What should customer support agents never let an AI agent do?

Anything that hands an account to the wrong person, sends money to the wrong place, or misleads the customer. Customer support agents should never let an AI agent change login details without full verification, refund to a different account, disclose account information to an unverified caller, promise outside policy, give regulated advice, pose as a person, or close an account.

Which red lines protect the customer’s account?

Changing the email, phone number or password route without full verification. This is how account takeover works. Someone who has a customer’s name and a few details asks to “update my email”, then resets the password. A request to change contact details is declared, and the agent should hold it for the full verification process. You should never approve it on a convincing story.

Disclosing account information to an unverified person. A caller who says they are the customer’s partner, parent or assistant is declared, not verified. Order details, addresses and payment information stay private until identity or authority is confirmed.

Closing an account. Closure can lose data, credit or subscriptions the customer did not mean to give up, and is sometimes requested by someone who is not the customer. It needs a person.

Which red lines protect the money?

Refunding to a different card or account than the one used to pay. A request to send a refund elsewhere is an external claim, and an external claim cannot authorise a payment. Refunds go back to the original payment method unless a verified process says otherwise.

Refunding above the limit or outside policy. The business’s refund limit is one of five bounds every action meets, with role scope, certificate, sources and the platform guardrails. Above it, the agent holds; you decide, within your own authority.

Which red lines protect what the customer is told?

Promising outside policy. Delivery dates the business cannot guarantee, compensation it does not offer, outcomes still under review. A promise made by the agent is a promise made by the business.

Giving regulated advice. In financial services, telecoms contracts, health or legal matters, some answers count as advice that only qualified people may give. The agent can give factual information within its role; anything that steers a customer’s decision on a regulated matter goes to a person.

Posing as a person. The agent should be clearly identified as an AI system. Under the EU AI Act people must be told when they interact with one, and it is good practice everywhere.

Why can’t a well-certified agent be trusted with these?

Because each one turns on something the agent cannot check alone: whether the person is who they say, whether a new account really belongs to the customer, whether a promise is fair in context. A governed agent’s authority also expires: certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day. Red lines sit in the business’s own limits, so they hold at any depth.

What does a crossed line look like in a telecoms queue?

Take a support agent at a mobile operator. A held item shows a request to change the account email, from a chat where the customer passed basic security questions. The agent held it because email changes need a one-time code to the existing number. The draft reply is ready to send the confirmation anyway, citing that the customer “has verified”.

The support agent declines. Basic questions are not full verification, and the customer said in the chat that they had lost their phone, which is exactly the story fraudsters use before a SIM swap. They send the request to the fraud team and note why. The customer turns out to be genuine, and is verified in store the next day. Nothing was lost by waiting.

How do support teams keep these lines?

Learn each line with a real example from your own queue. Decline and escalate rather than edit-and-approve. Write a short reason so the agent owner can tighten limits where the agent held something it should have refused. Your team lead has a parallel list; see what support team leads should never let an agent do. IT has its own: what IT administrators should never let an agent do.

Market detail differs; compare support training in Canadian telecoms with Nigerian telecoms. Why support agents are the safeguard is argued in why customer support agents are the real control. The overview is in AI agent skills by role.