AI agents for sales and customer service: what reliable deployment requires

Give the agent a specific job.

“Handle sales” is too broad to test. “Read an incoming enquiry, identify missing details and prepare a response from approved service information” has a clearer beginning and end. It also makes the limits visible: the agent is not authorised to create new commercial terms.

Write down the trigger, available information, permitted tools and allowed outcomes. Include an explicit outcome for insufficient information. Asking a useful clarification question is often a better result than completing every field.

Treat tool access as a permission decision.

Reading a record and modifying it should not automatically require the same access. Give the workflow only the actions it needs. Validate the caller, parameters and business rules in ordinary server-side software, independently of the model’s interpretation.

External messages and retrieved documents can contain misleading instructions. They should be treated as information to inspect, not as authority to change the workflow’s permissions. The application must retain control over credentials and execution.

Let the model propose. Let the application enforce. Keep a person responsible for consequential decisions.

Make the review step worth a person’s time.

A colleague should see the proposed action, its supporting information and the reason review is required. For example, a proposal draft can show the approved service source and highlight unknown scope details. A raw transcript that requires reconstruction is a poor approval interface.

• Pause before commitments outside the approved remit.
• Make missing or conflicting information visible.
• Record who approved the action and what they approved.
• Re-check relevant state if the underlying record changes before execution.

Test the inconvenient cases.

Include duplicate messages, a missing record, an expired credential, a tool timeout and a customer asking for something the business does not offer. A timeout may leave uncertainty about whether an action already happened, so blindly repeating it can make matters worse.

Release in a bounded environment with monitoring and a route back to manual handling. Review completed work and exceptions together. Reliability is an operating practice built around the agent, not a property established by one convincing conversation.