Outside AI agents can draft requests, not approve them

A customer proposed letting an outside AI agent read an alert and fill in a support ticket at Corvid Cloud. Elena Voss, a product manager there, said the agreed scope gave the agent only the alert and details needed for the ticket, not the customer’s whole account. She could not confirm that the workflow went live.

That distinction — preparing a request versus making a consequential decision — shaped the boundaries four people described to Bonzai for customers’ outside agents. They would permit limited tasks, then keep a person involved when the next step required approval, inspection or a current answer. None could point to a live test of that boundary with a customer’s agent.

Voss saw a use for an agent that filled in a ticket: “saving someone copy-and-paste doesn’t justify letting an outside agent read everything.” Kenji Moreau, owner and repair technician at FixPoint Repair, would let one book a time and send the device model and reported problem, subject to customer confirmation. Miriam Sayegh, sommelier and wine buyer at Cedar Table, would let an agent narrow the wine list by budget and style. Walt Brennan, co-founder and brewer at Kettle Yard Brewing, would be comfortable with an agent giving taproom hours from the brewery’s current page.

Each would stop short of a decision the information could not settle. Voss would keep changes to who can access customer data in Corvid Cloud’s interface for a person to review and confirm; she cited customers’ questions about agent access and data handling, not a specific incident. Moreau would inspect a device before quoting a price or choosing a part: a phone that appears to need a battery can instead have lint in its charging port. Sayegh would have staff check stock, discuss preferences and confirm a bottle. A guest request passed along to them as only “red with lamb” lacked a budget and a preference for a lighter or heavier wine. Brennan has seen customers arrive for beer on an outdated tap list, though he cannot say an AI sent them. He wants customers to contact the brewery about what is pouring: “Better they call and get a straight answer than have some assistant promise them a beer we’re out of.”

Marcus Hale, a partner at Northgate Ventures, has not seen a business allow or refuse a customer’s own agent for a particular task. He would want narrow permission, a record of its actions and a way for the customer to review or reverse them. His firsthand example concerns a different kind of agent: Two portfolio companies used their own AI agents for routine support, cut their support teams roughly in half, then rehired some staff within six months as customers still needed people for problems outside the usual pattern. Jeff Tannenbaum, a product manager focusing on consumer AI who lives in Los Altos, California, described another complication: Outside agents can navigate a business’s website through Chrome in ways the business may not distinguish from a customer’s actions. He has not seen a business block one.

For the four people who drew customer-facing boundaries, an outside agent could prepare a limited request or relay information, but approval or a decision needing a fresh check would stay with a person. None could point to that boundary being tested in a live customer-agent workflow.

At Corvid Cloud, that would mean an agent could fill in a ticket from an alert. A change to who can see customer data would still wait for someone to confirm it in the company’s own interface.