Write the decision map before the dialplan
Define a short prompt and the destination for every advertised digit. Include no input, invalid input and an unavailable destination. A menu that works only when callers press the expected key is incomplete.
Contexts form a call-permission boundary. Keep untrusted inbound routes separate from privileged outbound patterns.
Collect and validate digits
The Read application collects digits into a named variable and exposes a result status. Choose a maximum length, retry count and timeout suitable for the menu. Interpret the status and map accepted values to an explicit set of internal destinations.
Never treat caller-entered text as an unrestricted dial string or a shell command. Keep inbound menu contexts separate from privileged outbound dialing routes.
Test the media path
Use a known prompt format installed on the server. Listen from both an internal phone and an external test number. If the prompt plays but digits do not register, investigate DTMF negotiation before rewriting the routing logic.
Make failure useful
After a bounded number of retries, route to a staffed destination or a clear message. Avoid infinite loops between menus. Test business-hours transitions and a transfer to a busy extension. Retain a written menu map with the configuration so another administrator can change a destination without guessing at the caller experience.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.