For a while now I have watched the same scene repeat itself in different meetings. Someone shows a chatbot connected to a language model, the bot answers three questions in a row well, the room gets excited and someone asks when it can go into production. The honest answer is almost never welcome, because what they just saw is not the hard part.
Answering is easy. Acting is something else.
What separates a chatbot from an agent?
A chatbot converses. It receives a question, searches its knowledge base and returns text. If the customer asks for something that requires touching a system, the bot escalates to a human and its work ends there.
An agent does the work. It checks the actual status of an order in the ERP, reschedules an appointment in the calendar, opens a ticket with the correct category, applies a credit note within the limit it was authorized for. It has tools and permission to use them.
That phrase, “permission to use them”, is the whole conversation. The rest is a demo.
Where does this fit into customer experience?
In customer service, repetitive processes are enormous and fairly boring, which is exactly where an agent performs. The four cases we have most often seen work:
Status inquiries. Where is my order, how much do I owe, when does my contract expire, what happened with my request. They make up the bulk of the volume of any service desk, and almost none require human judgment.
Low-risk requests. Changing a shipping address, rescheduling a technical visit, updating contact details, resending an invoice. Things with clear rules and limited consequences.
Ticket triage. Read what the customer wrote, understand what it is really about, assign it a category and priority, and route it to the right team. An agent does this better than a form with a drop-down menu, because the customer does not know which category their problem falls into.
Case preparation. Before the human opens the ticket, the agent has already gathered the customer's history, similar previous tickets and the relevant documentation. The analyst starts with context instead of a single line of text.
Notice what is not on the list: nothing that involves moving money without supervision, canceling a service or closing a case on its own. That is not excessive caution; it is design.
The part almost nobody shows in the demo
An agent with tools is, from a security standpoint, a new user. One that works around the clock, does not get tired, does not ask and executes what it interprets. And that interpretation depends on text that, in customer service, is written by a stranger.
That is where the problem that concerns us directly appears. If the agent reads the customer's message and that message contains disguised instructions, the agent may obey them. It is called prompt injection, and the OWASP Top 10 for LLM Applications ranks it first on its list of risks, and not by chance.
Translated into operations: a customer writes an email that, in addition to their complaint, includes a line asking the system to show them another account's data. If no one separated what the agent reads from what the agent obeys, that line is a command.
There is another, less spectacular and far more frequent risk: the agent that returns correct information to the wrong person. There was no attack, just a misplaced permission.
So can it be done right?
Yes, and there is nothing magical about it. An agent can operate on real systems without becoming an exposure, as long as it reaches production with its own identity, permissions limited to its task, human approval for anything irreversible and an auditable trail of everything it did.
How each of those pieces is implemented depends on the environment, and that is precisely the work. What does not change from one client to another is the consequence of skipping one: the agent stops being a tool and becomes a door.
And once it is running, the agent is monitored like any other asset. If its behavior deviates from the pattern, that has to reach the SOC just as a compromised machine's would. We have already written about this same idea applied to security operations themselves in the agentic SOC.
Why would you ask a cybersecurity company to do it?
Automating customer service is a business project. Doing it without opening a back door into your systems is a security project. They are usually contracted separately, and that is why the result usually falls short somewhere.
At ZetTateK AI Labs we build these automations with the controls in place from day one, because the team that designs them is the same one that has spent years responding when something breaks. It is not a marketing stance: we already know what breaks.
If you are evaluating bringing agents into your customer service operation, the useful conversation does not start with the model. It starts with which processes you have today and what permissions would be needed. We review that at no cost in the initial assessment.
An agent without permissions is a demo. An agent with permissions and no controls is an incident waiting for a date.
Frequently asked questions
What is agentic automation in customer experience?
It is an artificial intelligence system that does not just reply to messages but carries out real tasks in your systems: it checks in the ERP where an order is, reschedules an appointment, or classifies and routes a new ticket. Unlike a chatbot, which only converses and escalates to a person when something has to be done, the agent has tools and permissions to act within defined limits.
Which customer service processes should be automated first with AI agents?
Start with what is repetitive and low risk. The four cases that work best are: status inquiries (orders, balances, due dates), simple requests such as updating contact details or resending an invoice, ticket triage (classifying, prioritizing and routing each case to the right team) and context preparation so the analyst receives the full history. Leave out anything irreversible, such as moving money or canceling services without human supervision.
What are the risks of connecting an AI agent to my company's systems?
The best known is prompt injection, which ranks first in the OWASP Top 10 for LLM Applications: a customer hides instructions inside their message and the agent obeys them. There is another, more frequent and less flashy one: delivering correct information to the wrong person because of a misconfigured permission. That is why the agent must be treated as one more user, with its own identity, minimum access, human approval for irreversible actions and an auditable log.
How much does it cost to implement an AI agent in customer service?
There is no single figure, because each implementation depends on your current systems, processes and permissions. The recommended approach is to start with an assessment: review which repetitive processes you have today and what access the agent would need to operate them securely. ZetTateK offers that initial assessment at no cost, so your company can size the project before committing budget.
