--- title: "AI agent in customer service: securing refunds" url: https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-in-customer-service lang: en updated: 2026-10-17 license: © Innopulse Consulting GmbH --- # AI agent in customer service: securing refunds In customer service, agents talk with customers and resolve cases themselves, up to credits and refunds. This makes every customer message a potential instruction, and exactly that must be secured. [Leutrim Miftaraj](https://knowyouragent.ch/en/about/leutrim-miftaraj), Founder, Innopulse Consulting GmbH Published 17 October 2026 ## Key points - The customer is not the [principal](https://knowyouragent.ch/en/knowledge/glossary/principal): her message must not shift the merchant's limits. - Credits and refunds are checked against the mandate outside the model before booking. - Denied decisions show where customers or attackers test the limits. ## Starting point A merchant deploys an agent that handles complaints: tracking deliveries, detecting errors, offering replacements or credits. It is to resolve small cases itself and hand larger ones to staff. The risk: a cleverly worded message leads the agent to refund more than allowed. ## Flow with evidence - **Merchant's mandate:** the agent may book credits up to CHF 100 and refunds up to the order value, only for existing orders. - **Case review:** the agent checks order, delivery status and reason for the complaint. - **Decision:** a decision service checks amount and link to the order against the mandate. - **Escalation:** higher amounts or unusual cases go to staff. - **Booking and receipt:** every credit is recorded with a reference to case and decision. ## Risks and countermeasures - **Confused deputy:** the customer is not the principal. Her message must never lead the agent to use its rights beyond the merchant's limits ([confused deputy](https://knowyouragent.ch/en/knowledge/glossary/confused-deputy)). - **Injected instructions:** claims such as “your supervisor approved this” are checked against the mandate, not believed. - **Serial abuse:** detect and escalate many small credits to the same person or address. - **Missing traceability:** without a receipt, it cannot be shown later why a credit was booked. ## What KYA verifies For every credit, KYA checks whether it lay within the merchant's mandate, whether a decision existed and whether the booking matched it. A credit above the limit shows up in the scope check, regardless of how convincing the customer's message was. ## Adoption Start with small credits and clear cases, such as late deliveries. Analyze denied decisions regularly; clusters show where customers or attackers test the limits. ## Roles and responsibilities - **Customer service management:** sets limits for credits and refunds and issues the mandate. - **Operations:** runs the agent and the decision service and analyzes denied decisions. - **Staff:** take over escalated cases and decide on exceptions. - **Finance:** matches booked credits against receipts. ## Operating metrics Important are the share of cases resolved by the agent, the total of credits per day compared with the average, denied decisions by reason and recurring recipients. A rise in denied decisions with the reason “above the limit” often shows deliberate attempts to talk the agent into things. ## How the certificate looks For a credit of CHF 60 due to a late delivery, the merchant's mandate, the decision and the receipt are present. The certificate confirms that the amount was below the CHF 100 limit, that a decision existed and that the booking matched it. The verdict is valid. If the agent was talked into a credit of CHF 900, the scope check reports the code amount_exceeds_limit. If the receipt of the booking is missing, the execution check reports no_receipt, and the result does not reach the higher levels. ## Frequently asked questions ### May an AI agent in customer service refund money? Yes, within a mandate from the merchant. What matters is that the refund decision does not depend on the model alone but is checked against clear limits. ### How do I prevent customers from talking the agent into things? By having every refund checked against the mandate by a component outside the model before booking. Claims in messages do not change the limits. ### What is a confused deputy in customer service? An agent that uses its rights in the customer's interest rather than within the merchant's limits, for example because she persuades it with a claim. ### Which records do I need? For every credit: the case, the decision and the receipt of the booking, so it can be shown later why and within which limits the refund was made. ### Should the agent tell customers it has a limit? Yes. Transparency defuses conflicts: the agent explains that it can decide up to an amount itself and that a staff member takes over above it. ### How do I handle goodwill cases? Goodwill is a separate action with its own limit in the mandate. Anything above it is decided by a person, and a signed decision records the exception. ### Can the agent also trigger replacement deliveries? Yes, as a separate action in the mandate with its own limit, for example up to the value of the original order. Replacement deliveries are also checked before execution and recorded. ### How quickly can the agent's mandate be adjusted? A new mandate with changed limits is issued in minutes. Revoke the old one through the [status list](https://knowyouragent.ch/en/knowledge/glossary/status-list) so only the new limits apply. ## Sources - OWASP: LLM01 Prompt Injection: [https://genai.owasp.org/llmrisk/llm01-prompt-injection/](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) - Confused-Deputy-Problem (Übersicht): [https://en.wikipedia.org/wiki/Confused_deputy_problem](https://en.wikipedia.org/wiki/Confused_deputy_problem) --- Quelle: https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-in-customer-service · KYA – Know Your Agent