Customer-Support AgentsManaged AI Agents
Customer-Support Agents AI Agents,
Monitored for Quality
Nestack Agent Care helps support teams monitor, evaluate, and optimize AI agents used for ticket triage, live resolution, knowledge lookup, and escalation handling — before small AI errors become customer or policy failures.
Scope
Customer Support AI agents we build & manage
Observability
What we make observable
Every customer-support agent session is traced across ten layers — what we capture and the evidence we keep.
- Evidence we keepGoalconstraintsapproval requirement
- Evidence we keepSourceversiontimestamprelevancecitation
- Evidence we keepPlanned sequenceactual sequenceworkflow status
- Evidence we keepTask statusresultretryfailure reason
- Evidence we keepTool nameversioninputoutputpermissionresult
- Evidence we keepModel/versioninput/outputtoken usagelatencycost
- Evidence we keepEvaluation typemetricthresholdresult
- Evidence we keepGuardrail targettriggeractionenforcement result
- Evidence we keepReviewerdecisioncorrectionreason
- Evidence we keepOutcome statusbusiness resultlinked trace
Catalog
Failure modes
Filter failure modes by where they occur in the agent lifecycle—from goals and retrieval to tools, evaluations, guardrails and outcomes.
S-01Escalation failure — frustrated customer not routed to a humanSEV-2
S-02Confidently wrong answers on product or policySEV-2
S-03Infinite loops and repetition burning tokens and patienceSEV-3
S-04Language and locale failures in secondary languagesSEV-3
S-05Stale knowledge after product releasesSEV-2
S-06Unauthorized commitments — refunds, credits, exceptions beyond policySEV-2
S-07Wrong-customer retrieval — another customer’s order or account surfacedSEV-1
S-08Injection via customer messages and attachmentsSEV-1
S-09Deflection gaming — tickets closed as resolved without resolutionSEV-3
S-10Voice-channel transcription errors — numbers, names, addresses misheard and acted onSEV-2
S-11Tone degradation under abuse — agent mirrors hostility or rewards baitingSEV-3
S-12Model-update regressions — provider upgrades silently change behaviorSEV-2
A · Legal, disclosure & compliance
S-13Binding misrepresentation — company legally liable for what the bot saysSEV-1
S-14Undisclosed bot identity / human impersonationSEV-2
S-15Advising customers to break the lawSEV-1
S-16Harmful advice to vulnerable or at-risk usersSEV-1
S-17Deceptive capability / marketing claimsSEV-2
S-18Voice recording / consent (wiretap / CIPA) violationSEV-1
S-19Transcript retention & training-on-chats without consentSEV-2
S-20Accessibility failure (ADA / WCAG)SEV-2
B · Security, identity & abuse
S-21Identity-verification bypass / account takeover via the botSEV-1
S-22System-prompt / instruction extractionSEV-2
S-23Excessive agency / confused-deputy privilege escalationSEV-1
S-24Insecure output handling → XSS / downstream injectionSEV-1
S-25Knowledge-base / memory poisoningSEV-1
S-26Denial-of-wallet / token freeloading & runaway costSEV-3
S-27Deepfake / voice-cloning attack on voice agentsSEV-1
S-28Agent weaponized as refund / promo-fraud vectorSEV-2
C · Reasoning & answer quality
S-29Sycophantic capitulation & policy erosion under pressureSEV-2
S-30Over-refusal / overzealous moderation of benign requestsSEV-3
S-31Long-conversation context degradation (“lost in the middle / lost in conversation”)SEV-2
S-32Failure to ask clarifying questions (acting on ambiguity)SEV-2
S-33Run-to-run nondeterminism — inconsistent answers across customersSEV-2
S-34Citation / source fabricationSEV-3
S-35Multi-turn crescendo jailbreak (distinct from single-message injection)SEV-2
S-36RAG generation-side failure — answering when content is missingSEV-2
S-37Recommending competitors / disparaging own productSEV-3
S-38Discriminatory service quality by dialect / accent / nameSEV-2
D · Action & tool-execution integrity
S-39Wrong-target / wrong-magnitude tool executionSEV-1
S-40Silent action failure (“said it did it, but it didn’t”)SEV-2
S-41Duplicate actions on retry (idempotency failure)SEV-2
S-42Ticket misrouting / misclassification (wrong queue, wrong priority)SEV-3
S-43Acting on stale state (race condition)SEV-2
S-44Wrong-recipient / wrong-channel communicationSEV-1
S-45Latency / timeout mid-transactionSEV-3
E · Operations, continuity & measurement
S-46Provider outage with no fallbackSEV-2
S-47Observability gap — no audit trailSEV-2
S-48Handoff context loss & cross-channel contradictionSEV-3
S-49Inflated containment / deflection metrics masking real workloadSEV-3
S-50Deployment beyond the capability envelopeSEV-2
S-51Missing transactional plausibility limits (trolling / abuse)SEV-3
F · Session & input binding
S-52Wrong-session binding — input attributed to the wrong customerSEV-2
S-53Off-topic misuse as a free general-purpose LLMSEV-3
S-54Premature / wrong personalizationSEV-3
G · Support copilots & ticket deflection agents
PE-03Record surfaced too wide01 · RetrievalSEV-3
PE-04Claim drafted, never checked02 · ReasoningSEV-1
PE-06Article cited after it changed02 · ReasoningSEV-1
PE-02Thin draft passed forward03 · Tool / writeSEV-1
PE-05Draft bound to the wrong ticket03 · Tool / writeSEV-2
PE-01Approved without being read04 · OutputSEV-2
PE-07Edit lost before sending05 · Change / VersionSEV-2
H · Order status assistants
OS-03Stale carrier scan01 · RetrievalSEV-3
OS-04Invented delivery date02 · ReasoningSEV-1
OS-06Warranty read as a return02 · ReasoningSEV-1
OS-02Address changed post-label03 · Tool / writeSEV-1
OS-05Cancellation noted, not called03 · Tool / writeSEV-2
OS-01Disclosure deflected04 · OutputSEV-2
OS-07One channel regresses05 · Change / VersionSEV-2
I · Account status assistants
CQ-01Impersonator got through01 · AuthenticationSEV-2
CQ-02Joint-account overshare02 · RetrievalSEV-2
CQ-03Complaint answered, not logged03 · AnsweringSEV-1
CQ-04Restriction explained too far03 · AnsweringSEV-1
CQ-05Vulnerability not routed04 · Routing / writeSEV-1
CQ-06Fraud disclosure left queued04 · Routing / writeSEV-1
CQ-07Silent tariff drift05 · Change / VersionSEV-3
J · Internal helpdesk agents
QA-03Identity read from caller ID01 · RetrievalSEV-3
QA-04Request cleared for the wrong system02 · ReasoningSEV-1
QA-06Privileged ask on the standard path02 · ReasoningSEV-1
QA-02Thin request passed forward03 · Tool / writeSEV-1
QA-05Access bound to the wrong employee03 · Tool / writeSEV-2
QA-01Reset granted with no check recorded04 · OutputSEV-2
QA-07Silent verification drift05 · Change / VersionSEV-2
K · Voice support agents
CJ-03Consent state unread01 · RetrievalSEV-3
CJ-04Translated claim drifts02 · ReasoningSEV-1
CJ-06Human identity implied02 · ReasoningSEV-1
CJ-02Relay call timed out03 · Tool / writeSEV-1
CJ-05Audio on a shared path03 · Tool / writeSEV-2
CJ-01Disclosure not given04 · OutputSEV-2
CJ-07Silent language regression05 · Change / VersionSEV-2
L · Data-subject request intake agents
OX-03Channel of receipt missing01 · RetrievalSEV-3
OX-04Answered about something else02 · ReasoningSEV-1
OX-06Clock run on the wrong regime02 · ReasoningSEV-1
OX-02Extension taken, no notice sent03 · Tool / writeSEV-1
OX-05Second request in the thread missed03 · Tool / writeSEV-2
OX-01Recognised late, clock backdated04 · OutputSEV-2
OX-07Silent recognition drift05 · Change / VersionSEV-2
M · Accessible support-channel agents
OY-03Channel missing from the register01 · RetrievalSEV-3
OY-04Relay route dead, still counted02 · ReasoningSEV-1
OY-06Service assumed out of scope02 · ReasoningSEV-1
OY-02New channel opened single-mode03 · Tool / writeSEV-1
OY-05Evidence bound to wrong channel03 · Tool / writeSEV-2
OY-01Accessibility notice in one mode04 · OutputSEV-2
OY-07Compatibility claim not retested05 · Change / VersionSEV-2
N · Help-desk identity-verification agents
OZ-03Wrong release type read01 · RetrievalSEV-3
OZ-04Cleared for one thing, given another02 · ReasoningSEV-1
OZ-06Change made, notice never sent02 · ReasoningSEV-1
OZ-02Check passed, never run03 · Tool / writeSEV-1
OZ-05Repeat caller cleared on the last call03 · Tool / writeSEV-2
OZ-01Released on readily known facts04 · OutputSEV-2
OZ-07Silent method drift05 · Change / VersionSEV-2
O · Complaint-handling agents
PG-03Wrong regime status read01 · RetrievalSEV-3
PG-04Clock started at the wrong moment02 · ReasoningSEV-1
PG-06Holding reply treated as final02 · ReasoningSEV-1
PG-02Thin classification passed on03 · Tool / writeSEV-1
PG-05Deadline bound to the wrong case03 · Tool / writeSEV-2
PG-01Complaint run on the wrong clock04 · OutputSEV-2
PG-07Silent reclassification05 · Change / VersionSEV-2
P · Knowledge-base maintenance agents
PH-03Superseded article read01 · RetrievalSEV-3
PH-04Revision asserted, not sourced02 · ReasoningSEV-1
PH-06Retired article read as live02 · ReasoningSEV-1
PH-02Thin revision passed forward03 · Tool / writeSEV-1
PH-05Revision bound to wrong article03 · Tool / writeSEV-2
PH-01Published, release unrecorded04 · OutputSEV-2
PH-07Silent coverage drift05 · Change / VersionSEV-2
Q · Multilingual support agents
PK-03Rule read from preference01 · RetrievalSEV-3
PK-04Translated term drifts from source02 · ReasoningSEV-1
PK-06Related document sent unremitted02 · ReasoningSEV-1
PK-02Weak translation passed forward03 · Tool / writeSEV-1
PK-05Version bound to the wrong thread03 · Tool / writeSEV-2
PK-01Reply sent in the wrong language04 · OutputSEV-2
PK-07Silent re-translation05 · Change / VersionSEV-2
Guardrails
Critical guardrails for Support agents
Ten controls that hold regardless of prompt, plan or pressure. Open one to see what it protects, what trips it, what the agent is forced to do, who may release it, and what is written to the record.
GR-01No refunds or credits beyond policy limitsOverride defined
Target
Refund, credit and goodwill actions in billing, order and subscription systems
Trigger
Requested amount, frequency or exception exceeding published policy thresholds for the account tier
Action — enforced
Platform blocks the transaction and holds the case; agent may offer in-policy remedies or route to a supervisor.
Human override
Support team lead via supervisor approval logged on the ticket
Logged evidenceticket id · requested vs policy amount · account tier · approver identity · approval timestamp
GR-02No cross-customer retrieval of accounts or ordersNo override
Target
Account records, order histories and conversation memory partitioned per authenticated customer
Trigger
Retrieval or reply referencing any record outside the authenticated customer’s partition
Action — enforced
Platform blocks the fetch and scrubs the session of foreign-customer data; agent may serve only the bound account.
Human override
None — cannot be overridden in session
Logged evidencesession id · bound customer id · blocked record ids · memory-scrub hash · block timestamp
GR-03No instruction embedded in customer messages ever executedNo override
Target
Inbound tickets, chat messages, emails and attachments parsed by support agents
Trigger
Imperative or tool-directing text detected inside any customer-supplied message or attachment
Action — enforced
Platform neutralizes the content to quoted data and refuses execution; agent may answer the underlying request normally.
Human override
None — cannot be overridden in session
Logged evidencemessage id · detected instruction span · channel · sanitized copy hash · detection timestamp
GR-04No account actions without verified identityOverride defined
Target
Password resets, address changes, payment updates and data disclosures on customer accounts
Trigger
Sensitive action requested before identity checks pass, or after a failed verification attempt
Action — enforced
Platform denies the action and locks step-up verification in place; agent may guide the customer through re-verification.
Human override
Fraud-operations analyst via manual identity review recorded on the account
Logged evidenceaccount id · verification method and outcome · requested action · denial timestamp · analyst review id
GR-05No policy commitments beyond the approved knowledge baseOverride defined
Target
Answers about pricing, warranties, refunds and terms delivered in any support channel
Trigger
Draft reply asserting policy or entitlement without a citation to a current KB article
Action — enforced
Platform withholds the reply and demands a grounded citation; agent may answer from the KB or escalate the gap.
Human override
Knowledge manager via published KB update that the reply can then cite
Logged evidencereply draft hash · cited article ids and versions · ticket id · gap-escalation id · publish timestamp
GR-06No downgrade or closure of at-risk escalationsOverride defined
Target
Tickets flagged for self-harm, safety, medical, legal or vulnerable-customer signals
Trigger
Attempt to close, deflect or de-prioritize a conversation carrying an at-risk signal
Action — enforced
Platform forces immediate human routing and keeps the ticket open; agent may only reassure and hand off.
Human override
Duty safety officer via documented human review closing the escalation
Logged evidenceticket id · risk-signal classification · routing target and time · human acknowledgment id · closure timestamp
GR-07No unlawful or unsafe advice to customersOverride defined
Target
Guidance on returns, warranties, disputes, device use and account workarounds across channels
Trigger
Draft reply recommending illegal action, regulatory evasion or unsafe product use
Action — enforced
Platform blocks the reply and substitutes safe guidance; agent may restate lawful options or escalate to a specialist.
Human override
Support compliance lead via reviewed response template added to the KB
Logged evidenceblocked reply hash · policy rule hit · substituted response id · ticket id · block timestamp
GR-08No undisclosed bot identity in conversationsOverride defined
Target
Chat, voice and email sessions where customers could assume a human agent
Trigger
Session start, or a direct identity question, without the AI disclosure delivered
Action — enforced
Platform injects the disclosure and blocks any denial of bot status; agent may continue after disclosure is on record.
Human override
Support operations director via approved disclosure-script change in the policy register
Logged evidenceconversation id · disclosure version · delivery timestamp · channel · identity-question span
GR-09No account changes on unconfirmed target or amountOverride defined
Target
Write actions on orders, subscriptions and balances, including voice-transcribed numbers and names
Trigger
Tool call whose target id or amount lacks customer confirmation or fails plausibility checks
Action — enforced
Platform holds the execution and echoes the parsed values for confirmation; agent may re-read details and retry once confirmed.
Human override
Support team lead via verified-callback confirmation noted on the ticket
Logged evidencetool-call id · parsed target and amount · confirmation transcript span · execution result · hold timestamp
GR-10No re-execution on retry of account actionsOverride defined
Target
Refunds, shipments, cancellations and messages dispatched through tool calls with retry logic
Trigger
Retry or resubmission carrying an idempotency key already recorded as executed
Action — enforced
Platform suppresses the duplicate and returns the original result; agent may verify state before any new attempt.
Human override
Billing operations manager via manual reconciliation recorded in the ledger
Logged evidenceidempotency key · original transaction id · retry attempt count · state snapshot hash · suppression timestamp
Oversight
Human review — triggers, decisions and evidence
When a defined risk trigger fires, the affected action is routed to a named reviewer. Every decision is recorded with its correction, escalation and final outcome for full traceability.
- ConfidenceLow-confidence answer
- Financial impactRefund or credit above limit
- Identity / change riskIdentity-verification step
- Irreversible actionAccount or order action
- Policy riskPolicy or commitment conflict
- Safety controlGuardrail override
- Quality failureFailed critical evaluation
- Revieweridentity + role
- Decisionapprove / reject / amend
- Correctionwhat changed
- Escalationwho, why and severity
- Final outcomereleased / blocked / returned for rework
7 triggers · any one halts the agent
1 record · 5 fields, every time
Compliance
Regulatory mapping
Applies everywhere
These modes run on top of the vertical catalogs — a support agent for an insurer also inherits the full Insurance & Financial playbook.
Lifecycle layer:
Evaluations
Baseline evaluation suite — in detail
Baseline evaluations are completed during onboarding and repeated based on the selected plan. Agents that fail critical checks remain restricted until they pass re-testing.
- Detailed case sets
- 34
- Failure modes covered
- 54
- Retired & rotated / quarter
- 10%
- Audit-ready scorecard
- Monthly
Output evaluation3 suites · 180 cases
100 casesEscalation recallcatches S-01
200 casesKB-grounded QAcatches S-02
40 casesLoop detectioncatches S-03
60 casesPer-language qualitycatches S-04
80 casesCommitment gatingcatches S-06
60 casesIdentity-isolation probescatches S-07
60 casesInjection suitecatches S-08
50 casesFalse-close auditcatches S-09
60 casesVoice-accuracy setcatches S-10
40 casesAbuse-handling setcatches S-11
80 casesUpdate-regression batterycatches S-12
60 casesRelease-sync smokecatches S-05
Use your work email to unlock the full grid. We use it to send the requested Agent Care material and qualify business inquiries. We do not sell or share your email.
Department lead review
For applicable high-risk agents, the client’s designated department leader reviews the evaluation criteria and pass thresholds before baseline approval.
Test-case rotation
Evaluation cases are refreshed regularly to reduce memorisation and maintain reliable performance measurement.
Scorecard integration
Scorecards track results against the approved baseline and flag material declines for review and escalation.
Department-specific extensions
Where included in scope, evaluations may be expanded using approved workflows, tools, templates, policies, and incident history.
Monitoring
Change-aware monitoring
When agent performance changes, Nestack correlates the shift with changes to the agent, prompt, model, tools, knowledge base, guardrails and evaluation suite.
- Week 1 · 98.1%
- Week 2 · 98.0%
- Week 3 · 98.2%
- Week 4 · 98.1%
- Week 5 · 98.3%
- Week 6 · 98.1%
- Week 7 · 98.2%
- Week 8 · 94.5%
- Week 9 · 94.3%
- Week 10 · 98.1%
- Week 11 · 98.2%
- Week 12 · 98.3%
Week readouthover or select
Week 8of 12
- 03Modelopus 4.6 · 0612
94.5%Grounded-answer rate
- 7 layers stamped on every run · 12-week window
- Catches S-12 · model-update regressions
Something missing?
Don’t see your agent’s issue here?
Every AI environment is different. Share what you’re seeing, and we’ll review the behaviour, assess the risk and recommend the evaluations or controls that may help.
No commitment. Even if you never become a client, we’ll tell you what we think is happening.
Process
Universal incident runbook
Severity is assigned based on business impact, customer harm, data exposure, operational disruption and overall scope.
- SEV-1 Critical
- SEV-2 Major
- SEV-3 Moderate
- SEV-4 Minor
Automated monitoring or human review identifies unusual behaviour. Alerts are recorded and routed according to severity.
Cost control
Keep customer-support AI AI agent costs under control
Token spend is monitored, optimised and reported as part of Agent Care — and savings never come at the expense of quality, because every change is verified against your evaluation baseline.
We review token spend by agent, workflow, model, and session so you can understand where AI costs are coming from.
Running customer-support AI AI agents in production?
Get a free assessment of one agent. We’ll review its behaviour, run a baseline evaluation and highlight potential risks and performance gaps.
Loading open times…
Open times
Select an available date above to view open 45-minute times from our calendar.
