What a voice agent should say before verifying the caller

Your voice agent looks up the calling number, finds a customer and greets them by name. That works when the account holder is calling. But phones get shared, handed to children and left on desks. Caller ID tells you which number is calling, not who is holding the phone.

The fix is to treat the match as a guess. Offer the first name as a question. Say nothing else from the profile until the caller confirms. Keep the unconfirmed profile out of the agent’s long-lived memory. That matters if your agent can read out account details, because a wrong match then tells a stranger about someone else’s money.

The last part is the one that is easy to miss. We ran the profile lookup from Rasa’s session-start personalisation pattern against Rasa’s own memory code. We set up the memory objects by hand, with no server, model bootstrap or model. Then we rendered the Project Memory section with Rasa’s own formatter and template, and tried to set the name again, to None. Output trimmed: Rasa’s debug log lines are left out.

### Project Memory
These facts are already set for this session and will remain so throughout this session.
- project.customer_name: Jordan
- project.customer_tier: Premier
- project.member_since: 2019
- project.time_of_day: morning
- project.default_account_id: acc_checking
- project.default_account_label: Everyday Checking
--- try to clear customer_name
ProjectMemoryAlreadySetError: Project memory field 'customer_name' is already set and cannot be overwritten.

Note the second line: it tells the model these facts “will remain so throughout this session”. In the Rasa Pro source, this section goes into the system prompt for routing and for the active skill.

So a shorter greeting is only half the job. If the lookup wrote the profile to project memory, the model still sees it, labelled as settled fact. In Rasa Pro 3.21.0.dev5, a tool that writes to a set project field through context.memory gets the error above, even when it writes None.

Why it happens

The pattern was written for a customer who has already signed in. The comment above its demo profile says a real deployment would take the customer “from the authenticated session / channel identity”. On a phone line, the channel identity is the calling number.

The session opener is a skill whose whole body is two steps. This excerpt is from skills/default_session_start/skill.md:

:::ordered_block id=main
steps:
  - id: identify
    execute_tool: get_customer_profile
  - id: greet
    action: utter_greet
:::

identify fetches the profile and greet speaks. Nothing between them asks whether the profile belongs to the caller. The README says the greeting fires “before the user types anything”, so the caller cannot correct anything first.

The greeting puts the name, tier and joining year in its first two sentences. This is the whole response file, skills/default_session_start/responses.yml, without its comment lines:

responses:
  utter_greet:
    - text: >-
        Good {session.project.time_of_day}, {session.project.customer_name}!
        Always great to see a {session.project.customer_tier} member who's been
        with us since {session.project.member_since}. How can I help you today?
      metadata:
        rephrase: true

Here is what that can sound like. This script is illustrative: Northgate Bank and the household are made up. The agent’s lines use the pattern’s greeting, the example offer in its transactions skill and its demo transaction rows. Jordan’s teenager is returning a missed call from Jordan’s phone.

Agent: Good afternoon, Jordan! Always great to see a Premier member who’s been with us since 2019. How can I help you today?

Caller: Er, what’s gone into the account recently?

Agent: Want your usual Everyday Checking, Jordan?

Caller: Yeah.

Agent: The only money in recently is a payroll deposit of $2,150.00 on 22 July.

Nothing here is a bug. The pattern’s guards are aimed at the model inventing a name, a tier or a payment. Every fact above was real and correctly looked up. It went to the wrong listener.

Where the profile goes after the greeting

Cutting the tier from the greeting does not remove it from the model. We read the Rasa Pro source to see where profile facts end up:

The middle row is the one that matters. Project memory holds facts that every skill in the agent can read. The pattern’s lookup tool writes six fields there, and Rasa lists them under the heading shown at the top of this page.

How to fix it

This guide recommends one approach: a number match earns a first name, asked as a question, and nothing else. The cost is one extra turn for the real customer. The first three steps are for whoever owns the words. The last is a requirement to hand to your engineer.

        context.memory.set("customer_name", _CUSTOMER_PROFILE["preferred_name"])
        context.memory.set("customer_tier", _CUSTOMER_PROFILE["tier"])
        context.memory.set("member_since", _CUSTOMER_PROFILE["member_since"])
        context.memory.set("time_of_day", time_of_day)
        context.memory.set("default_account_id", _CUSTOMER_PROFILE["default_account_id"])
        context.memory.set(
            "default_account_label", _CUSTOMER_PROFILE["default_account_label"]
        )

schema:
  private:
    candidate_name:
      type: text

        context.memory.set("candidate_name", _CUSTOMER_PROFILE["preferred_name"])
        context.memory.set("time_of_day", time_of_day)

--- after lookup, session-start skill
### Project Memory
These facts are already set for this session and will remain so throughout this session.
- project.time_of_day: morning
skill memory lines: ['default_session_start.candidate_name: Jordan']
--- after lookup, view_transactions skill
### Project Memory
These facts are already set for this session and will remain so throughout this session.
- project.time_of_day: morning
skill memory lines: []
--- caller says "no": clear candidate_name
cleared
--- after the no, session-start skill
### Project Memory
These facts are already set for this session and will remain so throughout this session.
- project.time_of_day: morning
skill memory lines: []

How to check the fix works

First, list what your project writes into memory. Run this from the project folder:

On the pattern, it printed these lines, unedited:

skills/default_session_start/tools.py:50:        context.memory.set("customer_name", _CUSTOMER_PROFILE["preferred_name"])
skills/default_session_start/tools.py:51:        context.memory.set("customer_tier", _CUSTOMER_PROFILE["tier"])
skills/default_session_start/tools.py:52:        context.memory.set("member_since", _CUSTOMER_PROFILE["member_since"])
skills/default_session_start/tools.py:53:        context.memory.set("time_of_day", time_of_day)
skills/default_session_start/tools.py:54:        context.memory.set("default_account_id", _CUSTOMER_PROFILE["default_account_id"])
skills/default_session_start/tools.py:55:        context.memory.set(
skills/view_transactions/tools.py:74:    context.memory.set("selected_account_label", account["label"])

The six session-start names are declared in the root memory.yml, so they are project memory. The grep can miss writes made through a helper or a name built at run time, so read memory.yml alongside it.

Then rehearse the wrong listener with a colleague, once your engineer has a build with a confirmation step. This is a proposed test, not a result we have:

Passing shows one conversation went right. It does not show every call will, and it does not test a caller who lies.

Trade-offs

The real Jordan hears a less warm opening and answers one extra question. Whether that is worth it is your call; the other side of it is a stranger hearing the customer’s pay.

Even the name has a cost. Saying “Jordan” tells whoever holds the phone that Jordan banks with you. For a service where the relationship itself is sensitive, greet without the name.

A “yes” is not verification either. Anyone willing to lie, including someone calling from a spoofed number, gets past it. If tier and tenure are too much to risk on that, move them to the third row of the table.

Limits

• This is a design argument, not a measurement. We have no figures for spoofed numbers or shared phones.
• Both memory runs used Rasa’s memory code, wired by hand, with no server, model bootstrap or model. We did not run the pattern on a phone channel, and the pattern has no tests.
• The prompt table comes from reading the Rasa Pro 3.20.0rc1 source, compared with 3.21.0.dev5, not from a live call. It shows what goes into each prompt, not what a model does with it.
• The write and reset runs were offline, outside a running server, and we did not search the engine for other reset paths.
• It does not define verification. It covers calls the customer places, not calls the agent makes.

Questions a designer will ask

import asyncio, importlib.util, sys
from pathlib import Path

from rasa.shared.core.slots import AnySlot
from rasa.shared.core.trackers import DialogueStateTracker
from rasa.mantle.memory.manager import MemoryManager
from rasa.mantle.memory.schema import ProjectMemorySchema
from rasa.mantle.skills.catalog import load_skill_catalog, load_default_skill_catalog
from rasa.mantle.state.tracker_handle import TrackerHandle
from rasa.mantle.tools.decorator import ToolContext
from rasa.mantle.prompts.memory_lines import partition_prompt_memory_entries, format_memory_prompt_lines
from rasa.mantle.prompts import system_prompt as sp

ROOT = Path(sys.argv[1])
project = ProjectMemorySchema.from_yaml(ROOT / "memory.yml")
catalog = load_skill_catalog(ROOT, defaults=load_default_skill_catalog())
slots = [AnySlot(f"project.{n}", mappings=[]) for n in project.fields]
tracker = DialogueStateTracker("probe", slots)
handle = TrackerHandle(tracker)
handle._memory_manager = MemoryManager(catalog, project, handle)
scope = ("default_session_start", "default_session_start")

spec = importlib.util.spec_from_file_location("ss_tools", ROOT / "skills/default_session_start/tools.py")
mod = importlib.util.module_from_spec(spec); spec.loader.exec_module(mod)
fn = getattr(mod.get_customer_profile, "__wrapped__", None) or getattr(mod.get_customer_profile, "fn", None) or mod.get_customer_profile
ctx = ToolContext(handle, memory_scope=scope)
asyncio.run(fn(context=ctx))

project_entries, _ = partition_prompt_memory_entries(handle.memory.read_all(*scope))
print(sp.render_template(sp.PROJECT_TEMPLATE, project_lines=format_memory_prompt_lines(project_entries)))
print("--- try to clear customer_name")
try:
    ctx.memory.set("customer_name", None)
    print("cleared")
except Exception as e:
    print(f"{type(e).__name__}: {e}")

env -i HOME=$HOME PATH=/usr/bin:/bin .venv/bin/python probe.py patterns/session-start-personalization 2>/dev/null

    return ToolResult(llm_response={"ok": True, "time_of_day": time_of_day})

import asyncio, importlib.util, sys
from pathlib import Path

from rasa.shared.core.slots import AnySlot
from rasa.shared.core.trackers import DialogueStateTracker
from rasa.mantle.memory.manager import MemoryManager
from rasa.mantle.memory.schema import ProjectMemorySchema
from rasa.mantle.skills.catalog import load_skill_catalog, load_default_skill_catalog
from rasa.mantle.state.tracker_handle import TrackerHandle
from rasa.mantle.tools.decorator import ToolContext
from rasa.mantle.prompts.memory_lines import partition_prompt_memory_entries, format_memory_prompt_lines
from rasa.mantle.prompts import system_prompt as sp

ROOT = Path(sys.argv[1])
project = ProjectMemorySchema.from_yaml(ROOT / "memory.yml")
catalog = load_skill_catalog(ROOT, defaults=load_default_skill_catalog())
names = [f"project.{n}" for n in project.fields] + ["default_session_start.candidate_name"]
tracker = DialogueStateTracker("probe", [AnySlot(n, mappings=[]) for n in names])
handle = TrackerHandle(tracker)
handle._memory_manager = MemoryManager(catalog, project, handle)
start = ("default_session_start", "default_session_start")

spec = importlib.util.spec_from_file_location("ss_tools", ROOT / "skills/default_session_start/tools.py")
mod = importlib.util.module_from_spec(spec); spec.loader.exec_module(mod)
fn = getattr(mod.get_customer_profile, "__wrapped__", None) or getattr(mod.get_customer_profile, "fn", None) or mod.get_customer_profile
ctx = ToolContext(handle, memory_scope=start)
asyncio.run(fn(context=ctx))

def show(label, scope):
    project_entries, skill_entries = partition_prompt_memory_entries(handle.memory.read_all(*scope))
    print(f"--- {label}")
    print(sp.render_template(sp.PROJECT_TEMPLATE, project_lines=format_memory_prompt_lines(project_entries)))
    print("skill memory lines:", list(format_memory_prompt_lines(skill_entries)))

show("after lookup, session-start skill", start)
show("after lookup, view_transactions skill", ("view_transactions", "view_transactions"))
if sys.argv[2:] == ["yes"]:
    print('--- caller says "yes": write the confirmed name to project memory')
    name = ctx.memory.get("candidate_name")
    ctx.memory.set("customer_name", name)
    ctx.memory.set("candidate_name", None)
    show("after the yes, session-start skill", start)
else:
    print('--- caller says "no": clear candidate_name')
    ctx.memory.set("candidate_name", None)
    print("cleared")
    show("after the no, session-start skill", start)

env -i HOME=$HOME PATH=/usr/bin:/bin .venv/bin/python variant_probe.py patterns/session-start-personalization no 2>/dev/null
env -i HOME=$HOME PATH=/usr/bin:/bin .venv/bin/python variant_probe.py patterns/session-start-personalization yes 2>/dev/null