Customer-Facing AI Agents: What They Are and How to Launch One

Short answer: A customer-facing AI agent is software that talks directly with your customers on channels like WhatsApp, iMessage, SMS or email, and can take real actions for them, such as checking an order or booking a call. Launching one safely means knowing who is speaking, limiting what each tool can do, putting a person in front of risky actions, and testing the agent before every change ships.

A customer texts your business at 11pm: "Where's my order? I need it by Friday." An internal tool can't answer that. A help-center search can't either. A customer-facing AI agent can. It knows who is texting, looks up the order in your system, sees it's delayed, offers a faster shipping option and, if the customer asks for a refund instead, sends that to a person on your team before any money moves.

That last part is what separates an agent you can launch from one you'll regret. This guide covers:

• What a customer-facing AI agent is, and how it differs from an internal one
• What has gone wrong when companies launched them without guardrails
• A seven-step checklist to launch one, with the Keiki features behind each step

What is a customer-facing AI agent?

A customer-facing AI agent is an AI system that talks with your customers directly and acts for them. It answers in the channel the customer already uses, such as WhatsApp, iMessage, SMS, Slack, Telegram or email, and it can call your tools: look up an account, change a booking, start a return, take a payment.

Three things make it different from an internal agent your own team uses:

• The other person is a stranger. Your employees sign in. A customer is a phone number or a WhatsApp ID, and the agent has to work out who they are before it shows them anything private.
• Every answer is public. A wrong answer lands on the customer's phone, next to everything you've told them that was right. You can't quietly fix it later.
• It speaks for your company. In February 2024, a Canadian tribunal ordered Air Canada to honor a refund its website chatbot had promised. The airline argued the chatbot was a separate legal entity responsible for its own actions, as The Guardian reported. The tribunal disagreed. What your agent tells a customer, your business has said.

It is also different from a chatbot that only answers questions. An agent decides which tools to call and in what order, so it can finish a task, not just describe how to do one.

Why companies are launching them now

The results can be large. In February 2024, Klarna announced that its AI assistant had handled 2.3 million conversations in its first month, two-thirds of its customer service chats, and that customers resolved their errands in under 2 minutes instead of 11. Those are Klarna's own figures.

Smaller teams see it too. Veeza AI moved its WhatsApp agent to Keiki and its founder reports doubled revenue and more than 20 hours a week of messaging upkeep saved; read how Veeza AI turned WhatsApp into its front door. Arc's founder reports a qualified call booked about 30 minutes after onboarding, covered in the Arc customer story. Both sets of numbers are founder-reported, not measured by Keiki.

The agents are not reliable enough to run alone, though. On τ-bench, a 2024 benchmark that simulates customer service conversations with real policies and tools, state-of-the-art function-calling agents such as GPT-4o succeeded on under half of the tasks. Run eight times on the same retail task, they got it right every time on under a quarter of them. That gap is why the launch checklist below is mostly about limits, not prompts.

What to look for in a customer-facing AI agent platform

You can build the agent loop yourself, but most of the work in a customer-facing agent sits around the model. Before you choose a platform, check that it handles:

| Need | What to check | | --- | --- | | Channels | One agent on every channel your customers use, without a rewrite per channel | | Identity | A way to tell the agent who is speaking, in your own users and permissions | | Tool limits | Permissions and approvals enforced before a tool runs, not written into the prompt | | Handoffs | A person can take over the conversation in the same thread, then hand it back | | Testing | Repeatable tests you run before a change reaches customers | | Security | Encrypted credentials, tenant isolation and an audit trail |

Keiki was built for this: you build one agent and it runs on iMessage, SMS, WhatsApp, Slack, Telegram and email. The background is in Introducing Keiki. The checklist below uses it for the examples.

How to launch a customer-facing AI agent

Step 1: Give the agent one job

Pick a job a customer would text you about, such as order status, bookings or account questions. Write down the tools that job needs and nothing else. A narrow agent is easier to test and easier to trust. You can add jobs once the first one works.

On Keiki, a cloud-served agent is one config: instructions, model, tools and features. Keiki hosts it, so you don't run a server.

Step 2: Connect the channels your customers use

Add channels in the dashboard: an iMessage line, a WhatsApp number, a Telegram bot, a Slack app or an email inbox. The agent config stays the same. Tools, memory and billing sit above the channel layer, so adding a channel never means rewriting the agent.

Step 3: Tell the agent who is speaking

This is the step most teams skip, and the one that matters most. A phone number in a tool argument is not proof of anything. Keiki's identity webhook asks your system, once per new sender, who this person is and what they may do. You answer with your own user ID and a list of scopes, such as orders:read or orders:refund.

Keiki passes that answer into the turn. It reaches the prompt, so the agent knows who it's talking to, and it reaches tool execution, so a call the person isn't allowed to make never runs. If your webhook fails, the agent keeps answering, but every tool that needs a scope is refused. Keiki never falls back to allowing it.

If many customers share one agent and one number, conversation authentication keeps each customer's conversation tied to their own account. For an unknown sender, your webhook can return a fixed reply, such as a link to connect their account, and the model never runs.

Step 4: Put a person in front of risky actions

Rules in a prompt are suggestions the model can ignore. Rules in a tool's policy are enforced before the tool runs. OpenAI's practical guide to building agents calls human intervention "a critical safeguard" and names the actions that should trigger it: ones that are "sensitive, irreversible, or have high stakes," such as canceling orders or authorizing large refunds.

On Keiki, a tool that changes data or money gets approval: 'ask' in its policy. When the model calls it, Keiki stores the exact call and waits for a person to approve it:

import { Effect, Schema } from 'effect'
import { defineTool } from '@onkeiki/agents'

export const refundOrder = defineTool({
  name: 'refund_order',
  description: 'Refund an order for the customer who is texting. A person approves it first.',
  input: Schema.Struct({ orderNumber: Schema.String }),
  policy: { approval: 'ask', requiredScopes: ['orders:refund'] },
  execute: (input, ctx) =>
    Effect.promise(async () => {
      const res = await fetch(
        `https://api.example.com/customers/${encodeURIComponent(ctx.phone)}/orders/${encodeURIComponent(input.orderNumber)}/refund`,
        { method: 'POST' },
      )
      return { ok: res.ok }
    }),
})

requiredScopes means only a customer your identity webhook granted orders:refund can trigger it, and any approver needs the scope too. The details are in Governed actions.

Also turn on escalation, so the agent can hand a conversation to your team in Slack, by email or to your own webhook. A teammate replies in the same thread, the agent stays quiet, and it picks the conversation back up when it's handed back. The full pattern, with approvals, handoffs and server notices, is in how to add human-in-the-loop to an iMessage agent.

Step 5: Tell customers they're talking to an AI

Don't let customers guess. Say so in the first reply. In the EU this is becoming a legal duty: Article 50 of the EU AI Act requires providers to design AI systems that interact directly with people so those people are informed they are interacting with an AI system, unless it's obvious from the context. Check the rules that apply where your customers live.

Step 6: Test before every change ships

A prompt change that fixes one conversation can break ten others. Keiki's Eval Studio runs test cases as real turns through your agent, with mocked tools, so outbound messages are blocked and usage isn't billed. Each check, such as "called the lookup tool before answering" or "didn't promise to reply later," shows as its own pass or fail. The same cases rank candidate models, so you can pick the one that behaves best rather than the one that sounds best.

Once the agent has real traffic, Replay tests a proposed prompt against turns that actually happened, so you compare against real customers instead of a guess.

Step 7: Check security before launch

A customer-facing agent holds your API keys and talks to your customers. Before launch, read how Keiki protects your keys and data: credentials are encrypted at rest with AES-256-GCM, secrets never enter the prompt or traces, every request is scoped to your organization on the server, and dashboard and API changes are written to an audit log. Optional prompt-injection screening checks inbound messages before they reach the model.

Launch checklist

Before you point real customers at the agent, confirm:

• The agent has one job and only the tools that job needs.
• Every channel you'll launch on is connected and tested with a real phone or account.
• An identity webhook returns your user ID and scopes for known customers, and a fixed reply for unknown ones.
• Every tool that changes data or money has approval: 'ask' and the right requiredScopes.
• Escalation is on, and someone on your team will see the handoff.
• The first reply tells the customer they're talking to an AI.
• Eval cases pass for the main job, a failing tool and an off-topic request.
• You've read the security page and rotated any test keys.

FAQ

What are customer-facing AI agents? Customer-facing AI agents are AI systems that talk with your customers directly, on channels like WhatsApp, iMessage, SMS or email, and take actions for them using your tools. Unlike a question-answering chatbot, an agent can finish a task, such as rebooking an appointment, not just explain it.

How is a customer-facing AI agent different from an internal one? An internal agent serves people who have already signed in to your systems. A customer-facing agent talks to strangers, so it has to verify who each person is, limit what each tool can do for them, and answer in public, where a wrong reply reaches the customer immediately and speaks for your business.

What should customer-facing AI agent platforms provide? At minimum: one agent across the channels your customers use, a way to pass your users and permissions into each turn, tool permissions and approvals enforced outside the prompt, handoffs to your team, repeatable testing, and encrypted credentials with an audit trail. Keiki covers each of these.

Can a customer-facing AI agent run without human oversight? For low-risk questions, often yes. For actions that move money or change data, put a person in front of them. Benchmarks such as τ-bench show current agents still fail many realistic customer service tasks, so approvals and handoffs are what make a launch safe.

How long does it take to launch a customer-facing AI agent? It depends on how many of your systems the agent needs. A hosted platform removes the server and channel work, so most of your time goes into the identity webhook, the tools and the eval cases. Panda Agency's founder reports the first useful agent in about five minutes; read the Panda Agency story for how.

Sources

• "Air Canada ordered to pay customer who was misled by airline's chatbot," The Guardian, February 16, 2024. https://www.theguardian.com/world/2024/feb/16/air-canada-chatbot-lawsuit
• "Klarna AI assistant handles two-thirds of customer service chats in its first month," Klarna press release, February 27, 2024. https://www.klarna.com/international/press/klarna-ai-assistant-handles-two-thirds-of-customer-service-chats-in-its-first-month/
• "τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains," Yao et al., Sierra, arXiv, June 2024. https://arxiv.org/abs/2406.12045
• "A practical guide to building agents," OpenAI, 2025. https://cdn.openai.com/business-guides-and-resources/a-practical-guide-to-building-agents.pdf
• "Article 50: Transparency obligations for providers and deployers of certain AI systems," EU Artificial Intelligence Act (Regulation (EU) 2024/1689), via artificialintelligenceact.eu. https://artificialintelligenceact.eu/article/50/