Step-up authentication for AI voice interactions

[SarvangiM]

Step-up authentication lets an AI voice agent ask an already authenticated caller for one more verification before it handles a request that needs extra assurance. 

Callers authenticate once, with the factors you choose in AI Voice Assistant Designer. That is right for most requests. Some, like resetting a password, changing payment details or moving loyalty miles, deserve more. With step-up, you choose the agents that handle those requests and require one more check there. Everything else flows as before. 

This post covers how step-up differs from baseline authentication and how to set it up, then walks through an illustrative airline example. Your agents and requests will differ; the pattern carries over. 

How it works 

• The voice assistant understands what the caller wants and hands the request to the matching agent, as it does for any request. 

• If that agent requires step-up, the caller completes one more check with the step-up factor you selected. 

• Once verified, the agent continues with the request, and the caller stays stepped up for the rest of the call. 

Baseline authentication and step-up 

	Baseline authentication	Step-up authentication
Purpose	Verifies who the caller is.	Adds assurance for high risk requests.
Runs	When the caller asks for something that requires authentication, or at the start of the call if you set it that way.	After baseline authentication, when the request reaches an agent that requires step-up. If a caller’s first request reaches such an agent, baseline authentication runs first.
Applies to	Identified callers.	Authenticated callers only.
Configured in	Caller verification, for each voice assistant.	A step-up factor selected in Caller verification for each voice assistant, then turned on for each AI agent that needs it in AI Agent Studio.
Factors	KBA, Soft PIN, TOTP, SMS OTP, Email OTP, Okta Verify push. One factor or two (MFA).	Okta Verify push, TOTP or SMS OTP. One factor only.
Attempts	Retries, 3 by default.	Single attempt.

Step-up applies to voice calls, and to a whole AI agent rather than to individual tools. 

Where it fits 

Step-up suits any service where some requests carry more value or risk than others. Illustrative examples: 

Industry	Requests that fit step-up
Travel	Reset an account password, or transfer or redeem loyalty miles
Financial services	Add a payee or change contact details
Employee services	Reset a password or update direct deposit details
Retail	Change the delivery address on a high-value order

Before you begin 

You need	Notes
Release	Australia Patch 7 or Brazil Patch 1 onward
System property	glide.conv_ai_voice.step_up.enabled is true (the default)
Voice assistant	Caller verification set up, with baseline authentication
Fallback	A fallback chosen on the Safeguards screen in AI Voice Assistant Designer: live agent transfer or incident creation
Step-up factor	Okta Verify push, TOTP or SMS OTP, set up and enrolled for your callers (see Step-up factors)
AI agent	A voice AI agent, edited in the new AI Agent Studio experience
Role	auth_factors_admin, sn_voice_aia.admin

The example: Acme Air 

Context: Maya, an Acme Air loyalty member, already verified with KBA to rebook a cancelled flight. KBA is a low-assurance factor, so for a request like a password reset, Acme Air wants one more check. They require step-up on the Password reset with voice AI agent and choose SMS OTP as the step-up factor. The rebooking agent does not require step-up. 

Who	Says	Behind the scenes
Maya	“I need to rebook my cancelled flight.”	Authenticated with KBA. The rebooking agent does not require step-up, so the request is handled
Maya	“I also forgot my loyalty account password. Can you reset it?”	The request reaches the Password reset with voice AI agent, which requires step-up
Agent	“For a password reset I need one more verification. I’ve sent a code to the mobile number on your account. What is it?”	An SMS OTP goes to the mobile number on Maya’s user record. The wording is illustrative
Maya	“4, 8, 2, 9, 1, 7.”	The code matches. The agent continues: “Thanks, you’re verified. I’ve sent a reset link to the email on your account.”

If Maya had entered a wrong code, the call would go to the fallback Acme Air configured on the Safeguards screen: a live agent transfer or incident creation. 

Set it up 

Step-up needs two settings, on two screens: a step-up factor for the voice assistant, and the requirement on each agent. You can complete them in either order. 

Step 1: Select the step-up factor 

For a new voice assistant, choose the step-up factor while you set up Caller verification in Assistant Designer.  

For an existing assistant, open Assistant Designer, find your voice assistant and select Edit. Go to Settings > Caller verification, select Add on the Step-up authentication card and choose the factor. The card sits below the authentication factors. 

Setting	Example value
Step-up factor	SMS OTP

One step-up factor per voice assistant, shared by every agent that requires step-up. You can choose the same factor you use for baseline authentication. The caller receives a new challenge: with SMS OTP, a new code. Selecting a step-up factor is mandatory for any voice assistant that an agent requiring step-up uses. 

See which agents need it. Once an agent requires step-up, the card names that agent, so you can see at a glance which agents rely on the factor. Each factor also shows an assurance level (for example, KBA is Low and SMS OTP is Medium) to help you choose. 

Step 2: Require step-up on the agent 

Step-up is set for each AI agent in the Access rules section of AI Agent Studio. Use an existing voice AI agent or set it while you create a new one. Turn on Require step-up authentication of users.  

The page also shows a reminder: every voice assistant that uses this agent needs a step-up factor selected in Caller verification. Select Go to Assistant Designer to open the list of assistants, then follow Step 1 for each one. The voice assistants that use the agent are listed under Channels > Otto voice assistants. 

Until a step-up factor is selected, callers who reach this agent go to the fallback you configured on the Safeguards screen in Assistant Designer: live agent transfer or incident creation. 

Note: Agents from an application collection open read-only: use Edit in original scope to change them. 

Step 3: Test it 

Test	Caller does	Expected result
Happy path	Authenticates, asks for the step-up request, enters the correct code	Agent continues with the request
First request needs step-up	Asks for the step-up request before authenticating	Baseline authentication runs first, then the step-up check
No step-up needed	Authenticates, asks for something an agent without step-up handles	Handled with no extra check
Wrong code	Enters an incorrect code (one attempt only)	The call goes to the fallback set on the Safeguards screen
No step-up factor	Asks for the step-up request on an assistant with no step-up factor selected	The call goes to the fallback set on the Safeguards screen

Plan your agents 

Step-up follows the agent, so how you group requests into agents shapes the caller experience. 

Practice	How
Group by assurance	Put requests that need extra assurance in their own agent and turn on step-up there. Other requests stay in agents without step-up.
Keep each agent focused	Step-up applies to the whole agent, so a simple lookup placed in a step-up agent triggers the check too.
One home per high-assurance action	Offer each high-assurance action only through agents that require step-up.
Name and describe agents clearly	The voice assistant relies on an agent’s name and description to match a request, so make both distinct.

For Acme Air, that looks like this: 

Agent	Handles	Step-up
Flight status and rebooking	Look up and change bookings	Off
Loyalty account help	Balance and activity lookups	Off
Password reset with voice AI agent	Sends a password reset link	On

If password reset sat inside Loyalty account help, every balance lookup would trigger the check too. Splitting them keeps routine requests quick. 

Step-up factors 

	Okta Verify push	TOTP	SMS OTP
Caller does	Approves on a registered device	Says or keys in a time-based code from an authenticator app	Says or keys in a code sent by text message
Caller needs	Okta Verify installed and signed in	An authenticator app set up on their profile	A mobile number on their user record

These three factors offer a stronger security posture for advanced risk scenarios, so KBA, Email OTP and Soft PIN are available for baseline authentication only. 

Troubleshooting 

Symptom	Check, in order
Step-up never runs	The glide.conv_ai_voice.step_up.enabled property is true; step-up is on for the agent that handles the request, and the step-up card in Caller verification names that agent; the request reaches that agent (review its name and description); the caller authenticated first
The step-up toggle is missing	The agent is open in the new AI Agent Studio experience; an application-collection agent is open in its original scope
Callers go to the fallback unexpectedly	A step-up factor is selected in Caller verification for that voice assistant; the caller entered the correct code, since only one attempt is allowed
Callers cannot complete the check	The caller is enrolled in the factor; for Okta Verify push, the API key is valid; for SMS OTP, the provider is active and the mobile number on the user record is correct

Wrap-up 

Step-up authentication adds a second checkpoint at the agent level for authenticated callers, using one factor and a single attempt. Routine requests stay quick. Requests that need extra assurance get the check they warrant. A caller who does not pass goes to the fallback you configured. 

To get started, list the requests that need extra assurance, group them into their own agents, turn on step-up for those agents, and select the step-up factor in Caller verification. 

Learn more 

• Step-up authentication (product documentation) 
• AI voice agents are here (getting started and FAQs) 
• Caller verification for AI voice agents (overview)