# OPS-233 — A spoken consent record must name the agent who took it

> Every consent record must carry the identifier of the agent who read the consent script.

- **Rule ID:** OPS-233
- **Layer:** Operational (`OPERATIONAL`)
- **Checks:** `campaign.message_flow + privacy policy`
- **Severity:** MEDIUM — Usually survives review, but lowers your trust score or invites manual review.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** FTC, practice
- **Applies:** Applies when consent was collected by live verbal.
- **Canonical URL:** https://ekas.io/rules/10dlc/operational/ops-233/

## Why this rule exists

A verbal opt-in has no artifact the consumer touched, so the whole evidentiary weight sits on the call. Naming the agent is what makes the record investigable: it is how a brand finds out that one agent has been paraphrasing the script, and how it shows a regulator that it looked. Contact centres omit it because the CRM records the account owner rather than whoever was on the call.

## How to fix it

Store the agent identifier — the login, extension or badge number of the person who read the script — on each verbal consent record. Done when any consent record names a specific person, not a team or a queue.

## Example of a compliant value

```text
Verbal opt-ins store agent_id: acme-cs-0142 with the call UCID and the script version read.
```

## Notes

Registration-side twin: we judge whether the programme describes storing the field, never whether the stored record exists.