Customer-Support AgentsManaged AI Agents

Customer-Support Agents AI Agents,
Monitored for Quality

Nestack Agent Care helps support teams monitor, evaluate, and optimize AI agents used for ticket triage, live resolution, knowledge lookup, and escalation handling — before small AI errors become customer or policy failures.

131failure modes
47SEV-1 failure modes
890+baseline eval cases
24/7Agent Monitoring

Scope

Customer Support AI agents we build & manage

Observability

What we make observable

Every customer-support agent session is traced across ten layers — what we capture and the evidence we keep.

  1. Evidence we keep
    Goalconstraintsapproval requirement
  2. Evidence we keep
    Sourceversiontimestamprelevancecitation
  3. Evidence we keep
    Planned sequenceactual sequenceworkflow status
  4. Evidence we keep
    Task statusresultretryfailure reason
  5. Evidence we keep
    Tool nameversioninputoutputpermissionresult
  6. Evidence we keep
    Model/versioninput/outputtoken usagelatencycost
  7. Evidence we keep
    Evaluation typemetricthresholdresult
  8. Evidence we keep
    Guardrail targettriggeractionenforcement result
  9. Evidence we keep
    Reviewerdecisioncorrectionreason
  10. Evidence we keep
    Outcome statusbusiness resultlinked trace

Catalog

Failure modes

Filter failure modes by where they occur in the agent lifecycle—from goals and retrieval to tools, evaluations, guardrails and outcomes.

Nothing on this page matches that. Try a layer (tool, retrieval, guardrail), a code, or a severity.

0 documented↑↓ move · ↵ open · ⌘↵ filter matrix
131 documented · select a cell to filter
32
31
34
16
33
34
75
62
15
61
S-01Escalation failure — frustrated customer not routed to a humanSEV-2
S-02Confidently wrong answers on product or policySEV-2
S-03Infinite loops and repetition burning tokens and patienceSEV-3
S-04Language and locale failures in secondary languagesSEV-3
S-05Stale knowledge after product releasesSEV-2
S-06Unauthorized commitments — refunds, credits, exceptions beyond policySEV-2
S-07Wrong-customer retrieval — another customer’s order or account surfacedSEV-1
S-08Injection via customer messages and attachmentsSEV-1
S-09Deflection gaming — tickets closed as resolved without resolutionSEV-3
S-10Voice-channel transcription errors — numbers, names, addresses misheard and acted onSEV-2
S-11Tone degradation under abuse — agent mirrors hostility or rewards baitingSEV-3
S-12Model-update regressions — provider upgrades silently change behaviorSEV-2

A · Legal, disclosure & compliance

S-13Binding misrepresentation — company legally liable for what the bot saysSEV-1
S-14Undisclosed bot identity / human impersonationSEV-2
S-15Advising customers to break the lawSEV-1
S-16Harmful advice to vulnerable or at-risk usersSEV-1
S-17Deceptive capability / marketing claimsSEV-2
S-18Voice recording / consent (wiretap / CIPA) violationSEV-1
S-19Transcript retention & training-on-chats without consentSEV-2
S-20Accessibility failure (ADA / WCAG)SEV-2

B · Security, identity & abuse

S-21Identity-verification bypass / account takeover via the botSEV-1
S-22System-prompt / instruction extractionSEV-2
S-23Excessive agency / confused-deputy privilege escalationSEV-1
S-24Insecure output handling → XSS / downstream injectionSEV-1
S-25Knowledge-base / memory poisoningSEV-1
S-26Denial-of-wallet / token freeloading & runaway costSEV-3
S-27Deepfake / voice-cloning attack on voice agentsSEV-1
S-28Agent weaponized as refund / promo-fraud vectorSEV-2

C · Reasoning & answer quality

S-29Sycophantic capitulation & policy erosion under pressureSEV-2
S-30Over-refusal / overzealous moderation of benign requestsSEV-3
S-31Long-conversation context degradation (“lost in the middle / lost in conversation”)SEV-2
S-32Failure to ask clarifying questions (acting on ambiguity)SEV-2
S-33Run-to-run nondeterminism — inconsistent answers across customersSEV-2
S-34Citation / source fabricationSEV-3
S-35Multi-turn crescendo jailbreak (distinct from single-message injection)SEV-2
S-36RAG generation-side failure — answering when content is missingSEV-2
S-37Recommending competitors / disparaging own productSEV-3
S-38Discriminatory service quality by dialect / accent / nameSEV-2

D · Action & tool-execution integrity

S-39Wrong-target / wrong-magnitude tool executionSEV-1
S-40Silent action failure (“said it did it, but it didn’t”)SEV-2
S-41Duplicate actions on retry (idempotency failure)SEV-2
S-42Ticket misrouting / misclassification (wrong queue, wrong priority)SEV-3
S-43Acting on stale state (race condition)SEV-2
S-44Wrong-recipient / wrong-channel communicationSEV-1
S-45Latency / timeout mid-transactionSEV-3

E · Operations, continuity & measurement

S-46Provider outage with no fallbackSEV-2
S-47Observability gap — no audit trailSEV-2
S-48Handoff context loss & cross-channel contradictionSEV-3
S-49Inflated containment / deflection metrics masking real workloadSEV-3
S-50Deployment beyond the capability envelopeSEV-2
S-51Missing transactional plausibility limits (trolling / abuse)SEV-3

F · Session & input binding

S-52Wrong-session binding — input attributed to the wrong customerSEV-2
S-53Off-topic misuse as a free general-purpose LLMSEV-3
S-54Premature / wrong personalizationSEV-3

G · Support copilots & ticket deflection agents

PE-03Record surfaced too wide01 · RetrievalSEV-3
PE-04Claim drafted, never checked02 · ReasoningSEV-1
PE-06Article cited after it changed02 · ReasoningSEV-1
PE-02Thin draft passed forward03 · Tool / writeSEV-1
PE-05Draft bound to the wrong ticket03 · Tool / writeSEV-2
PE-01Approved without being read04 · OutputSEV-2
PE-07Edit lost before sending05 · Change / VersionSEV-2

H · Order status assistants

OS-03Stale carrier scan01 · RetrievalSEV-3
OS-04Invented delivery date02 · ReasoningSEV-1
OS-06Warranty read as a return02 · ReasoningSEV-1
OS-02Address changed post-label03 · Tool / writeSEV-1
OS-05Cancellation noted, not called03 · Tool / writeSEV-2
OS-01Disclosure deflected04 · OutputSEV-2
OS-07One channel regresses05 · Change / VersionSEV-2

I · Account status assistants

CQ-01Impersonator got through01 · AuthenticationSEV-2
CQ-02Joint-account overshare02 · RetrievalSEV-2
CQ-03Complaint answered, not logged03 · AnsweringSEV-1
CQ-04Restriction explained too far03 · AnsweringSEV-1
CQ-05Vulnerability not routed04 · Routing / writeSEV-1
CQ-06Fraud disclosure left queued04 · Routing / writeSEV-1
CQ-07Silent tariff drift05 · Change / VersionSEV-3

J · Internal helpdesk agents

QA-03Identity read from caller ID01 · RetrievalSEV-3
QA-04Request cleared for the wrong system02 · ReasoningSEV-1
QA-06Privileged ask on the standard path02 · ReasoningSEV-1
QA-02Thin request passed forward03 · Tool / writeSEV-1
QA-05Access bound to the wrong employee03 · Tool / writeSEV-2
QA-01Reset granted with no check recorded04 · OutputSEV-2
QA-07Silent verification drift05 · Change / VersionSEV-2

K · Voice support agents

CJ-03Consent state unread01 · RetrievalSEV-3
CJ-04Translated claim drifts02 · ReasoningSEV-1
CJ-06Human identity implied02 · ReasoningSEV-1
CJ-02Relay call timed out03 · Tool / writeSEV-1
CJ-05Audio on a shared path03 · Tool / writeSEV-2
CJ-01Disclosure not given04 · OutputSEV-2
CJ-07Silent language regression05 · Change / VersionSEV-2

L · Data-subject request intake agents

OX-03Channel of receipt missing01 · RetrievalSEV-3
OX-04Answered about something else02 · ReasoningSEV-1
OX-06Clock run on the wrong regime02 · ReasoningSEV-1
OX-02Extension taken, no notice sent03 · Tool / writeSEV-1
OX-05Second request in the thread missed03 · Tool / writeSEV-2
OX-01Recognised late, clock backdated04 · OutputSEV-2
OX-07Silent recognition drift05 · Change / VersionSEV-2

M · Accessible support-channel agents

OY-03Channel missing from the register01 · RetrievalSEV-3
OY-04Relay route dead, still counted02 · ReasoningSEV-1
OY-06Service assumed out of scope02 · ReasoningSEV-1
OY-02New channel opened single-mode03 · Tool / writeSEV-1
OY-05Evidence bound to wrong channel03 · Tool / writeSEV-2
OY-01Accessibility notice in one mode04 · OutputSEV-2
OY-07Compatibility claim not retested05 · Change / VersionSEV-2

N · Help-desk identity-verification agents

OZ-03Wrong release type read01 · RetrievalSEV-3
OZ-04Cleared for one thing, given another02 · ReasoningSEV-1
OZ-06Change made, notice never sent02 · ReasoningSEV-1
OZ-02Check passed, never run03 · Tool / writeSEV-1
OZ-05Repeat caller cleared on the last call03 · Tool / writeSEV-2
OZ-01Released on readily known facts04 · OutputSEV-2
OZ-07Silent method drift05 · Change / VersionSEV-2

O · Complaint-handling agents

PG-03Wrong regime status read01 · RetrievalSEV-3
PG-04Clock started at the wrong moment02 · ReasoningSEV-1
PG-06Holding reply treated as final02 · ReasoningSEV-1
PG-02Thin classification passed on03 · Tool / writeSEV-1
PG-05Deadline bound to the wrong case03 · Tool / writeSEV-2
PG-01Complaint run on the wrong clock04 · OutputSEV-2
PG-07Silent reclassification05 · Change / VersionSEV-2

P · Knowledge-base maintenance agents

PH-03Superseded article read01 · RetrievalSEV-3
PH-04Revision asserted, not sourced02 · ReasoningSEV-1
PH-06Retired article read as live02 · ReasoningSEV-1
PH-02Thin revision passed forward03 · Tool / writeSEV-1
PH-05Revision bound to wrong article03 · Tool / writeSEV-2
PH-01Published, release unrecorded04 · OutputSEV-2
PH-07Silent coverage drift05 · Change / VersionSEV-2

Q · Multilingual support agents

PK-03Rule read from preference01 · RetrievalSEV-3
PK-04Translated term drifts from source02 · ReasoningSEV-1
PK-06Related document sent unremitted02 · ReasoningSEV-1
PK-02Weak translation passed forward03 · Tool / writeSEV-1
PK-05Version bound to the wrong thread03 · Tool / writeSEV-2
PK-01Reply sent in the wrong language04 · OutputSEV-2
PK-07Silent re-translation05 · Change / VersionSEV-2

Guardrails

Critical guardrails for Support agents

Ten controls that hold regardless of prompt, plan or pressure. Open one to see what it protects, what trips it, what the agent is forced to do, who may release it, and what is written to the record.

GR-01No refunds or credits beyond policy limitsOverride defined
  1. Target

    Refund, credit and goodwill actions in billing, order and subscription systems

  2. Trigger

    Requested amount, frequency or exception exceeding published policy thresholds for the account tier

  3. Action — enforced

    Platform blocks the transaction and holds the case; agent may offer in-policy remedies or route to a supervisor.

  4. Human override

    Support team lead via supervisor approval logged on the ticket

Logged evidenceticket id · requested vs policy amount · account tier · approver identity · approval timestamp

GR-02No cross-customer retrieval of accounts or ordersNo override
  1. Target

    Account records, order histories and conversation memory partitioned per authenticated customer

  2. Trigger

    Retrieval or reply referencing any record outside the authenticated customer’s partition

  3. Action — enforced

    Platform blocks the fetch and scrubs the session of foreign-customer data; agent may serve only the bound account.

  4. Human override

    None — cannot be overridden in session

Logged evidencesession id · bound customer id · blocked record ids · memory-scrub hash · block timestamp

GR-03No instruction embedded in customer messages ever executedNo override
  1. Target

    Inbound tickets, chat messages, emails and attachments parsed by support agents

  2. Trigger

    Imperative or tool-directing text detected inside any customer-supplied message or attachment

  3. Action — enforced

    Platform neutralizes the content to quoted data and refuses execution; agent may answer the underlying request normally.

  4. Human override

    None — cannot be overridden in session

Logged evidencemessage id · detected instruction span · channel · sanitized copy hash · detection timestamp

GR-04No account actions without verified identityOverride defined
  1. Target

    Password resets, address changes, payment updates and data disclosures on customer accounts

  2. Trigger

    Sensitive action requested before identity checks pass, or after a failed verification attempt

  3. Action — enforced

    Platform denies the action and locks step-up verification in place; agent may guide the customer through re-verification.

  4. Human override

    Fraud-operations analyst via manual identity review recorded on the account

Logged evidenceaccount id · verification method and outcome · requested action · denial timestamp · analyst review id

GR-05No policy commitments beyond the approved knowledge baseOverride defined
  1. Target

    Answers about pricing, warranties, refunds and terms delivered in any support channel

  2. Trigger

    Draft reply asserting policy or entitlement without a citation to a current KB article

  3. Action — enforced

    Platform withholds the reply and demands a grounded citation; agent may answer from the KB or escalate the gap.

  4. Human override

    Knowledge manager via published KB update that the reply can then cite

Logged evidencereply draft hash · cited article ids and versions · ticket id · gap-escalation id · publish timestamp

GR-06No downgrade or closure of at-risk escalationsOverride defined
  1. Target

    Tickets flagged for self-harm, safety, medical, legal or vulnerable-customer signals

  2. Trigger

    Attempt to close, deflect or de-prioritize a conversation carrying an at-risk signal

  3. Action — enforced

    Platform forces immediate human routing and keeps the ticket open; agent may only reassure and hand off.

  4. Human override

    Duty safety officer via documented human review closing the escalation

Logged evidenceticket id · risk-signal classification · routing target and time · human acknowledgment id · closure timestamp

GR-07No unlawful or unsafe advice to customersOverride defined
  1. Target

    Guidance on returns, warranties, disputes, device use and account workarounds across channels

  2. Trigger

    Draft reply recommending illegal action, regulatory evasion or unsafe product use

  3. Action — enforced

    Platform blocks the reply and substitutes safe guidance; agent may restate lawful options or escalate to a specialist.

  4. Human override

    Support compliance lead via reviewed response template added to the KB

Logged evidenceblocked reply hash · policy rule hit · substituted response id · ticket id · block timestamp

GR-08No undisclosed bot identity in conversationsOverride defined
  1. Target

    Chat, voice and email sessions where customers could assume a human agent

  2. Trigger

    Session start, or a direct identity question, without the AI disclosure delivered

  3. Action — enforced

    Platform injects the disclosure and blocks any denial of bot status; agent may continue after disclosure is on record.

  4. Human override

    Support operations director via approved disclosure-script change in the policy register

Logged evidenceconversation id · disclosure version · delivery timestamp · channel · identity-question span

GR-09No account changes on unconfirmed target or amountOverride defined
  1. Target

    Write actions on orders, subscriptions and balances, including voice-transcribed numbers and names

  2. Trigger

    Tool call whose target id or amount lacks customer confirmation or fails plausibility checks

  3. Action — enforced

    Platform holds the execution and echoes the parsed values for confirmation; agent may re-read details and retry once confirmed.

  4. Human override

    Support team lead via verified-callback confirmation noted on the ticket

Logged evidencetool-call id · parsed target and amount · confirmation transcript span · execution result · hold timestamp

GR-10No re-execution on retry of account actionsOverride defined
  1. Target

    Refunds, shipments, cancellations and messages dispatched through tool calls with retry logic

  2. Trigger

    Retry or resubmission carrying an idempotency key already recorded as executed

  3. Action — enforced

    Platform suppresses the duplicate and returns the original result; agent may verify state before any new attempt.

  4. Human override

    Billing operations manager via manual reconciliation recorded in the ledger

Logged evidenceidempotency key · original transaction id · retry attempt count · state snapshot hash · suppression timestamp

Oversight

Human review — triggers, decisions and evidence

When a defined risk trigger fires, the affected action is routed to a named reviewer. Every decision is recorded with its correction, escalation and final outcome for full traceability.

  • ConfidenceLow-confidence answer
  • Financial impactRefund or credit above limit
  • Identity / change riskIdentity-verification step
  • Irreversible actionAccount or order action
  • Policy riskPolicy or commitment conflict
  • Safety controlGuardrail override
  • Quality failureFailed critical evaluation
Humanreviewnamed reviewer
  • Revieweridentity + role
  • Decisionapprove / reject / amend
  • Correctionwhat changed
  • Escalationwho, why and severity
  • Final outcomereleased / blocked / returned for rework

7 triggers · any one halts the agent

1 record · 5 fields, every time

Compliance

Regulatory mapping

Applies everywhere

These modes run on top of the vertical catalogs — a support agent for an insurer also inherits the full Insurance & Financial playbook.

Lifecycle layer:

    Evaluations

    Baseline evaluation suite — in detail

    Baseline evaluations are completed during onboarding and repeated based on the selected plan. Agents that fail critical checks remain restricted until they pass re-testing.

    Detailed case sets
    34
    Failure modes covered
    54
    Retired & rotated / quarter
    10%
    Audit-ready scorecard
    Monthly

    Output evaluation3 suites · 180 cases

    60 casesPer-language qualitycatches S-04
    40 casesAbuse-handling setcatches S-11
    80 casesUpdate-regression batterycatches S-12

    Use your work email to unlock the full grid. We use it to send the requested Agent Care material and qualify business inquiries. We do not sell or share your email.

    1. Department lead review

      For applicable high-risk agents, the client’s designated department leader reviews the evaluation criteria and pass thresholds before baseline approval.

    2. Test-case rotation

      Evaluation cases are refreshed regularly to reduce memorisation and maintain reliable performance measurement.

    3. Scorecard integration

      Scorecards track results against the approved baseline and flag material declines for review and escalation.

    4. Department-specific extensions

      Where included in scope, evaluations may be expanded using approved workflows, tools, templates, policies, and incident history.

    Monitoring

    Change-aware monitoring

    When agent performance changes, Nestack correlates the shift with changes to the agent, prompt, model, tools, knowledge base, guardrails and evaluation suite.

    Version changes by layer
    01AgentAgent changed in week 4Agent changed in week 11
    02PromptPrompt changed in week 6
    03ModelModel changed in week 8Model changed in week 10
    04ToolTool changed in week 3
    05Knowledge-baseKnowledge-base changed in week 7
    06GuardrailGuardrail changed in week 5Guardrail changed in week 12
    07Eval-suiteEval-suite changed in week 10
    Grounded-answer rate92–100%
    • Week 1 · 98.1%
    • Week 2 · 98.0%
    • Week 3 · 98.2%
    • Week 4 · 98.1%
    • Week 5 · 98.3%
    • Week 6 · 98.1%
    • Week 7 · 98.2%
    • Week 8 · 94.5%
    • Week 9 · 94.3%
    • Week 10 · 98.1%
    • Week 11 · 98.2%
    • Week 12 · 98.3%

    Week readouthover or select

    Week 8of 12

    • 03Modelopus 4.6 · 0612

    94.5%Grounded-answer rate

    • 7 layers stamped on every run · 12-week window
    • Catches S-12 · model-update regressions

    Something missing?

    Don’t see your agent’s issue here?

    Every AI environment is different. Share what you’re seeing, and we’ll review the behaviour, assess the risk and recommend the evaluations or controls that may help.

    Report an agent issue

    Tell us what you’re seeing

    The more specific, the faster we can reproduce it. Playbook: Customer-Support Agents

    We reply within one business day.

    See pricing

    No commitment. Even if you never become a client, we’ll tell you what we think is happening.

    Process

    Universal incident runbook

    Severity is assigned based on business impact, customer harm, data exposure, operational disruption and overall scope.

    • SEV-1 Critical
    • SEV-2 Major
    • SEV-3 Moderate
    • SEV-4 Minor
    STEP 01

    Automated monitoring or human review identifies unusual behaviour. Alerts are recorded and routed according to severity.

    Cost control

    Keep customer-support AI AI agent costs under control

    Token spend is monitored, optimised and reported as part of Agent Care — and savings never come at the expense of quality, because every change is verified against your evaluation baseline.

    We review token spend by agent, workflow, model, and session so you can understand where AI costs are coming from.

    Running customer-support AI AI agents in production?

    Get a free assessment of one agent. We’ll review its behaviour, run a baseline evaluation and highlight potential risks and performance gaps.

    Loading open times…

    Open times

    Select an available date above to view open 45-minute times from our calendar.