Keep voice tools behind authenticated workspace approvals

Treat speech as a request channel

A spoken instruction conveys intent but does not establish authority over private workspace resources. Caller ID can be useful for routing allowed peers, yet it is not sufficient authentication for mailbox searches, account changes or connected app operations. Lupin asks incoming callers to request an authenticated callback through iMessage or the dashboard before granting private agent access. Build the dialogue around that fact. The system can explain how to continue securely without revealing whether a particular private message, contact or external account exists.

Preserve the existing agent permission boundary

Workspace operations are delegated to Lupin’s configured agent backend, retaining its model, tool discovery and permissions. The spoken conversation service does not receive unrestricted account credentials simply because it is handling audio. A number’s project ownership and the credential’s permissions continue to matter. The restricted registration key supports its documented bootstrap scope and does not authorize paid phone resources or external app writes. When a tool is unavailable, return the actual permission or configuration condition instead of swapping to an owner credential behind the user’s back.

Bind approval to exact structured effects

Sensitive actions create pending approvals in the authenticated workspace console. The request must identify the tool, account or resource and exact arguments the human will authorize. Saying yes during a call does not execute that request. If a caller changes a date, recipient or destination while approval is pending, generate the corrected action rather than silently reusing the earlier approval. Connected app execution also binds a discovered account revision and concrete tool version, so a reconnect invalidates stale approval context. Conversation continuity cannot substitute for that resource identity.

Keep returned content from becoming authority

A tool result can contain email text, web content or an external document that attempts to direct later actions. Treat it as task data even when read aloud by the assistant. For example, a calendar description asking the agent to send private notes elsewhere does not gain authority from the fact that an approved calendar lookup returned it. Summarize only the content needed for the current task and keep new effects behind their own authorization. Speech synthesis should not turn an untrusted quoted instruction into a trusted system command.

Test denial and correction as normal paths

Use a synthetic incoming caller asking for private email, an authenticated callback requesting a permitted lookup, and a pending write whose arguments change mid-conversation. Verify that the first receives secure continuation instructions, the second follows scoped access and the third requires updated approval. Include a provider disconnect while approval is pending: the action should remain reviewable without assuming spoken completion. Record only test identities and structured outcomes. These cases demonstrate that natural voice interaction can coexist with clear authority boundaries rather than depending on the caller to phrase requests perfectly.

Test a pending write after disconnection

Prepare a synthetic calendar change, end the voice session before the owner approves it and inspect the authenticated pending action. The proposal should remain exact and reviewable, with no execution caused by the call ending. A new session can explain its status without treating previous conversational assent as the missing grant.

Sources & verification

Reviewed against current checked-in Lupin routes, shared contracts and official provider references. No live calls, OAuth authorizations, app actions or purchases were performed.

• Lupin phone, SMS and calls ↗Checked 2026-11-05
• Lupin connections ↗Checked 2026-11-05
• Lupin authentication ↗Checked 2026-11-05

Prepared with AI assistance by Lupin editorial. How we research and maintain these guides.