AI Safety for AI Agents That Call and Message in Europe: Beyond STIR/SHAKEN — Query-Scoped, Non-Bearer Communication Authority That Stops Spam, Robocalls and Post-Inquiry Harassment at the Network Edge, Supporting GDPR, ePrivacy and EU AI Act Transpa

Abstract When a user contacts businesses from a map, directory or marketplace, those businesses gain a contact reference that keeps working after the inquiry ends: a phone number, masked number, chat thread or callback link. Possessing the reference is enough to call or message again. The results include: follow-up spam and robocalls; resale of lead data; contact across unrelated inquiries; scraper-driven abuse. AI agents widen the problem. They now call and message businesses on users’ behalf, and business-side AI agents call users back, both potentially at machine scale. Europe has strengthened caller identity. France requires authentication of calls using national numbers, built on STIR/SHAKEN-style signed caller identity. Other regulators, including Ofcom in the UK and Traficom in Finland, have acted against spoofed calling-line identity. These measures prove who is calling. They do not prove that the caller is allowed to reach this person, for this purpose, now. A correctly authenticated business can still call a user who contacted it once, weeks ago, for something else. A correctly authenticated AI agent can still call far beyond the task it was given. This disclosure adds that missing authorization layer: Non-bearer contact references. Every phone number, masked number, chat handle, callback link or AI-agent contact reference is non-bearer. Knowing, storing, reselling or replaying it does not allow contact. Query-scoped handles. Each inquiry receives its own handle. Verification at an enforcement point. Contact is admitted only by an enforcement point that verifies a signed, context-bound authorization. Enforcement points include: the IMS core and session border controller; SIP proxies, WebRTC and TURN servers; SMS, RCS and email gateways; device brokers and CPaaS or marketplace messaging gateways. What the authorization is bound to. It covers: the handle, the inquiry and the business identity; the requesting actor, human or AI agent; the channel, the purpose and the permitted effect; validity, quota and revocation conditions. No path until verified. Until verification succeeds, no SIP dialog, media path, message delivery or notification exists. The path is absent rather than blocked. Identity and authority together. In networks with signed caller identity, the identity attestation shows who is calling, and the authorization artifact shows that this call is permitted. Both can be checked at the same SBC or IMS element before session setup. Preview, then separate future authorization. A bounded preview lets users compare businesses. Further contact needs a separate future authorization, granted only after the user selects, approves or books. The business may pay a lead or callback-extension fee, but never learns the user’s permanent number. No reuse or transfer. Authority cannot be reused for another inquiry or business. It cannot be transferred to affiliates or call centres, or widened through AI sub-agents. API credentials, OAuth sessions, platform accounts or carrier session setup alone do not authorize contact. Instant withdrawal. The user can withdraw at any time, and an epoch advance ends contact immediately. Fast enough for the call path. A precomputed scope-descriptor hash is compared with an attempt hash. Nonce, quota and revocation state are then updated atomically, in sub-millisecond to low-millisecond time. Only then is a short-lived bounded release capability issued, which the gateway consumes. Other protections. Keys and state can sit in a TEE, HSM, secure element or modem security processor. Signed receipts provide evidence. Failures fail closed with no fallback path. The claims run to claim 139 and include seven independent claims (1, 2, 79, 79A, 136, 138 and 139). They cover: enforcement-point methods and systems; privacy-preserved lead monetization; descriptor-hash hot-path verification; device-side release brokers; bounded release capabilities; AI-agent-initiated contact; recursive delegation tokens; proactive revocation; cross-service purpose control. EU relevance (AI-generated). This section was generated with AI assistance. It is not legal advice and does not state that any implementation satisfies EU or national law. Readers must cross-check it against the original PCT filing on WIPO PATENTSCOPE and the official legal texts before drawing any conclusion. Technical alignment does not itself establish regulatory compliance. The mechanisms may support objectives associated with: GDPR: purpose limitation and data minimization (Article 5), withdrawal of consent (Article 7(3)), and data protection by design (Article 25). Contact is bound to the inquiry’s purpose, the permanent number is never disclosed, and withdrawal takes effect instantly. ePrivacy Directive, Article 13: consent for unsolicited direct-marketing communications. Future contact requires a separate, user-triggered authorization. European Electronic Communications Code and national CLI rules: protection against nuisance calls, fraud and number misuse, complementing caller-identity authentication with authority-based admission. Digital Services Act: platform measures against misuse of messaging and contact features, through non-transferable, scope-bound authority and abuse feedback. EU AI Act, Article 50: transparency when people interact with AI systems. AI-agent identity is bound into every authorization and receipt. NIS2: security of electronic communications services, through hardware-isolated signing and fail-closed enforcement. European 6G programmes: the Smart Networks and Services Joint Undertaking and the Hexa-X-II flagship, where trustworthy, AI-native communication is a design goal. Industry relevance (AI-generated). This section describes technical relevance only. It is not an endorsement, a validation, a criticism or a statement of infringement, and no company named is affiliated with the inventor. Readers must cross-check it against the original PCT filing and official company sources. These are potential integration scenarios, not confirmed company implementations or product commitments. Orange. Orange operates under France’s caller-authentication regime. It is a network partner in Aduna in France, alongside Bouygues Telecom and Free, where CAMARA-based SIM Swap and KYC APIs launched in 2025. It has also presented its own live network-API portfolio to developers. The architecture could let Orange: add purpose and inquiry scope on top of authenticated identity at its IMS and SBC layer; offer a “verify contact authority” API to map, marketplace and travel platforms; give Orange Business voice, RCS and contact-centre customers guaranteed connection for authorized callbacks, while unauthorized follow-ups never ring. Nokia. Nokia supplies IMS and voice cores and AirScale baseband with the anyRAN approach. It runs Network as Code, with APIs such as Number Verification and Quality on Demand. It has led European 6G research through Hexa-X and Hexa-X-II, and is building AI-RAN products on NVIDIA’s ARC-Pro platform following NVIDIA’s $1 billion investment announced in October 2025. The architecture could become: a licensed feature in Nokia cores and SBCs; a contact-authority API on Network as Code; a hot-path function on AI-RAN edge compute; an AI-native 6G session-admission concept, in which AI agents reach people only within authorized scope. Other European relevance: Operators: Deutsche Telekom, Vodafone, Telefónica, Bouygues Telecom, Free, Telia, Swisscom. Network vendors: Ericsson, which co-founded Aduna. CPaaS providers: Sinch, Infobip, Vonage, Twilio. Platforms: Booking.com, Adevinta, Bolt, Doctolib, Just Eat Takeaway. Supervisors and standards bodies: BEREC, ARCEP, Ofcom, Traficom, the EDPB, national data protection authorities, ETSI and 3GPP. New revenue can come from: per-verification network APIs; consumer “no post-inquiry contact” tiers; callback-extension fees paid by businesses instead of buying phone numbers; higher connect rates for authorized business calls; lower fraud, complaint and compliance costs. This disclosure is based on PCT/IB2026/056771 (WO 2026/172333 A2, filed 1 July 2026, published 20 August 2026), which claims priority to PCT/IB2025/058316. It belongs to the family built on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026. The inventor is open to acquihire or strategic collaboration. Keywords: AI safety; trustworthy AI; AI agent calling; AI voice agents; agentic communication; STIR/SHAKEN; caller ID authentication; calling line identification; CLI spoofing; number authentication; anti-spoofing; anti-spam; anti-robocall; nuisance calls; anti-harassment; caller authorization; consent-based communication; purpose-bound communication; number masking; proxy numbers; masked calling; lead privacy; lead monetization; callback control; map business discovery; marketplace messaging; non-bearer token; context-bound authorization; anti-replay; revocation; SIP; SIP Identity; IMS; session border controller; WebRTC; SMS; RCS; CPaaS; network APIs; CAMARA; GSMA Open Gateway; Aduna; Network as Code; 5G-Advanced; 6G; AI-native networks; AI-RAN; Hexa-X-II; SNS JU; TEE; HSM; fail-closed; GDPR; consent withdrawal; ePrivacy Directive; European Electronic Communications Code; Digital Services Act; EU AI Act Article 50; NIS2; BEREC; ARCEP; Ofcom; ETSI; Orange; Nokia; Ericsson; Deutsche Telekom; Vodafone; Telefónica; Sinch; Infobip; Booking.com Zenodo file name: AI_Safety_for_AI_Agents_That_Call_and_Message_in_Europe_Beyond_STIR_SHAKEN_WO2026172333.pdf