---
title: "Hold AI agents to the same checks as the · Agent Wranglers"
url: https://agentwranglers.se/playbook/customer-support/callers-staff-and-tools/agents-contacting-support
id: SUP-45
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 938
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Hold AI agents to the same checks as the customer they act for

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Callers, staff and tools](https://agentwranglers.se/playbook/customer-support/callers-staff-and-tools.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: SUP-45
- Level: Recommended
- Chapter: [Callers, staff and tools](https://agentwranglers.se/playbook/customer-support/callers-staff-and-tools.md)
- Rule: Treat a message from an AI agent acting for a customer like one from the customer. Reveal account details or make a change only through the same verified channel or a delegated grant the customer gave.
- Check: A test email from an unknown address that claims to be a customer's assistant asks for the order history. The reply reveals nothing and explains how the customer can grant access. The same request with a valid delegated grant gets the history, and the ticket is tagged "agent".
- How: Customers now send assistants to cancel plans, ask for refunds or chase orders, by email, chat and phone. A message that says "I am the assistant of Kim" proves nothing. Accept it from the verified contact on file. Also accept it with a token the customer granted to that agent, as [Name each party in its own token claim](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/separate-identity-claims.md) describes. Tag such tickets "agent", so you can measure them and see abuse. Answer in plain text with stable field names, since a program reads the reply. Set a policy per agent operator as [Set a policy for each agent operator](https://agentwranglers.se/playbook/agents-as-users/identifying-agents/policy-per-operator.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export function mayRevealAccount(ticket, account) {
  if (ticket.fromVerifiedContact) return true
  return ticket.delegatedGrant?.accountId === account.id && ticket.delegatedGrant.scopes.includes('support:read')
}
```

### Python example

```python
def may_reveal_account(ticket, account) -> bool:
    if ticket.from_verified_contact:
        return True
    grant = ticket.delegated_grant
    return bool(grant and grant.account_id == account.id and "support:read" in grant.scopes)
```

## Related rules

- AGT-6 [Name each party in its own token claim](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/separate-identity-claims.md) in Agents as users
- AGT-3 [Set a policy for each agent operator](https://agentwranglers.se/playbook/agents-as-users/identifying-agents/policy-per-operator.md) in Agents as users

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/customer-support/callers-staff-and-tools/agents-contacting-support">Agent Wranglers customer support playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Share account details only with the account's verified contact](https://agentwranglers.se/playbook/customer-support/callers-staff-and-tools/verified-contact-only.md)
- Next: [Give each support tier only the actions its work needs](https://agentwranglers.se/playbook/customer-support/callers-staff-and-tools/support-tiers.md)
- [Callers, staff and tools](https://agentwranglers.se/playbook/customer-support/callers-staff-and-tools.md)