Agentic AI in Customer Service: What AI Agents Can Actually Do

"Agentic" is on every support vendor's homepage in 2026, and it now covers everything from a decision-tree bot with a new logo to software that can cancel a subscription on its own. The useful question is not whether a product is agentic. It is which of your customers' requests the agent can complete, what it must check before it touches an account, and what happens when it gets something wrong.

This guide is for founders, support leads and operations managers deciding how much to let an AI agent do. It defines the term, lays out the spectrum from FAQ bot to action-taking agent, and maps common support tasks to three levels: safe to automate, automate with verification, and keep with a person. Then it covers guardrails, analyst forecasts and how actions work in PepoChat, which we build, including the limits.

What is agentic AI in customer service?

Agentic AI in customer service is an AI system that works toward the customer's goal by deciding which steps to take and carrying them out through connected tools, rather than only writing a reply. The test is simple: can it do something in another system on the customer's behalf?

Agentic AI is software built on a language model that decides, from the conversation, which actions to take, takes them through tools it has been given, reads the results and decides what to do next. A tool (vendors also say action, skill or function) is one operation the model is allowed to call, such as "look up order by number", with defined inputs and a result it can read.

Anthropic's December 2024 engineering guide, Building effective agents, draws a distinction most vendor pages blur. It calls systems in which the model and its tools follow a path written in code "workflows", and systems in which the model directs its own process and tool use "agents"; both count as agentic. The guide names support as a natural fit, because support conversations need outside information and actions and success is easy to judge. Its one-line summary: "Customer support combines familiar chatbot interfaces with enhanced capabilities through tool integration." It also recommends starting with the simplest system that works and adding autonomy only when simpler designs fall short.

Gartner's March 2025 press release draws a similar line, contrasting earlier generative AI, which produced text or summaries, with agentic AI that can act on its own. In practice, a support agent becomes agentic the moment it can read live order data, change a subscription, create a ticket or book a meeting. Everything before that is answering.

AI agents vs chatbots: where does agentic AI sit on the spectrum?

There are three broad levels, and many products marketed as agentic sit at the second. What separates them is what the software can know and what it can change.

A FAQ bot returns pre-written replies and menus, and cannot handle a question nobody anticipated. A grounded answer agent searches your knowledge base for every question, writes the answer from what it finds and hands off when it finds nothing; it can tell a customer your return window, but not whether their return arrived. An action-taking agent is the same grounded agent plus tools, so it can look up that return. This is where "agentic" means something, and where the risk moves from a wrong answer to a wrong change.

Most teams should get level two working well before adding level three, because an agent that takes actions on top of a thin knowledge base fails in more expensive ways. A copilot, which drafts replies for your staff and never talks to the customer, is a different product again; what is an AI support agent compares agents, chatbots and copilots side by side.

What can AI agents actually do in customer service today?

The actions that work reliably in 2026 are short, well-defined operations against a system that already has an API: look up an order, read or cancel a subscription, create or check a ticket, book a meeting, find a contact, post an alert. Long chains of judgement calls are not reliable yet.

Order status. "Where is my order?" is the most common ecommerce question, and it is a read-only lookup by order number or email. The agent asks for the number, calls the store and reports the payment and fulfilment status in plain language.

Subscriptions. Which plan am I on, when does it renew, and please cancel at the end of the period. Reading is easy. Cancelling is a write that needs an explicit request and a confirmation.

Tickets. When the agent cannot resolve something, filing a ticket in your helpdesk with the customer's email and a summary turns a dead end into a tracked follow-up. Checking an existing ticket's status is a lookup.

Booking, CRM and alerts. Offering real openings from a scheduling calendar and booking one, finding a contact or opening a case, subscribing someone to a list when they ask, or posting an alert to a team channel.

What is not realistic, or not wise, is anything that needs judgement about money or fairness. Refund decisions, goodwill credits, policy exceptions, disputes and conversations involving hardship belong with people. Multi-step processes across several systems, such as cancelling a plan, refunding the unused part and updating the CRM, are expensive to unwind when one step succeeds and the next does not. Gartner's June 2025 release made a similar point, with its analyst saying current models are not mature enough to pursue complex business goals autonomously or follow nuanced instructions over time.

Gartner's March 2025 release also expects customers to contact you through their own AI agents, for example to cancel a membership, and calls them machine customers. If some of the "people" in your chat are bots, rules enforced in your systems matter more than rules written in a prompt.

Which customer service tasks should an AI agent automate?

Automate lookups that reveal little and changes that are cheap to reverse, require verification for anything tied to an account, and keep money, exceptions and identity disputes with people. Two questions sort almost every task: what does the answer reveal if the wrong person asks, and what does it cost if the action runs wrongly or twice?

Two rows deserve a note. Order status by number is safe only when the action returns status fields and nothing else; if your store's order numbers are sequential, a curious visitor can try a few, so the reply must not include a name, address or phone number. And "keep human" does not mean the agent does nothing. The agent can still collect the details, file a ticket that says "refund requested for order 1042, reason: arrived damaged", and tell the customer what happens next. The person makes the decision; the agent removes the typing.

What guardrails does an action-taking AI agent need?

Six controls cover most of the risk: verify identity before account actions, limit what the agent can read, use the narrowest credentials, make writes safe to retry, require confirmation or human approval for high-impact actions, and treat everything the agent reads as untrusted. None depends on the model behaving well, which is the point.

Verify identity before account actions

Verification is proof that the person in the chat controls the account they are asking about, usually a one-time code sent to the account's email address. Without it, an email typed into the chat is only a claim, and an agent that looks up "the subscription for [email protected]" will read Sam's plan to whoever typed it. Require verification for any action that reveals or changes account details.

Allow-list the data the agent can see

The OWASP Top 10 for LLM Applications calls this risk excessive agency (LLM06): an AI system that can do more than it needs to, traced in OWASP's LLM06 entry to excessive functionality, permissions and autonomy. The data side matters as much. An order API that returns the full address and phone number hands both to the model, and a manipulated conversation can coax them back out. An allow-list of response fields means the agent only ever sees, say, the status and the delivery estimate.

Use the narrowest credential, and let your systems decide

Connect each tool with the most limited key the provider offers: a Stripe restricted key, a Shopify app with only the order-reading scope, a read-only WooCommerce key. OWASP's mitigations add a principle worth adopting by name, complete mediation: the downstream system enforces what is allowed, rather than trusting the model to decide.

Make writes safe to retry

Idempotency is the property that sending the same request twice has the same effect as sending it once. Stripe's page on idempotent requests explains the point: after a connection error, a client can retry with the same key without creating a second object. Many agent platforms, PepoChat included, run actions at least once, so a rare retry can run a write twice. That is harmless for a lookup, a nuisance for a ticket and a real loss for a refund.

Require confirmation or human approval for high-impact actions

OWASP recommends a human in the loop to approve high-impact actions. In support there are two forms. The customer confirms ("Yes, cancel at the end of this billing period"), which guards against a misunderstood request. A staff member approves, which guards against everything else: the agent files the refund request, a person decides.

Treat everything the agent reads as untrusted

Prompt injection is text written to override an AI agent's instructions, typed into the chat or planted in a web page, document or API response the agent reads. It is first on OWASP's 2025 list (LLM01). In December 2025 the OWASP GenAI Security Project published a separate Top 10 for Agentic Applications, led by agent goal hijack (ASI01) and tool misuse (ASI02): the same problem once the agent can act. No prompt reliably prevents injection, so the defence is containment. An injected instruction can only do damage through the tools and data the agent already has, which is why the controls above matter more than clever wording, and why a failed or odd tool call should end in a handoff, not a retry. The full list for a website bot is in AI chatbot security risks.

What do analysts predict for agentic AI in customer service?

Gartner's headline forecast is that by 2029 agentic AI will resolve 80% of common customer service issues without human intervention, cutting operational costs by 30%. In June 2025 it predicted that over 40% of agentic AI projects will be cancelled by the end of 2027. Both are forecasts, not measurements.

The March 5, 2025 press release, quoting Daniel O'Sullivan of Gartner's customer service and support practice, also advises service leaders to expect interactions from customers' own AI agents and to write policies for AI-led interactions covering privacy, security and escalation.

The June 25, 2025 press release blames escalating costs, unclear business value and inadequate risk controls. It cites a January 2025 Gartner poll of 3,412 webinar attendees, in which 19% said their organisation had invested significantly in agentic AI, 42% conservatively, 8% not at all, and 31% were waiting or unsure. It also names agent washing: rebranding existing assistants, robotic process automation and chatbots as agentic without substantial agentic capability. Gartner estimated that only about 130 of the thousands of vendors claiming agentic AI are real.

Read together, the releases say the ceiling is high for common, well-defined issues, and that most early projects fail on cost, value or risk control rather than on the model. The 80% figure is about "common" issues in 2029, and it is often quoted in sales decks as if it were a current benchmark. For what companies report today, and how they count it, see AI ticket deflection benchmarks.

How do actions work in PepoChat?

PepoChat's AI support agent can call prebuilt actions for 13 tools and custom actions against any HTTPS API. Each action is switched on separately, tested with a real request, and limited to the response fields you list.

Prebuilt actions. Stripe (find a customer, check a subscription, cancel at period end), Shopify (order status), WooCommerce (an order by number, or recent orders by email), Zendesk, Freshdesk and Zoho Desk (create and check tickets), HubSpot and Salesforce (find contacts, file tickets or cases), Jira (create an issue), Slack and Discord (post an alert), Mailchimp (subscribe on request) and Zapier (trigger a Zap). The integrations page lists them all.

Custom actions. Any HTTPS endpoint you already have, with a "when to use" description the agent reads to decide, placeholders allowed in the path and query but never the host, up to 10 inputs the agent collects, encrypted headers, and up to 20 response field paths the agent may read. Leave the field list empty and the whole response passes, so fill it in. New custom actions start disabled, and the Test button runs the real request. The custom actions documentation walks through each field.

Network rules. HTTPS only; private and internal hosts refused by name and by DNS-over-HTTPS resolution; no redirects; a 10-second timeout; responses over 2 MB rejected and at most 4,000 characters passed to the agent. Visitor inputs are escaped for exactly where they land, and keys are encrypted and never shown again (webhook URLs for Slack, Discord and Zapier are visible on the action card).

Behaviour in the conversation. Only the visitor's explicit request can trigger an action. The agent collects the inputs it needs, never invents values, and answers in plain language rather than pasting raw output, and tool results are wrapped as untrusted data in the prompt. If a lookup finds nothing it asks the visitor to double-check; on any other error it offers a person. Actions never run in voice calls. The Stripe cancel action needs an explicit request and a confirmation and ends the plan at the end of the paid period; cancelling Stripe subscriptions safely covers that flow.

The limits. Up to 20 actions per workspace, integrations included. Execution is at-least-once, so do not wire refunds or payments. Verification is not applied to actions automatically: a visitor can prove an email with a six-digit code that expires after 10 minutes, but an action that looks up an order or subscription by email runs for any email typed into the chat unless its "when to use" text requires verification. Visitor verification explains what the code unlocks. Every feature, actions included, is on every plan, the free one too, and PepoChat publishes no resolution statistics, so test it on your own tickets.

How should you roll out an AI agent that takes actions?

Roll out in order of risk: answers first, then one read-only lookup, then a write with confirmation, reviewing real transcripts at each step.

1. Read 100 to 200 recent tickets and tag each one: answerable from docs, needs customer data, needs a change, needs a person. The middle two groups are your candidate actions.
2. Get grounded answers and handoff right first. If the agent cannot explain your return policy, a returns action will not save it.
3. Add one read-only lookup with the fewest fields that answer the question, and test it on test records, because tests run the real request.
4. Write the "when to use" text like a policy: when the action applies, what to collect, and whether the visitor must verify their email first.
5. Watch two weeks of transcripts for wrong triggers, missing inputs and lookups that should have required verification.
6. Add one write action with a confirmation step, chosen so a duplicate would be harmless. Keep refunds, payments and exceptions as tickets for a person.
7. Review monthly and remove actions nobody uses; each one is another path from a manipulated conversation into your systems.

What to do next

Start with the ticket review in step 1, because it tells you whether you need an action-taking agent at all or a well-grounded answer agent with a clean handoff. If actions are on your list, sort the candidates into the three columns of the task table and build only the first column at first. When you are ready to try it on real content, create a free PepoChat workspace, connect one read-only action, and watch what the agent does with your customers' questions before anything it touches can cost money.