The risk with a customer-facing AI agent is not that it fails to answer. A visible failure is recoverable. The risk is that it answers confidently and wrongly, in fluent prose, and the customer believes it.
An agent that invents a returns window creates an obligation you did not agree to. One that improvises a delivery date creates a complaint. These are business problems, and they are solved with engineering controls rather than better prompts.
Key takeaways
- Grounding: answers come from your sources, or not at all.
- Scope: an explicit list of permitted topics, everything else escalates.
- Confidence thresholds: below a bar, hand off rather than guess.
- Audit trail: every automated message logged with the source it used.
Grounding
A language model without grounding answers from general training data, which does not contain your returns policy, your stock levels or your delivery times. Asked anyway, it produces something plausible.
Grounding constrains it to retrieve from your material first and answer only from what it finds. When the sources do not cover the question, the correct output is an explicit "I don't have that" plus a handoff.
This makes source quality the ceiling on answer quality. Outdated policy docs produce confidently outdated answers. Practically, that means an owner for the source content and a review cadence, or the whole system degrades quietly.
Test grounding directly. Ask the agent something plausible that your sources deliberately do not cover, such as a policy you have never published. A grounded agent says it does not know. An ungrounded one invents something reasonable, which is exactly the failure mode you are testing for.
Scope control
Grounding governs where answers come from. Scope governs what the agent is allowed to discuss at all. These are separate controls and both are necessary.
Define permitted topics explicitly. Everything outside escalates. Categories that should almost always sit outside scope:
- Anything creating a financial obligation: refunds beyond published policy, custom pricing, goodwill credits.
- Legal or regulatory questions: liability, warranty interpretation, compliance.
- Medical, financial or safety advice, in any sector where that applies.
- Complaints and escalations: a frustrated customer should reach a person quickly.
- Anything about a named individual, including your own staff.
Scope is not a limitation on the agent. It is the definition of what you are prepared to stand behind automatically.
Confidence thresholds and sentiment routing
Even in scope and grounded, an agent will encounter questions it half-understands. The dangerous zone is moderate confidence: high enough to answer, low enough to be wrong.
Set the threshold deliberately. Too high and everything escalates, defeating the purpose. Too low and it guesses. Start conservative and lower it as you accumulate evidence, rather than the reverse.
Layer sentiment routing on top. A customer expressing frustration should reach a person regardless of whether the agent could technically answer, because at that point the interaction is about acknowledgement rather than information.
Audit trails
When something goes wrong, you need to answer three questions: what was sent, why, and what source it used. Without a log, you are guessing, and you cannot fix a failure you cannot reconstruct.
Log every automated message with the sources retrieved, the confidence score, and the scope decision. Review a sample weekly, not only after complaints. Most degradation is gradual and invisible until someone looks.
This also matters for regulated sectors, where "the AI said it" is not a defence. The audit trail is what demonstrates the controls existed and functioned.
A launch checklist
- Sources reviewed and current, with a named owner and a review cadence.
- Scope list written down and agreed with whoever owns the commercial risk.
- Escalation paths tested for every out-of-scope category.
- Confidence threshold set conservatively, to be relaxed on evidence.
- Sentiment routing enabled so frustration reaches a person.
- Audit logging on and someone assigned to review samples weekly.
- Adversarial testing done: try to make it promise a refund, invent a policy, or discuss a competitor.
That last step is the one most often skipped and the most informative. Spend an hour genuinely trying to make the agent misbehave before customers do it accidentally.
Frequently asked questions
Can guardrails eliminate hallucination entirely?
They reduce it to a manageable rate rather than zero. That is why the audit trail and human escalation paths matter as much as the controls themselves.
Does constraining the agent make it less useful?
It narrows range and raises trustworthiness. A narrow agent that is always right beats a broad one that is usually right, because the failures are what customers remember.
Who should own the scope list?
Whoever owns the commercial risk, usually support leadership with sign-off from legal in regulated sectors. It should not be an engineering decision made by default.