What an AI support agent can and can’t do safely

An AI support agent is a program that reads a customer’s message, works out what they want and replies in ordinary language. It usually sits on WhatsApp, your website or email. Behind it, a language model writes the replies and a set of connections lets it look things up in your systems, such as an order database or a booking calendar.

The useful way to think about it is as a new junior team member who is fast, never tired, and has read only the documents you gave it. It is good at the questions that have a known answer. It has no business making calls that depend on context, authority or care for the person.

The best jobs are frequent, factual and low in consequence if the agent gets stuck. A customer asking “where is my order?” needs a look-up, not a decision. The agent finds the order, reads the status and tells them in a sentence.

What these jobs share is a correct answer that already exists somewhere in your systems. The agent’s task is to find it and say it clearly, at any hour, in the customer’s language. That is a narrow job, and a narrow job is one you can test properly before real customers see it.

Keep anything that carries real consequences or needs judgement with a person. A language model can sound confident when it is wrong, and it does not carry responsibility the way a staff member does.

The agent can still help with these cases. It can gather the order number, the photos and the customer’s account of the problem, then pass a tidy summary to the person who decides. The decision stays human. The preparation does not have to.

Safety comes from how the agent is built, not from the model alone. Four guardrails matter most.

Ground it in your own data. The agent should answer from your order system, your product catalogue and your written policies, and say “I don’t know” when the answer is not there. It should not fill gaps from general knowledge about how businesses usually work.

Hand off to a human. Define clear triggers: the customer asks for a person, the topic is on your do-not-handle list, the agent has failed to help after two attempts, or the customer sounds upset. The handoff should pass the full conversation so the customer does not repeat themselves.

Keep logs. Store every conversation, what data the agent looked up and what it replied. If a customer disputes what was said, you can check. Be careful with personal data, and store only what you need.

Limit what it can do. Give the agent read access to order status, not the ability to cancel orders or change payments, unless a person approves the action.

If your agent talks to customers on WhatsApp, you will use the WhatsApp Business API, usually through an approved provider. The rules are set by Meta and change, so confirm the current terms before you build. In general terms, three things apply.

First, opt-in. You need the customer’s permission to message them on WhatsApp, and you should keep a record of when and how they gave it. Second, templates. When you start a conversation, or reply after the conversation window has closed, you must use a message template that has been submitted and approved in advance. Replies within an open window, started by the customer, are more flexible. Third, quality. Customers can block or report a business, and a poor reputation can limit what you are allowed to send.

Design the agent around this. Make the opt-in clear on your forms, write templates that say plainly what they are for, and give customers an easy way to stop receiving messages.

Launch narrowly. Start with one job, such as order status, and one channel. Read the conversations every day for the first weeks, then every week. Look for questions the agent could not answer, answers a person would have worded differently and moments where a handoff should have happened sooner.

Each finding becomes a change: a new FAQ entry, a corrected policy line, a tighter handoff rule. Keep a short list of test questions, including awkward ones, and run it again after every change so you notice if something that worked has broken.

List the questions your team answers most often this week and sort them into three piles: factual, needs judgement, and sensitive. The first pile is where an agent can start. The other two stay with people.

If you want a second pair of eyes on that list, Ingenatrix offers a free automation audit. We will go through it with you, say which jobs suit an agent and which do not, and describe what the guardrails would look like for your business.