AI agent in customer service: securing refunds

Key points

• The customer is not the principal: her message must not shift the merchant's limits.
• Credits and refunds are checked against the mandate outside the model before booking.
• Denied decisions show where customers or attackers test the limits.

Starting point

A merchant deploys an agent that handles complaints: tracking deliveries, detecting errors, offering replacements or credits. It is to resolve small cases itself and hand larger ones to staff. The risk: a cleverly worded message leads the agent to refund more than allowed.

Flow with evidence

1. Merchant's mandate: the agent may book credits up to CHF 100 and refunds up to the order value, only for existing orders.
2. Case review: the agent checks order, delivery status and reason for the complaint.
3. Decision: a decision service checks amount and link to the order against the mandate.
4. Escalation: higher amounts or unusual cases go to staff.
5. Booking and receipt: every credit is recorded with a reference to case and decision.

Risks and countermeasures

• Confused deputy: the customer is not the principal. Her message must never lead the agent to use its rights beyond the merchant's limits (confused deputy).
• Injected instructions: claims such as “your supervisor approved this” are checked against the mandate, not believed.
• Serial abuse: detect and escalate many small credits to the same person or address.
• Missing traceability: without a receipt, it cannot be shown later why a credit was booked.

What KYA verifies

For every credit, KYA checks whether it lay within the merchant's mandate, whether a decision existed and whether the booking matched it. A credit above the limit shows up in the scope check, regardless of how convincing the customer's message was.

Adoption

Start with small credits and clear cases, such as late deliveries. Analyze denied decisions regularly; clusters show where customers or attackers test the limits.

Roles and responsibilities

• Customer service management: sets limits for credits and refunds and issues the mandate.
• Operations: runs the agent and the decision service and analyzes denied decisions.
• Staff: take over escalated cases and decide on exceptions.
• Finance: matches booked credits against receipts.

Operating metrics

Important are the share of cases resolved by the agent, the total of credits per day compared with the average, denied decisions by reason and recurring recipients. A rise in denied decisions with the reason “above the limit” often shows deliberate attempts to talk the agent into things.

How the certificate looks

For a credit of CHF 60 due to a late delivery, the merchant's mandate, the decision and the receipt are present. The certificate confirms that the amount was below the CHF 100 limit, that a decision existed and that the booking matched it. The verdict is valid.

If the agent was talked into a credit of CHF 900, the scope check reports the code amount_exceeds_limit. If the receipt of the booking is missing, the execution check reports no_receipt, and the result does not reach the higher levels.

Frequently asked questions

May an AI agent in customer service refund money?

Yes, within a mandate from the merchant. What matters is that the refund decision does not depend on the model alone but is checked against clear limits.

How do I prevent customers from talking the agent into things?

By having every refund checked against the mandate by a component outside the model before booking. Claims in messages do not change the limits.

What is a confused deputy in customer service?

An agent that uses its rights in the customer's interest rather than within the merchant's limits, for example because she persuades it with a claim.

Which records do I need?

For every credit: the case, the decision and the receipt of the booking, so it can be shown later why and within which limits the refund was made.

Should the agent tell customers it has a limit?

Yes. Transparency defuses conflicts: the agent explains that it can decide up to an amount itself and that a staff member takes over above it.

How do I handle goodwill cases?

Goodwill is a separate action with its own limit in the mandate. Anything above it is decided by a person, and a signed decision records the exception.

Can the agent also trigger replacement deliveries?

Yes, as a separate action in the mandate with its own limit, for example up to the value of the original order. Replacement deliveries are also checked before execution and recorded.

How quickly can the agent's mandate be adjusted?

A new mandate with changed limits is issued in minutes. Revoke the old one through the status list so only the new limits apply.

Sources

1. OWASP: LLM01 Prompt Injection: https://genai.owasp.org/llmrisk/llm01-prompt-injection/
2. Confused-Deputy-Problem (Übersicht): https://en.wikipedia.org/wiki/Confused_deputy_problem