Frontline support staff meet manipulation at the handoff, when a customer the AI agent refused asks for a person. Train them to read the transcript before replying, treat screenshots as claims, recognise "the bot promised me" as a tactic, and verify identity before any account change. Practise on real refused chats, anonymised, until the response is habit.
Where do support staff meet manipulation?
A support agent, the AI kind, handles routine chats: order status, simple refunds within limit, password resets through secure flows, answers from the help centre. It holds or refuses the rest, and many of those contacts pass to a human support agent. This article is about training the humans.
The handoff is where manipulation concentrates. A customer who could not get what they wanted from the AI tries again with a person, and has had time to prepare. Typical approaches:
- Jailbreak attempts that failed, now retold: "Your assistant agreed to refund me, it just couldn't process it."
- Screenshots and attachments of orders, payments or conversations, edited, or carrying hidden text the AI agent flagged.
- Account takeover: a caller who failed authentication with the AI now wants a person to change the email address because they "lost access".
- Refund abuse: repeated "never arrived" claims, each small enough to seem not worth questioning.
- Emotional pressure: anger, distress, threats of public complaint.
The AI agent's record shows exactly what it said and why it stopped. The OWASP Top 10 for LLM Applications lists prompt injection and excessive agency among the main risks for systems like this; a governed agent counters both by treating customer text as content and acting only within bounds. The human support agent completes the defence, or undoes it.
The support operations manager owns this training. Team leads deliver it.
How do you train support staff, step by step?
- Team lead: runs a baseline. Eight anonymised handoffs; staff say what they would do.
- Trainer: shows how to read the transcript and hold reason. What the AI agent was asked, what it said, which bound decided.
- Agent, depth 1: assembles examples of refused and held chats with flagged inputs, failed authentication and repeated claims.
- Trainer: seeds a test workspace with an edited screenshot, a "the bot promised" handoff, and an account-change request after failed authentication.
- Staff: handle each seeded handoff in role-play, then compare their replies.
- Team lead: runs pressure role-plays with an angry and a distressed customer.
- Agent, depth 3 in live work: resolves routine contacts, passes others with a summary and the hold reason. Staff read both before replying.
- Staff: report suspected fraud or account takeover attempts and tag the contact so it becomes a test case.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Baseline | Nothing | none | Staff, team lead |
| Transcript reading | Shows conversation and hold reason | 1 | Trainer explains |
| Examples | Lists refused and flagged chats | 1 | Trainer anonymises |
| Seeded handoffs | Passes test contacts | 3 | Staff handle |
| Pressure role-play | Nothing | none | Team lead |
| Live handoffs | Summarises and passes on | 3 | Staff decide |
What should support staff recognise?
Claims about what the AI agent said. Check the transcript. If it did not promise, say so politely and decide on the merits.
Screenshots as evidence. A screenshot is a claim from outside. Check the order or payment in your own system.
Identity shortcuts. "I can't get the code because I lost my phone." Follow the recovery process. Never change contact details on the strength of a story.
Repeated small claims. Look at the account history the AI agent surfaced. Patterns matter more than any single request.
Instructions in attachments. If the hold reason says the AI agent found instruction-like text in a document, treat the whole document with caution.
Urgency and emotion. Respond to the feeling, keep the check. "I understand this is frustrating. I need to confirm a couple of things so I can help."
Which controls leave evidence?
- Transcript read before reply. Evidence: handoff view logged as opened before the first response.
- Account changes after failed authentication need recovery steps. Evidence: the recovery record.
- Refunds above limit approved by a lead. Evidence: approver name.
- Suspected fraud tagged. Evidence: tag and referral.
- Role-plays repeated quarterly. Evidence: attendance and scores.
What should you measure?
- Seeded handoffs mishandled in exercises.
- Account changes after failed authentication that skipped recovery.
- Refunds granted on "the bot promised" where the transcript shows no promise.
- Customer satisfaction on handoffs, to check vigilance stays polite.
Where does training usually go wrong?
Staff do not read the transcript. It is the single most useful habit. Make the handoff view open on it.
Fear of complaints. Staff concede to avoid escalation. Leads must back them when they hold the line correctly.
Treating attempts as funny. Jailbreak attempts are shared as jokes. Treat them as reports.
Training only new starters. Experienced staff learned the job before the AI agent existed and need the handoff skills too.
Team leads need a deeper version; see how to train support team leads to spot prompt injection and pressure. Collections staff meet related tactics in how to train collections agents to spot prompt injection and pressure. For background, read what prompt injection is and OWASP prompt injection and AI agents that act. The full programme is in training teams for AI agents.
Where the Academy fits
Support staff who only take handoffs often need the Foundations track at Pryme Intelligence Academy: about four hours, free, covering how agents are governed and the decision chain. Those who decide held refunds and account changes need the Operator track, whose module tests are set in the learner's own industry and role, so they practise on support contacts.
Questions people ask
Should staff tell customers that the AI agent refused for a reason?
Yes, in plain terms. "That request needs a person to check it" is honest and calm.
What if the AI agent really did make a mistake?
Then the transcript shows it, and the staff member corrects it and tags the contact so the agent's owner can fix the brief.
Can staff override a refusal?
A refusal means the action is outside the AI agent's bounds. Staff with the right authority can act within their own limits, with a recorded reason. A withheld action is different: it is refused at the platform floor for every agent at every depth, and no setting or override changes that.