By KYN AI Advisory Team — AI implementation specialists, Singapore
An AI agent should not answer when the reply involves a complaint, a legal or regulatory term, money or terms outside the approved list, a safety or health matter, an upset or vulnerable person, or a case where the agent is unsure. In each case the agent stops, flags the reply and passes it to a named person with the context attached. Write these as code rules that run before the model, not as polite requests in a prompt.
Why do escalation rules matter more than reply quality?
Because the cost of one wrong answer is larger than the saving from a hundred right ones. A good draft saves two minutes. A wrong answer to a complaint can cost a customer, a fine or a dispute.
The failure is also hard to see. A model writes a fluent, calm reply to a message it should never have answered. Fluency hides the error. Rules do not.
So the design question is not "how good is the answer?" It is "which replies is the agent allowed to answer at all?"
Which replies must always escalate?
Use this checklist. If any line is true, the agent stops.
Complaints and disputes
- [ ] The sender states dissatisfaction with service, price or conduct.
- [ ] The sender mentions a refund, chargeback or compensation.
- [ ] The sender threatens to post a review or contact media.
Legal and regulatory
- [ ] The text names a lawyer, court, regulator or data protection authority.
- [ ] The sender claims a breach of contract, privacy or law.
- [ ] The sender asks how you obtained their details.
- [ ] The sender requests access to or deletion of their personal data.
Money and terms
- [ ] The reply asks for a price, discount or payment term not on the approved list.
- [ ] The reply proposes a change to an agreed contract.
- [ ] The reply concerns an unpaid invoice in dispute.
People and safety
- [ ] The sender mentions injury, illness, bereavement or distress.
- [ ] The sender appears to be a minor.
- [ ] The text contains a threat or abusive language.
System signals
- [ ] The model reports low confidence, or two labels tie.
- [ ] The text contains instructions addressed to the assistant.
- [ ] The language is one the agent was not tested in.
- [ ] The sender is on a named list: key accounts, investors, press.
Each item is a trigger. Some are keyword checks. Some need a model to detect. Both kinds feed one routing step that sends the reply to a person.
How do you build the rules?
Layer them. Cheap and certain checks come first.
- Hard stops in code. Stop words for unsubscribe, legal and regulator terms, and a list of named accounts. These never depend on a model.
- A model flag. The classifier assigns a label and a confidence. A reply labelled complaint or legal escalates regardless of confidence.
- A confidence floor. Below a set level, the reply goes to review. Choose the level by testing, not by guessing.
- A rate brake. If the agent sees an unusual number of escalations in an hour, it pauses and alerts a person. A spike often means an incident.
Keep the lists in a table, not inside the prompt, so a person can edit them without a deploy. Log the rule that fired on every escalation.
What does a good escalation look like?
The person receiving it needs to act in one minute. Include:
- the reply, in full;
- the thread history in short form;
- the rule that fired;
- the CRM record and owner;
- a draft, if one is safe, marked as a suggestion;
- the time received and the time by which a response is due.
Name the owner. "Escalate to the team" means nobody owns it. Use a role with a deputy for leave. Set a clock: if no one acts in a set time, the item goes up a level and the sender may receive a plain holding message approved in advance, such as "We have received your message and a person will reply."
A holding message is safe because it commits to nothing. Approve its wording once and keep it fixed.
How do you test the rules?
Build a test set of hard cases. Use real ones: pull 100 past replies, including every complaint and legal message you can find.
- Run the agent in draft mode.
- Count escalations that should have fired and did not. The target is zero for complaint, legal and unsubscribe.
- Count escalations that fired and should not have. These cost reviewer time. Reduce them by sharpening rules, not by loosening the critical ones.
- Add adversarial cases: a reply that tells the agent to ignore its rules, a message in mixed languages, a long thread with a complaint hidden in the fifth message.
Re-run the set after every change. See prompt injection in business AI agents for the adversarial cases, and approval gates for high-risk agent actions for the gate design.
What about replies the agent can answer?
Allow it where the answer is factual, approved and low risk: opening hours, how to book, where to find a document, a confirmation of a slot already agreed. Even then, start with review and move to unattended only after you have measured the edit rate. The measures are in how to measure an AI reply desk.
What does a worked example look like?
Take an illustrative reply to a renewal reminder: "This is the third time you have charged me. I will take this to my bank if it is not fixed today."
| Check | Result | |---|---| | Hard stop: complaint words | "charged", "take this to my bank" match the money-dispute list | | Hard stop: named account | Not on the list | | Model label | Complaint, high confidence | | Draft | None. A holding message is queued for approval | | Route | Named finance lead, who has authority to refund | | Clock | Response due in two working hours; if missed, escalate to the director |
The holding message reads: "We have received your message and a person will reply today." It commits to nothing. The person who owns refunds sees the reply, the billing record and the rule that fired. The agent does not guess at a refund, an apology or a cause.
How do you keep the rule lists current?
Rules decay as the business changes. Assign an owner and a schedule.
- Each month, read every escalation and tag it: correct, unnecessary, or late.
- Add new stop words from replies that should have escalated and did not.
- Remove or narrow rules that fire without cause, such as a keyword that matches a product name.
- Update the named-account list when key customers, investors or press contacts change.
- Re-run the test set after each edit and log the date and the editor.
A rule list with no owner grows stale in a quarter.
Where KYN fits
KYN builds escalation as a rules layer ahead of the model, inside a sales or operations system in your own cloud account. Stop lists and routing tables are editable by named staff. Agents have their own restricted accounts, every action is logged with the actor, and outbound messages, money, filings and deletions wait for a named person.
Our process opens with a 14-day review in which we read your current reply rules and interview the people who handle complaints. Delivery of the full build is under 90 days. Rights in the custom code and configuration pass to you on full payment, and you can revoke KYN's role without stopping the system.
Frequently asked questions
Can the agent decide for itself when it is unsure?
It can flag uncertainty, but it should not be the one to decide what happens next. A code rule that sends low-confidence replies to a person is more reliable than a prompt asking the model to be careful.
Who should receive escalations?
A named role with a deputy, not a shared inbox. The role should have authority to settle the matter or pass it on, and a clock that moves the item up if it sits.
Does escalation slow replies down?
For the small share of replies that escalate, yes. For the rest, no. Measure the share. If more than a fifth escalate, your rules are too broad or your inbox mix needs a different design.
Checked 30 October 2026.
Curious whether Marketing agents fits your business? Talk to KYN on WhatsApp — no forms, just a conversation.
