A voice agent should never say a private value before the caller is verified, or any value its job does not need. Withhold the field from the model instead of banning it in the prompt. Dograh, the open-source AI voice agent platform you can self-host or run on Dograh Cloud, sends only the fields you template into a prompt.
Key Takeaways
- A field the model never receives can't be spoken, so template less.
- Verify through a yes-or-no tool so the stored value stays in your system.
- Redaction cleans stored copies after the call. It can't unsay a word.
This post is part of our guide to compliant AI voice agents, which counts every place a call's data goes. Below, we list what an agent should never say, then cover which fields to template, verification without exposure and who else hears the agent, all in Dograh.
What a voice agent should never say out loud
Most spoken leaks are an agent being helpful to the wrong person. A wrong number or a relative on a shared phone hears whatever the agent knows, and so does a caller fishing for details. OWASP's entry on sensitive information disclosure describes the same failure in chat, a user receiving another user's personal data, and its first fix is least privilege.
| Never say out loud | The control that stops it |
|---|---|
| Any order, amount, address, appointment, claim or health detail before verification | Disclosure tools sit only on the steps after verification |
| A full account, card or ID number | The business's system returns only the last four digits |
| The stored answer to a security question | A tool compares the answer and returns yes or no |
| Another customer's details | Account IDs come from call data, never from the caller |
| Keys, internal numbers or the agent's own instructions | None of them sits in the prompt |
| Account details inside a transfer introduction | The introduction instructions leave them out |
Each row follows one rule. The agent cannot say what it was never given, so the work happens before the call reaches the model.
Only templated fields reach the model
Dograh puts a value into a prompt only where you write it as a template variable, such as {{initial_context.first_name}}. Pre-Call Data Fetch can return a full customer record, and a campaign CSV can carry twenty columns, but nothing copies the whole record into the prompt. A date of birth that sits in the record and not in the prompt never reaches the model.
So the rule is to template only what the agent must say or check. "Do not mention the balance" is a weak instruction, because a model can avoid the word and still give away the meaning. OWASP's entry on system prompt leakage asks for sensitive data to be kept apart from prompts and for controls to be enforced outside the model, and leaving the field out does both.
Watch the Greeting Text most closely. It plays the moment the call connects, before anyone is verified, so it should name the business and nothing about the person's account. Give every variable a fallback, such as {{first_name | there}}, because a missing value is spoken as empty text.
What the caller says stays out of later prompts too. Values the agent extracts, the gathered_context, go to webhooks and the call record but never back into an agent prompt, so one caller's words are never read back through a variable.
Verify without showing the agent the answer
Verification should compare a value without the model ever holding it. An HTTP API tool sends what the caller said, plus the account ID as a Preset Parameter set to {{initial_context.account_id}}, to your own endpoint. The endpoint answers verified: true or false. The stored date of birth stays inside your system, and the agent has nothing to read back.
The tool's whole response reaches the agent, so the endpoint should return only the verdict and the fields this step may say. Attach tools that disclose details only to nodes after verification, so the order of check first, share second is built into the flow. Our overview of voice AI security for phone agents covers the failed-check path and callbacks to the number on file.
Masking belongs to your system as well. If the agent should say "the card ending in 4821", have the endpoint return last4 and template only that. The full number then never exists in the call. Reading spelled details back accurately is its own problem, covered in our post on names, numbers and emails on voice agents.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Who else hears what the agent says
The caller is not the only listener. On Twilio, Transfer Call can play a transfer introduction to both people before connecting them, and anyone who picks up hears it, including any member of a ring group. It is off by default and limited to 25 words. Its default instructions summarise the caller's request and essential details, so edit the Introduction instructions to name the reason for the call and leave every account value out.
Voicemail is a second listener you can't see. If the agent is set to leave a message, anyone with access to that mailbox hears it, so keep it to the business name and a callback number, with a reason that reveals nothing private.
Payment details are the clearest case of all. Never take card numbers on a call, because recordings and transcripts keep everything said. An HTTP API tool can ask your own system to send its secure payment link instead, as our post on payment-sensitive calls explains.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
What the transcript keeps
Everything the agent says lands in the transcript and the recording, and traces hold the prompts with their filled-in values when tracing is on. A value kept out of the prompt never reaches any of them. Redaction tools clean those stored copies after the call, which helps, but no tool can unsay a word the caller already heard.
Self-hosting with local models keeps prompts, transcripts and recordings on your own servers. Self-hosted Dograh has no per-minute platform fee, but servers, model keys and phone minutes still cost money. Dograh Cloud charges a 1¢-a-minute platform fee. Our post on where call data goes and how long it stays maps every stored copy.
Then check the design on real calls. Add a QA check such as "did the agent share any account detail before verification" and run it on a sample of live calls. A tagged call shows you which field reached the prompt, and the fix is almost always to take that field out.
Glossary
- Verify-then-disclose
- A call order where the agent greets, confirms identity with an approved check, and only then shares personal details. In Dograh it is enforced by attaching disclosure tools only to nodes after the check.
- Template variable fallback
- A default value in a placeholder, such as {{first_name | there}}, spoken when the field is missing. Without one, Dograh speaks the missing value as empty text.
- Masked field
- A value your system shortens before the call, such as the last four digits of a card. The agent can read it back without the full number ever reaching the model.
- Transfer introduction
- A short spoken line Dograh can play on Twilio to both the caller and the person who answers a transfer. Anyone on a ring group who picks up hears it, so it should carry no account values.
