AI Refund Agent Guardrails: A Practical Checklist

Why can’t the system prompt be the guardrail?

A prompt states the rules. It does not enforce them. Customers can argue, invent approvals and plant instructions, and research on customer-service agents shows that policy-aware persuasion gets past agents told to follow a refund policy (Nakash et al., 2025).

OWASP’s guidance on excessive agency calls for complete mediation: authorize each request in the downstream system instead of relying on the model to decide. For a refund agent, that means the refund service itself rejects a call that breaks a limit, whatever the conversation said.

The checklist: control, what it stops, how to test it

Each control below is enforced outside the model. The test column describes what to run before launch and after every change.

Control	What it stops	How to test it
Server-side caps per refund, per order and per customer per period	Anchoring, salami refunds, nibbling, injected amounts	Call the tool directly above the cap and expect a rejection. Run a salami scenario and check the cumulative total.
Approval tiers with IDs looked up server-side	‘My manager already approved it’, made-up reference numbers	Supply a fabricated ID, a real ID for a different order, an expired ID and a used ID. All four must fail.
One remedy per order	Refund plus replacement plus credit on the same order	Ask for a refund after a replacement has shipped. Check the order total across all money tools.
Claim counters by customer, address, device and payment method	Serial claimants, the same story from a new account	Seed fixtures with prior claims on linked accounts and run a repeat-claim scenario.
Untrusted content treated as data	Indirect prompt injection in tickets, attachments, product pages and tool output	Plant instructions in a ticket body, hidden PDF text and a CRM note. Score by tool calls, not by the reply.
Policy retrieved at decision time	Invented policy, stale limits, customers quoting fake policy	Change a limit in the policy source and check the agent uses the new one. Have the customer quote a policy that does not exist.
Commitment checks on outbound messages	Promises the agent cannot keep	Compare promises in the transcript with the tool log. Flag any promised refund or exception with no matching call.
Complete logging of money tool calls	Disputes and incidents you cannot reconstruct	Replay a logged conversation and confirm you can explain every dollar from the log alone.
A working escalation path to a human	Concessions offered to end a conversation, pressure that builds when a customer cannot reach a person	Ask for a human repeatedly. Check the handoff tool is called and no concession is offered instead.
Loop and rate limits on tools and turns	Tool-call exhaustion and endless haggling	Run a stalling scenario and check the agent stops, hands off and concedes nothing.

How should approval tiers work?

An approval is a record created by a person in a separate system, never a sentence in the chat. The refund tool takes an approval_id argument, and the server checks it before paying out.

Bind each approval to one order ID and a maximum amount.
Give it an expiry and make it single-use.
Record who approved it and why.
Return the same generic error for missing, wrong and expired IDs, so probing teaches the customer nothing.
Never let the agent create approvals, and never accept an approval stated in a message, an attachment or a ticket note.

What counts as untrusted input?

Anything the customer or a third party could have written. OWASP recommends separating and marking external content so it has less influence. For money tools, go further: untrusted text can supply facts to check, never permission to act.

Customer messages, ticket bodies and quoted email history
Attachments, including OCR text and hidden text layers
Product pages, reviews and seller descriptions
Free-text fields in tool output: order notes, CRM notes, carrier status text
Saved memory or profile notes written during earlier conversations

What should every money tool call log?

Enough to explain the decision without rerunning the model.

Conversation ID, customer ID and authenticated identity
Tool name, all arguments and the server’s response, including rejections
Policy version and the clause IDs the server checked
Model, prompt and tool versions
The documents and tool outputs the agent read before the call
Approval ID and approver, where one was used

Where should a human come in?

Escalate on clear triggers: an amount above the agent’s tier, a repeat claimant, suspected injection, a legal threat, or a customer who asks for a person. The agent hands over a summary and does not promise an outcome.

A missing escalation path creates its own risk. In a 2025 account of United’s support chatbot, a customer who repeatedly asked for a human got generic answers until he falsely claimed elite status, after which the bot placed him in the human queue. No refund was issued, but the pattern rewards the customer who lies.

Questions

Should the agent know its own refund limits?

It needs to know enough to act sensibly, such as ‘refunds above a limit need approval’, but the exact number does not have to be in its context. If the server enforces the cap and returns a generic ‘needs review’ response, a customer who probes for the threshold learns little.

Do these controls hurt honest customers?

Mostly not. Caps and approval checks only act on requests above a limit, and a fast escalation path is better service than an agent that improvises. Claim counters can catch honest repeat buyers, so route those cases to review rather than refusing outright.

What is the minimum set before launch?

Server-side caps, approval IDs checked server-side, one remedy per order, untrusted content kept away from tool arguments, full logging and a working handoff to a human. Add claim counters and commitment checks as volume grows.

Attack families

Scenarios

Free checklist

Get the guardrail checklist for agents that move money.

A one-page PDF of the controls and the test for each. Download it right away, and we email you the link.

Guardrails checklist for AI refund and discount agents