Dial command transfer flags

I’ve got my dialplan setup so all SIP extensions are called with the ‘t’, ‘w’ and ‘k’ flags (callee controlled only).

However this means that someone making a call from one of our SIP extensions can’t use those functions. For example, I might place a call to a colleague, and then find I’ve got to move to another desk, but as I’m the caller and not the callee I can’t park the call.

I’m concerned that if I added the upper-case equivalents that callers arriving from outside over Zaptel or IAX would then also be able to use the DTMF codes.

Similarly, I don’t have any flags at all on my outbound ITSP’s IAX dial commands, so I’ve got no caller controlled functions. However we’re also forwarding some calls received from IAX straight back out to IAX, so we don’t want the original external caller to be able to send the DTMF tones.

Can someone please either clarify that only calls initiated from Asterisk would honour the TWK flags and DTMF controlled functions, or else give me some pointers on how I can change my dialplan to only add those flags if the call originated from an authorised SIP user?