reference-check agent called the candidate's current manager - the consent flag sat in a field the agent never read

reference-check agent called the candidate's current manager - the consent flag sat in a field the agent never read

TL;DR

The consent flag existed in the ATS but the agent's prompt never mentioned it, so it called the candidate's current manager and risked their job. Make consent a hard gate: the agent must read the field and refuse to contact non-consented references. This is a safety issue, not a data issue.

reference-check agent called the candidate's current manager - consent flag unread

Steps

1. Confirm what happened: check the ATS consent field for the candidate and the call log. Expected: Consent was 'no' or unset, and the call went out anyway.

2. Add consent as a hard gate in the agent's workflow: read the consent field first; if not explicitly yes, do not contact. Expected: The agent refuses without consent.

3. Default to the safe side: treat missing consent as no consent, never as yes. Expected: Unset fields block instead of permitting.

4. Notify the candidate and document the incident; a current-employer contact can cost someone their job. Expected: The incident is owned and disclosed.

5. Add a pre-send checklist to every outbound reference workflow: consent verified, correct person, correct relationship. Expected: The checklist runs before every contact.

When to use

• a reference contact went to a non-consented person
• the agent contacts references autonomously
• consent lives in a field the agent ignores

When not to use

• consent was given and the right person was contacted (working as intended)
• references are collected via survey links, not calls (different workflow)
• the candidate explicitly asked for the current manager to be contacted

Tool compatibility

• any reference-check agent
• ATS consent fields

Variant phrasings

• "reference agent called current manager no consent"
• "consent flag unread reference check"
• "agent contacted employer without permission"

Why it happens

Consent is a field, and agents only respect fields their instructions mention. The reference workflow was built around scheduling and questions, and consent was a column nobody wired into the prompt. The agent did exactly what it was told; what it was told was incomplete in the most dangerous way.

Edge cases

• consent can be revoked; re-check at contact time, not just at scheduling time
• verbal consent needs a written record the agent can read; otherwise it does not exist to the agent
• different jurisdictions have different rules; the gate should be configurable per region

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_16Buzxq263-VNqq988Wsww