KamoCRM

Phone_call calls whoever a team member named, looked up by name, with no approval and no consent gate, and never anyone else

FixMCPGatewayService
Shipped
October 15, 2026 at 4:57 AM UTC
Author
Kamo
Commit
a5789cc

Owner 2026-10-15: "When a supervisor, or any team member for that matter, tells SI to call someone else on the team, they should call them. No questions asked, no approval needed. [...] Just make the call if coming from a team member, no questions asked, to any person or number." Live case (crm, Luna, run cb459313, 00:42Z): Sage asked Luna in chat to call Briana. phone_call took a colleague only by memberId, Luna had no lookup loaded, and she called it with Sage's own memberId (call 05f93987 rang Sage's cell, consent RECORD lead:1200096283021764886); asked again, she said she needed Briana's verified details and her consent to AI calls (the tool description's "only people who agreed to AI calls"). - phone_call takes name (a teammate is looked up in the directory: one match is called; none is NO_SUCH_PERSON and several AMBIGUOUS_NAME, both telling the SI to ask the requester and never call someone else) and message. - A memberId beside a name that is not theirs is CALLEE_MISMATCH: "memberId X is Sage Nadjafinia, not Briana". - The planner weighs the run's own request (cited, or RequestVerifier.inferFromRun: author, channel, addressee, recency, run and taint all checked). A team member's request makes K6's consentBasis REQUESTED_BY_TEAM_MEMBER with requestedByMemberId, calleeName and message, for colleagues, leads, contacts and bare numbers alike. An email, a website chat or a caller never stands: those calls keep every consent check and approval. - A teammate with no number on their profile is called on their extension (K6 dials it) when someone asked for it. - The pipeline's approval step adopts the planner's request, so K3 sees it (implicit) and takes it as the approval. - K6's OPTED_OUT reads "Pat Lee asked us not to call on September 12, 2026. Tell the person who asked that instead of calling." (DownstreamErrors carries optedOutOn); NO_NUMBER asks the SI to get a number from the requester. - The description now says: call exactly who a teammate named, no approval or consent needed, never anyone else. - tools/list snapshots (cp04, cp07-audit, cp11-memory-off, cp13 intent-not-offered) regenerated: only phone_call changed. Tests: PhonePackTeamRequestTest (teammate by name to extension with message, the run's wake as the request, nobody or several by name, CALLEE_MISMATCH, lead/number to K6 as a team request, no approval through the pipeline, OPTED_OUT wording, email-originated never a team request); PhonePackTest updated where SP95 D3a was overruled. packs, pipeline, tools, policy, downstream, disclosure: 1075 run, the same 5 failures as origin/main (KnowledgeAndPeoplePacksTest, NotificationsPackTest, StrictReadTest; unrelated).

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free ForeverView Pricing