Knowing Your Number Is Not Permission to Call: Authorization-to-Reach for Spam-Free, Privacy-First Communication in the 6G and AI-Agent Era

Abstract Robocalls, spam texts, and scam calls all exploit one design assumption: anyone who knows a phone number, SIP URI, or messaging handle can attempt contact. Once a number is shared with a business, a marketplace seller, a delivery driver, or a directory listing, it becomes a permanent, reusable route, and leaked or brokered contact data keeps that route open for anyone who obtains it. Existing defences answer different questions. STIR/SHAKEN verifies who is calling, not whether that caller is permitted to reach this recipient now. Virtual and masked numbers hide the real number but stay dialable while active. OAuth delegates API access but defines no telecom reachability rules. Spam scoring and call screening judge an attempt only after it has already been routed and signaled. This disclosure describes an authorization-to-reach model that separates knowing a contact identifier from permission to make contact. Each inbound call, message, or notification is held as a candidate request until an enforcement point, such as a session border controller, SIP application server, IMS node, or CPaaS gateway, validates a recipient-scoped grant bound to sender, recipient, purpose or transaction, channel, expiry, attempt quota, revocation epoch, and audience, with replay protection and sender binding so that a copied grant is not a bearer credential. Only then does the phone ring or the message get delivered; otherwise the request is rejected (for example with SIP 403) before any communication takes effect. Three deployment profiles, blocked path, pre-routing authorization, and absent path, allow incremental rollout over existing E.164 numbering, SIP, IMS, and PSTN infrastructure, while emergency calls (911/112) and lawful intercept remain unaffected. The gap grows as AI agents and AI-native 6G networks originate contact at machine speed. The record includes use cases (map and directory enquiries, marketplaces, ride and delivery, AI assistants), a comparison with existing approaches, a candidate grant format, possible STIR/PASSporT, SIP, and OAuth encodings, security and privacy analysis, a 58-question telecom engineering FAQ, and five workflow charts. A reference implementation is publicly available. Its central principle: possession of a communication identifier is not, by itself, permission to communicate. Download the full PDF to review the workflow charts, grant format, deployment profiles, and complete FAQ. Keywords: robocall prevention; spam call blocking; scam calls; SMS spam; caller ID spoofing; STIR/SHAKEN; PASSporT; SIP; IMS; session border controller; CPaaS; number masking; virtual numbers; privacy relay; consent to contact; contact data leakage; telecom fraud prevention; authorization-to-reach; purpose-scoped authorization; revocable grant; capability token; non-bearer token; OAuth RAR; DPoP; replay protection; zero-trust telecom; 6G; IMT-2030; AI-native networks; AI agents; machine-originated traffic; emergency call routing; TCPA; GDPR