# reference-check agent called the candidate's current manager - the consent flag sat in a field the agent never read

## TL;DR

The consent flag existed in the ATS but the agent's prompt never mentioned it, so it called the candidate's current manager and risked their job. Make consent a hard gate: the agent must read the field and refuse to contact non-consented references. This is a safety issue, not a data issue.

```text
reference-check agent called the candidate's current manager - consent flag unread
```

## Steps

1. Confirm what happened: check the ATS consent field for the candidate and the call log.
   Expected: Consent was 'no' or unset, and the call went out anyway.

2. Add consent as a hard gate in the agent's workflow: read the consent field first; if not explicitly yes, do not contact.
   Expected: The agent refuses without consent.

3. Default to the safe side: treat missing consent as no consent, never as yes.
   Expected: Unset fields block instead of permitting.

4. Notify the candidate and document the incident; a current-employer contact can cost someone their job.
   Expected: The incident is owned and disclosed.

5. Add a pre-send checklist to every outbound reference workflow: consent verified, correct person, correct relationship.
   Expected: The checklist runs before every contact.

## When to use

- a reference contact went to a non-consented person
- the agent contacts references autonomously
- consent lives in a field the agent ignores

## When not to use

- consent was given and the right person was contacted (working as intended)
- references are collected via survey links, not calls (different workflow)
- the candidate explicitly asked for the current manager to be contacted

## Tool compatibility

- any reference-check agent
- ATS consent fields

## Variant phrasings

- "reference agent called current manager no consent"
- "consent flag unread reference check"
- "agent contacted employer without permission"

## Why it happens

Consent is a field, and agents only respect fields their instructions mention. The reference workflow was built around scheduling and questions, and consent was a column nobody wired into the prompt. The agent did exactly what it was told; what it was told was incomplete in the most dangerous way.

## Edge cases

- consent can be revoked; re-check at contact time, not just at scheduling time
- verbal consent needs a written record the agent can read; otherwise it does not exist to the agent
- different jurisdictions have different rules; the gate should be configurable per region

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_16Buzxq263-VNqq988Wsww