Identified is not verified, and voice agents keep confusing the two

The caller told your agent who they were. Your agent believed them, and then acted on it.

A voice or chat agent handling accounts has to establish who it is talking to. Almost all of them do the first half well: they collect a name, an account reference, a date of birth, and they route on it. Very few do the second half, which is proving that the person supplying those details is the person they describe.

The details are usually not secret. A name and an account number are semi-public, and the rest is frequently derivable. Once the agent treats the claim as established, everything downstream inherits the mistake, including the tools that write.

The tell is in the transcript rather than the code. The agent moves from asking to assuming in a single turn, and after that it never re-establishes identity even when the request escalates from reading something harmless to changing something that matters.

Guardrails do not catch this because nothing hostile is said. The conversation is cooperative from end to end. It is a business logic failure wearing the clothes of a normal support call.

The check to run: read a transcript and mark the exact turn where your agent stops verifying and starts assuming. Then list every tool it can reach after that turn. That list is your actual blast radius.