Vendors describe capabilities vaguely on purpose. Here is a concrete version.
What it does
Look things up. Search your own documents and website content before answering, rather than relying on whatever happened to fit in the prompt. This is what stops it inventing.
Capture a qualified lead. Record the enquiry with name, contact, what they want, and the answers to the qualifying questions. Refuse to record a lead with no way to contact the person, because that is just a note.
Open a support ticket. Create a numbered ticket in your inbox, give the visitor the number, attach what they described.
Notify your team. Email, or a signed webhook into a CRM, Slack or an automation tool.
Fetch a human. Bring a person into the live conversation when the visitor asks, or when it is out of its depth.
What it should refuse to do
Act destructively on its own initiative. Cancelling, refunding, deleting. These need explicit human confirmation, because the cost of a misread instruction is not symmetric.
Give professional advice. Medical, legal, electrical safety. The correct behaviour is to stop and route to a qualified person.
Quote what you have not published. Anything requiring a survey should produce a booked survey, not a number.
Pretend to be human. It will slip, and the trust you lose then is worth more than the trust you borrowed.
How permissions should work
Three properties are worth insisting on:
- Off by default. A new agent answers questions and does nothing else until you decide otherwise.
- Validated. Everything the model produces is checked against a schema before it reaches any real system. Model output is input, and it is influenced by pages you did not write.
- Logged. Every attempt recorded, including the refused ones, so "the agent tried to do X and was not allowed" is visible rather than invisible.
Why the refusals matter as much as the abilities
The interesting engineering in an action system is not making the AI capable. It is making sure that a hostile page, an odd instruction or a confused model cannot turn capability into damage.
A vendor who talks only about what their AI can do, and not about what it is prevented from doing, has thought about half the problem.
See it on your own site
Build one from your website and watch what it does with a question it cannot answer.
Related: AI employee vs chatbot · what is an AI employee.