Guardrails for an AI Customer-Support Assistant

Define the allowed job

List the questions the assistant may answer and the actions it may take. Frequently asked questions, order-status explanation, and navigation are lower risk than refunds, account changes, medical advice, or binding quotations.

Write escalation rules before prompts. Low confidence, frustrated language, repeated failure, sensitive data, or a request outside scope should move the conversation to a human with context.

• Tell customers they are interacting with an AI assistant
• Do not request secrets or full payment credentials
• Require confirmation before consequential actions
• Provide a visible human-contact option at all times

Ground answers in approved sources

Use a curated knowledge base with ownership and review dates. Retrieve relevant passages and instruct the model to answer only from those sources. If the answer is absent or contradictory, the correct response is uncertainty plus escalation.

Separate public information from account-specific data and enforce authorization before retrieval. Log which source supported an answer so reviews can improve the content instead of guessing why the model responded.

• Version policies and product information
• Filter personal data before sending prompts
• Treat retrieved content as untrusted input
• Limit tools and data to the current user and task

Evaluate real conversations

Create a test set covering common questions, ambiguous wording, malicious instructions, unsupported requests, and escalation cases. Score factual support, helpfulness, privacy, tone, and correct handoff—not just whether the response sounds fluent.

Review production samples with appropriate privacy controls. Track containment beside reopened conversations, complaints, incorrect answers, and handoff time so automation does not hide customer effort.