Voice agents increasingly issue tool calls that disclose private information or modify external state. Correct intent recognition is not sufficient for authorization when identity, entity values, confirmation, or policy evidence is stale, missing, or contradictory. We introduce VoiceAgentGuard, a model-agnostic runtime gate that separates a planner’s proposed action from release. For every private-read or mutating call, it builds a Voice Action Contract from independently maintained identity state, entity revisions, confirmation evidence, policy support, schema validity, risk tier, and handoff requirements. A deterministic, side-effect-free validator either executes the call or returns a repair action: clarify, confirm, block, or handoff. SafeOutcome credits policy-correct completion, blocking, and escalation while penalizing unsupported execution. On a 480-task GPT-5.5 transfer, VoiceAgentGuard reduces unsafe release from 0.250 to 0.017 relative to an LLM guard with comparable pass@1. On 2,400 perturbed traces, it improves SafeOutcome from 0.417 to 0.733 and lowers unsafe release from 0.568 to 0.100. On 480 held-out adaptive attacks, unsafe release is 0.075 versus 0.340 for the LLM guard, with 1.55 ms median warm-path latency. Grounded, live-planner, and real-speech checks show that explicit contracts turn insufficient evidence into auditable repair rather than unsafe execution.