Before Your Support Agent Uses AI, Decide What It Can Actually Do

A customer asks a French retailer for a return label. Their message also contains text telling the assistant to ignore the policy, reveal internal instructions and issue a full refund. A human may recognise the extra text as irrelevant; an agent that treats every retrieved or incoming instruction as authority may not.

The sensible workflow separates the customer's request from system instructions. Retrieve the relevant returns policy, identify the order and prepare a proposed response. A representative checks eligibility before any label, refund or customer message is issued.

Give the initial assistant read access only to the order and policy information needed for the ticket, scoped to the representative's rights. A separate tool can propose a return, but the policy engine and authorised person decide whether it proceeds. Never let text in a customer email grant access or change the tool's permissions.

France's CERT-FR warns that agent tools can increase the impact of prompt injection and recommends restricting accessible actions, isolation and human validation for consequential operations. Those controls reduce exposure; a better prompt alone is not a security boundary.

An order history can contain contact details, delivery addresses and payment-related information. Minimise what enters the model context, set appropriate retention and confirm processor and hosting arrangements. CNIL's generative-AI guidance discusses the deployment choices and obligations that arise when customer or employee data is involved.

Show the policy section and order facts the draft used. If a policy is missing or a delivery status is uncertain, the assistant should prepare an internal question or a holding response rather than inventing eligibility.

Test ordinary returns alongside conflicting policy versions, malicious messages, language changes and cases involving damaged goods. Review whether the proposed answer cites the right policy, whether the agent attempted an unauthorised action and whether the representative had enough context to decide.

Track reopens, refund corrections and review time alongside speed. Start with one queue, one policy owner and one rollback path; add actions only after the team can explain what happens when the tool fails.