How can customer support teams use AI agents?

Most support inboxes are dominated by the same few questions: where is my order, how do I reset my password, what are your hours, can I change my booking. An AI agent, meaning a language model that can follow instructions and use tools such as an order lookup, can answer many of these at any hour. The harder part is deciding what it should not handle, and making the move to a person smooth when that moment comes.

The safest designs treat the agent as a front desk, not a manager. It greets, sorts, answers what it is allowed to answer, and passes everything else to the right human with the details already gathered.

Decide what the agent may do

Start with a list of request types and sort each one into a column. This illustrative table is for an online store:

Agent handles alone	Agent prepares, person approves	Person handles from the start
Order status and tracking	Refunds and credits	Complaints about staff or service
Store hours, shipping times, return policy	Exceptions to policy	Billing disputes and fraud reports
Password reset links	Address changes on shipped orders	Health, safety or legal issues
Product questions from the catalog	Replacement of damaged items	Distressed or vulnerable customers

The middle column is where agents save the most time without taking risks. The agent collects the order number, photos and reason, then a team member clicks approve or reject. OpenAI's guidance on agent safety gives a pointed example of why this matters: an agent may offer a refund it is not supposed to. Its advice is to write your policies down clearly, with examples of the cases you want handled differently.

A worked design: triage, specialists and a human handoff

A common pattern uses several small agents rather than one large one. In OpenAI's Agents SDK, a handoff lets one agent pass the conversation to another that specializes, such as order status, refunds or general questions. The model sees each handoff as a tool it can choose; a handoff to a "Refund Agent" appears to it as a tool named transfer_to_refund_agent. A handoff can also carry data, such as the reason for escalating, which your code can log.

The same idea extends to people. Here is the outline of a triage agent's instructions for an imaginary store, Northwind Outfitters:

Prompt

You are the first point of contact for Northwind Outfitters support. You are an AI assistant, and you say so in your first message.

Route each request:
- Order status, shipping, store policies: answer using the order_lookup and policy_search tools only.
- Refund, credit or policy exception: collect the order number, the reason and any photos, then transfer to the refund agent. Never promise an outcome.
- Complaint, billing dispute, fraud, injury, legal threat, or a customer who is upset or asks for a person: transfer to a human with a summary.

When you transfer to a human, write a summary in this form:
Customer request: …
What has been checked: …
What the customer was told: …
Reason for transfer: …

Never ask for full card numbers, passwords or government ID numbers. If a customer types one, don't repeat it.

The summary format matters more than it looks. A customer who has to explain their problem twice starts the human conversation annoyed. A four-line summary lets the person pick up exactly where the agent stopped.

Try it: Take your team's last 50 tickets and sort them into the three columns above. Count how many fall in each. The left column shows what an agent could handle; the right column shows the escalation rules you need to write first.

Disclosure: say it's an AI

Customers should know when they are talking to software. In the European Union, Article 50 of the AI Act requires that AI systems designed to interact with people be built so those people are told they are dealing with an AI, unless that is obvious from the context. The information must be clear and given no later than the first interaction, and the AI Act Explorer site states that this article applies from August 2, 2026. Other places have their own rules, and customers everywhere appreciate honesty. A plain first line such as "I'm Northwind's AI assistant; I can check orders and policies, and I'll bring in a person whenever you need one" covers both.

Privacy and safety limits

Support conversations are full of personal information. Three principles from OpenAI's agent safety guidance apply directly:

Share as little as possible. An agent can leak private data without any attacker, simply by sending more to a tool than it needed. Give the order tool an order number, not the whole customer record.
Treat customer text as untrusted. A message can contain instructions meant to manipulate the agent, a prompt injection. Keep customer input separate from your own instructions, and have tools return fixed fields rather than free text where possible.
Filter and approve. Use guardrails that redact personal details, keep approvals on for actions that change anything, and review conversation logs regularly.

OpenAI is frank that agents will still make mistakes or be tricked even with these measures. That is why the right-hand column exists.

When must a customer reach a person?

Whenever they ask. A request for a human should be honored at once, without making the customer repeat themselves or argue with the agent. Make the option visible in the first message, and test it regularly, since a hidden or broken escalation path is one of the fastest ways to lose customer trust.

A person should also take over when the stakes are high: money moving outside normal policy, disputes, suspected fraud, anything involving health, safety or the law, and decisions that significantly affect someone's account. The agent can gather facts for these cases, but a human should decide and communicate the outcome.

Finally, escalate when the agent is struggling or the customer is. Set simple triggers: the same question asked twice, two failed tool lookups, or signs of frustration or distress. Erring toward a person costs a few minutes of staff time; erring the other way can cost a customer.