundaries between them, so that a failure has an edge decided at design rather than discovered during an incident.
The question that matters in infrastructure is not whether something will fail. It is how far the failure travels before it stops.
Built as one undifferentiated thing, a voice estate has no natural edge. A fault in routing reaches numbering, numbering reaches connectivity, and the first symptom anyone notices is that nothing works — the least useful symptom available.
Built as layers, each has an edge. When something fails, the question of what is affected has an answer that was decided in advance.
What fails, and how far it reaches
Stated per layer, because the answer during an incident should not be a matter of investigation.
Four, each holding one kind of risk
Take one, take two, take all four. The boundaries mean adding another later does not require unpicking the first.
Connectivity
The outermost layer. Whether a call can happen at all.
- Authorisation — establishing that your phone system is what it claims to be
- Transport — carrying signalling and audio without exposure
- Selection — choosing the way out, per call
- Containment — bounding what a compromise can cost
Control
Where a call goes, and what happens when nobody answers.
- Registration — endpoints establishing and holding a session
- Routing — deciding where an arriving call goes
- Retention — holding recordings and voicemail lawfully
- Replication — ensuring no facility holds your call flows alone
Numbering
What a caller dials, and whether it can ever be unreachable.
- Eligibility — establishing whether a range can be held at all
- Evaluation — deciding where a call goes
- Authority — controlling what may be presented outbound
- Custody — preventing a range being taken
Operation
Change, treated as a layer because it causes more incidents than failure does.
- Request — turning an outcome into a change
- Review — deciding whether and when a change is safe
- Application — making the change without widening the blast radius
- Verification — establishing that it did what was intended
The right control at the right boundary
Applying everything everywhere sounds thorough and produces a system nobody can reason about. Applying the right protection at the right boundary produces one where a security question has a specific answer.
- Encrypted signalling and media at the connectivity boundary, exceptions recorded
- Address-based authorisation for fixed sites, removing the credential entirely
- Destination policy denying by default, permitting only what is actually called
- Role-based access with individual attribution at the control boundary
- Presentation authority and port-out verification at the numbering boundary
- Change attribution with before and after state at the operation boundary
How a layer is added
The same sequence whichever layer is being fitted, because the failure modes are the same.
-
Measure
Concurrency reconstructed from call records in short intervals. Inventory taken to completeness, including the analogue devices on no register.
-
Specify
The boundary, the protection and the failure behaviour written down and agreed before anything is provisioned.
-
Prove
Exercised with representative traffic including deliberate failure, until behaviour matches the specification.
-
Fit
In waves, with the previous arrangement retained and a rollback position established before each begins.
-
Hold
Monitored continuously, reviewed on a cadence, with capacity compared against measured use in both directions.
Four situations
The layers are constant. Which boundary matters most is not.
Small operations
Where the containment boundary matters most, because nobody is watching.
Open Application BLarge organisations
Where the change boundary carries the most risk.
Open Application CDistributed teams
Where the boundary sits outside the organisation entirely.
Open Application DContact operations
Where capacity is a plateau rather than a peak.
OpenRange types
Geographic, national and toll-free, where coverage and local regulation permit.
Guaranteed destination
Every number terminates somewhere defined; no evaluation path ends undefined.
One control layer
However many ranges, the routing and reporting sit in one place.
Numbering, answered precisely
Whether a number is available in a given country is a regulatory question rather than a technical one, and the rules differ by country and by range type. We confirm each range before committing to a date rather than publishing a map that implies otherwise.
Written by the people who hold it
Studies on capacity, fitting and diagnosis. Notes on numbering and fraud. Nothing gated.
Measuring concurrency
Deriving the figure from records, and the two categories records will never contain.
Fitting a layer into an existing estate
What to establish first, and where these projects actually go wrong.
Locating a quality fault
Three metrics, three symptoms, and locating the fault by layer.
Numbering as a boundary
Why numbering is a boundary rather than an inventory.
The shape of fraud
Automated, indiscriminate, and timed against detection latency.
No. Most organisations take one or two. The boundaries mean adding another later does not require unpicking the first, which is the usual reason estates end up with two suppliers.
Yes. Control can sit above a trunk you already own, and numbering can terminate into a phone system that is not ours. The failure boundary is then partly outside our control, and the design says so rather than implying otherwise.
Whichever one is failing. Blocked calls means connectivity, calls reaching the wrong place means control, a number unreachable means numbering, and something that broke after a change means operation.
Because in a mature estate change causes more incidents than component failure does. Treating it as an activity rather than as a bounded layer is how those incidents happen.