IAM.Agent: IAM.Voice scenarios through Core MCP

Read and edit real scenarios, check revisions and publish immutable versions without starting calls.

Permissions and environment

This development capability requires Core connected to the current IAM.Voice control plane. An administrator must bind the exact Core principal/tenant to a valid owner session for the intended Voice organization. These permissions are separate: a tenant-read API key does not grant scenario access. Expired or revoked sessions require administrator renewal; the client does not sign in on another user’s behalf automatically.

Enterprise and Community use the same discovered MCP catalog. Reads require voice:read; writes require voice:write and a separate administrator write grant. Other organizations’ projects remain inaccessible. Both actual client transports were checked on staging with owned educational projects, including foreign-organization, stale-revision and revoked-session refusals. This does not qualify every mobile UI sequence or a production release.

Complete a task

  1. Connect the supplied Core MCP using the service guide, test it and publish tools in Enterprise. For Community, the operator sets IAM_CORE_MCP_URL and IAM_CORE_MCP_TOKEN before starting the app.
  2. Check for voice.projects_list, voice.project_get, voice.project_versions, voice.project_save and voice.project_publish. Do not substitute a local scenario store when a tool is missing.
  3. Ask the agent to list projects and read the selected project by exact project_id. Review its current revision, name, starting step and graph transitions before editing.
  4. For a new project, review a draft with name, startStepId and steps; omit project_id. For an update, supply the exact project_id and the retrieved draft.revision. Review the inputs and approve the write request in the client.
  5. Read the saved project back first. Publish separately: voice.project_publish takes the exact project_id and revision. After approval, check voice.project_versions for the actual immutable published version.

Publishing does not activate a telephone route, start a call/campaign or change SIP credentials. Results contain activated: false. Telephony actions remain separate IAM.Voice operations with their own permissions.

Enterprise: masked HTTP header and discovery of two synthetic MCP tools
Enterprise: masked HTTP header and discovery of two synthetic MCP tools
2026-10-16 · Actual native .app development candidate; educational local MCP transport fixture, without real IAM services or customer data.
  1. MCP
  2. URL
  3. HTTP headers (NAME=VALUE per line)
  4. Save
  5. Test
  6. Discovered synthetic tools

This existing Enterprise capture illustrates the MCP connection and stored-header controls used in step1. Its caption identifies the educational transport fixture. It does not show a dedicated Voice project editor or prove the project operation itself; the real staging service checks described above were separate.

Recovery

On a revision conflict, read the project again, compare edits and review a new draft. Never retry the old write automatically. If a response is lost, inspect the list and exact project/version history first: the write may have completed.

For 401/403 or a delegated-session error, ask the administrator to restore the exact binding and permissions. Core verifies the current user, tenant and role before each operation and never switches to local data on refusal. Arbitrary URLs, tenant fields and cookies are not accepted in tool arguments.