How is security handled in a situation like this? (I'll end up reading up on it). But I mean things like how does the API let a specific session with a specific user only surface information for that specific user from the available tooling?
You first authenticate via the phone (you can run an initial api call on phone start,) save session credentials in state on 11labs side and can then pass them back to future tool calls. You can then authenticate via a passcode if you wish
