"Sometimes the call is authenticated, sometimes not. Regardless, do you want any autheticated call to be able to run any arbitrary application including "system" on your switch?" yes, if the control is on the proxy, that would be handy, but that's not the case. and i already refered that it could be configurable. anyway, i do agree the patch does opens the system to security issues. i actually have it harcoded with intercept:tp_call_id, just wanted to give some options without success. i opened a jira ticket and will work from there. Thanks