Breach Call Center and Agent Script UI in Figma

Quick answer

Breach call center and agent script UI keeps support teams aligned with legal-approved answers when call volume spikes after individual notification—without improvising forensic detail or promising remedies legal has not approved. Design a versioned script workspace synced to notice FAQ NL-* versions, identity verification steps before disclosing account-specific impact, escalation paths to privacy and legal, and ticket tagging tied to incident VIN-*. Connect to individual notification, remediation offers, privacy request queue, and war room. Start from the Figma guides hub and pair with forms, Dev Mode handoff, and audit log.

Who this is for

Product designers building internal support tooling for privacy incidents—not generic CRM ticket views.
Support operations leads scaling breach hotlines with scripted, auditable responses.
Privacy and legal teams who need agents to stay within approved talking points.

Agent script workspace

BreachScriptWorkspace — Incident VIN-992 · Script BS-992-v3 · Synced to FAQ NL-992-v3
├── Header: Active incident · Call volume: 847 today · Avg handle time: 6m 12s · Escalations: 23
├── Script sections (guided flow):
│   ├── 1. Opening — Empathy + confirm caller reason · Do not admit liability beyond FAQ
│   ├── 2. Identity verification — See verification panel below
│   ├── 3. Approved talking points — Read-only from FAQ v3 blocks
│   ├── 4. Eligibility check — Was caller in IND-441 segment? · Show yes/no/unknown
│   ├── 5. Remediation offer — Link to [enrollment flow](/designing-breach-remediation-offers-and-credit-monitoring-enrollment-ui-in-figma/) if eligible
│   ├── 6. Escalation triggers — Legal keyword · Threat of litigation · Media inquiry · Regulator mention
│   └── 7. Closing — Recap actions · Send follow-up email template · Ticket summary
├── Live sidebar:
│   ├── FAQ quick search (same index as [notice landing page](/designing-breach-faq-and-notice-landing-page-ui-in-figma/))
│   ├── Forbidden phrases (red banner): "We guarantee no fraud" · "Only 100 people affected"
│   └── War room link — [Shift handover](/designing-security-operations-shift-handover-and-war-room-ui-in-figma/) for status updates
├── Version lock: BS-992-v3 published with NL-992-v3 · Out-of-sync warning if FAQ updates
└── Audit: agent_id · call_id · script_version · sections_used[] · escalation_flag

Element	Purpose
FAQ sync indicator	Agents see when script lags notice page—force refresh before shift
Forbidden phrases	Prevent legally risky improvisations under stress
Section timer	Ops metrics without recording call content against policy
Read-only talking points	Source of truth is legal-approved FAQ, not agent memory

Verdict: Script UI is a compliance instrument—if agents can edit talking points inline, you have recreated email drift in voice channel.

Identity verification before disclosure

IdentityVerificationPanel — Call CALL-8821 · Step 2 of 4 · Do not skip for account-specific answers
├── Tier 0 (no verification): General FAQ answers from [notice page](/designing-breach-faq-and-notice-landing-page-ui-in-figma/) · Public information only
├── Tier 1 (light verification): Email on file + last 4 of phone OR zip code · Confirm account exists
├── Tier 2 (full verification): OTP to email on file · Required before:
│   ├── Confirming caller was in affected segment
│   ├── Issuing [monitoring enrollment](/designing-breach-remediation-offers-and-credit-monitoring-enrollment-ui-in-figma/) code
│   └── Discussing data categories tied to their account
├── Failed verification:
│   ├── 3 attempts → Lock session · Offer callback after manual review
│   └── Direct to public FAQ · Do not guess eligibility
├── Social engineering flags:
│   ├── Caller refuses OTP but demands account detail → Escalate
│   └── Caller claims to be journalist → Media escalation path
└── Link: [Email OTP UI](/designing-email-verification-and-otp-ui-in-figma/) component reuse

Design verification as a stepper with explicit “what you can say now” unlock—agents should never disclose segment membership before Tier 2 passes.

Ticket tagging and CRM integration

BreachSupportTicket — VIN-992 · Ticket TKT-44102 · Channel: Phone · Agent: Support tier 1
├── Auto-tags: incident:VIN-992 · script:BS-992-v3 · channel:phone · locale:EN
├── Caller context (post-verification):
│   ├── Account ID (hashed display) · Segment: EU-A · Notification: IND-441 delivered
│   ├── Monitoring: Not enrolled · CTA sent via follow-up email
│   └── Prior tickets: 0 on this incident
├── Structured disposition:
│   ├── Topic: Eligibility · Monitoring · Password reset · Phishing concern · Other
│   ├── Resolved in script? Yes / Escalated / Callback scheduled
│   └── Follow-up template: IND-follow-up-v1 (pre-approved)
├── Escalation queue (if triggered):
│   ├── Privacy team · Legal · Executive comms · Fraud
│   └── SLA: Privacy 4h · Legal 24h · Show countdown in UI
├── Link: [Privacy request queue](/designing-privacy-request-queue-and-case-management-ui-in-figma/) if DSAR mentioned
└── Export: Ticket summary to [compliance export](/designing-compliance-exports-and-legal-hold-ui-in-figma/) on incident close

Disposition	Route to	Agent action
Monitoring enrollment help	Self-service + script section 5	Send enrollment link; do not read full SSN over phone
”Was my data stolen?”	FAQ block + eligibility	Tier 2 verify first; category-level answer only
Regulator or lawyer calling	Legal escalation	Stop script; warm transfer; no recording disclaimer change
DSAR / delete my data	Privacy queue	Create linked case; do not promise 24h deletion

Escalation and war room coordination

EscalationPanel — CALL-8821 · Trigger: Media inquiry · Routed to Executive comms
├── Escalation form (required fields):
│   ├── Trigger type · Caller role · Exact quote (agent notes) · Script section active
│   ├── Verification status · Account ID if verified
│   └── Urgency: Standard / Urgent / Legal hold
├── War room feed (read-only):
│   ├── Latest approved message from [war room](/designing-security-operations-shift-handover-and-war-room-ui-in-figma/)
│   ├── Do not share internal timelines with callers
│   └── Link to [status page](/designing-customer-incident-status-page-and-communication-ui-in-figma/) talking points only
├── Callback scheduler: Privacy specialist · 30-min slots · SMS confirmation to verified number
└── Audit: escalation_id · routed_to · acknowledged_at · resolution_note

Verdict: Escalation UI should capture what the caller asked in structured fields—free-text-only notes fail compliance review at scale.

Comparison: agent script vs adjacent tools

Tool	Focus	This UI adds
Notice FAQ	Public self-service	Voice channel with verification gates
Individual notification	Outbound comms	Inbound call handling tied to IND-* segments
Remediation offers	Enrollment UX	Agent-assisted enrollment without reading PII aloud
Privacy queue	Formal rights requests	Triage DSAR mentions during breach calls
War room	Internal incident ops	Approved external messaging feed for agents

Handoff checklist (Dev Mode)

BreachScript — script_id (BS-), incident_id, faq_version_id (NL-), sections[], forbidden_phrases[], published_at.
ScriptSection — section_id, sort_order, title, content_richtext, unlock_after_verification_tier.
VerificationSession — call_id, tier_reached, otp_sent_at, verified_at, failed_attempts.
BreachSupportTicket — ticket_id, incident_id, script_id, channel, disposition, escalation_id, caller_account_hash.
EscalationRecord — escalation_id, trigger_type, routed_team, sla_due_at, resolved_at.
FollowUpTemplate — template_id, channel, subject, body, linked_script_version.
Accessibility — High-contrast script panel; keyboard shortcuts for section jump; screen reader labels on verification stepper.

Common mistakes

Mistake	Why it hurts	Fix
Agents edit script text in CRM	Drift from legal-approved FAQ	Read-only sync from NL-* version
Disclose affected counts on calls	Re-traumatizing; may be wrong	Category-level FAQ answers only
Skip verification for ” upset caller”	Social engineering risk	Tiered unlock with empathy scripts
No link to FAQ version	Cannot prove what agents were told to say	BS-* stamped to NL-* on publish
Record calls without disclosure	Legal and jurisdiction issues	UI banner with recording state per region
Generic support macros	Wrong incident context	Auto-tag VIN-* on all breach tickets
Promise credit monitoring to ineligible callers	Contract and legal exposure	Eligibility check tied to IND-* segment
No escalation SLA visible	Callers stuck in limbo	Countdown and callback scheduler

Recommended workflow

Publish notice FAQ NL- v3* before activating breach script BS-* v3.
Train support tier 1 on verification stepper and forbidden phrases; run tabletop with privacy.
Activate script workspace when individual notification IND-* send begins.
Monitor call dispositions and propose new FAQ blocks—not ad hoc script edits.
Escalate media and legal calls immediately; do not extend script for non-tier-1 topics.
Export ticket and script audit to regulatory archive at incident close.

FAQ

Do agents need a separate script per locale?

Yes. Link BS-* variants to notice FAQ locale components—route calls by IVR language selection.

Can agents access forensic investigation notes?

No. War room and forensic tools are internal-only. Script sidebar shows approved external messaging only.

What if FAQ updates mid-shift?

UI shows out-of-sync banner; supervisor must acknowledge BS-* v4 rollout before agents continue tier-2 disclosures.

Should breach calls use a dedicated queue?

Recommended. Auto-tag VIN-* and apply breach-specific SLAs separate from billing support.

How does this relate to privacy queue?

Breach calls may mention DSAR or erasure—create a linked privacy case; do not resolve formal rights requests entirely in the breach script.

Next steps

Design breach FAQ and notice landing page UI in Figma — source of truth for agent talking points
Design affected individual breach notification and communication UI in Figma — outbound comms that drive inbound call volume
Design breach remediation offers and credit monitoring enrollment UI in Figma — agent-assisted enrollment handoff
Design privacy request queue and case management UI in Figma — escalate formal rights requests from breach calls
Design security operations shift handover and war room UI in Figma — approved messaging feed for support supervisors

Designing breach call center and agent script UI in Figma: guided responses, escalation, and FAQ sync