Telenaas communications
Authpermit decides what should happen; Telenaas reaches the person. Every text Authpermit sends goes through Telenaas for a purpose, and every attempt leaves a receipt (GET /api/v1/comms/deliveries). No product calls Telenaas directly.
| Purpose | Telenaas | What happens |
|---|---|---|
| Phone verification, the SMS/WhatsApp factor | TeleAuth | Telenaas generates, sends and checks the code; Authpermit never sees it |
| "Was this you?" | Messages | A sign-in from a new device (or a risky one) is texted to the verified phone. YES marks it yours; NO signs it out, asks your other sessions to verify again and opens an account-takeover incident |
| Approval by SMS | Messages | Approvers with a verified phone get "Reply APPROVE code or DENY code"; the reply is their signed vote, with every approval rule applied. Approvals that need MFA are decided in the console |
| Critical incidents, AI incidents, legal deadlines | TeleGuard | An alarm that texts security analysts (compliance officers for deadlines), then admins, then owners until someone replies YES |
| Notices to several people | TeleAlert | One-way |
Your phone
Settings → Security → Phone (or /api/v1/app/phone in the apps): verify a number by SMS or WhatsApp. It becomes your text-code factor — email plus a text code is AAL2; it never reaches AAL3 and is offered after passkeys and authenticator apps. Changing the phone on your profile unverifies it. Turn off sign-in alerts with login_alerts: false in your settings.
Organization settings
telenaas_approvals (false: no approval texts), teleguard_escalate (false: no TeleGuard), teleguard_min_severity (default critical).
When it is not configured
Nothing pretends. Without a Telenaas key every send is unavailable; with a key but no sender number, codes are still sent when Telenaas can route them and everything else is unavailable: no sender number — recorded on the receipt, the prompt, the incident or the response link. GET /api/v1/comms/status says what works now.
Inbound webhook
POST /webhooks/telenaas accepts only deliveries signed x-telenaas-signature: v1=HMAC-SHA256(secret, "<timestamp>.<body>") within five minutes, and processes each delivery id once. Subscribe it to sms.received whatsapp.received sms.status sms.opted_out sms.opted_in.
API and MCP
GET /api/v1/comms/status, /comms/deliveries, /comms/prompts (scope comms:read); POST /api/v1/response/escalate with provider: "teleguard" (incident:manage). MCP: authpermit_comms_status, authpermit_comms_deliveries, authpermit_comms_prompts, authpermit_response_escalate.