Scope limits & refusals
The layered defense that keeps an agent inside its contract — input screens, prompt rules, output checks — and refusal UX that leaves customers helped, not stonewalled.
The scope contract is a promise; guardrails are its enforcement. One layer is never enough — prompts leak under pressure, and any single check has blind spots. Production customer agents run three thin layers rather than one thick one:
- Input screening (before the model): cheap classifiers or rules that catch the obvious — off-topic floods, abuse, prompt-injection signatures, competitor-comparison bait, and topics from the never list. Screened inputs get routed (abuse → human, out-of-scope → redirect template) without spending a full model turn. Keep it coarse; false-positive refusals of innocent questions cost more than they save.
- Prompt rules (in the model): the never list, the scope contract, the injection bounding, the compensation ban — everything from Modules 1-2. This layer does the most work and cannot be the only layer, because a sufficiently creative customer will eventually find its seams. Assume leakage; design the next layer to catch it.
- Output checking (after the model): the last gate before the customer. Scan drafts for: policy numbers not present in context (the verbatim tripwire, automated), compensation language ('refund', 'discount', '%' outside a policy citation), out-of-scope topic drift, PII echoes (next lesson), and never-list violations. Failures don't ship — they retry with a corrective note or fall back to a safe template + handoff. This layer is what lets you sleep.
Refusal UX: the difference between guarded and hostile
Every refusal is still a customer interaction, and most 'my chatbot is useless' screenshots are refusals done badly. The template that works: acknowledge the ask → state the limit without lecturing → give the real path ('I can't compare us to other roasters — genuinely not my lane. For what we're best at, I can tell you exactly: … And if you're weighing options, our sales team loves that conversation: …'). Never fake-limitation ('I'm just an AI 😔'), never moralize at an innocent question, and never dead-end: every refusal names a door. Write refusal templates for your top 6 out-of-scope categories as product copy, with the same care as the marketing site — because screenshots don't distinguish.
When the input screen detects crisis language — threats of self-harm, medical emergency, danger — the agent's only job is a warm, immediate route to humans and appropriate resources, with the session flagged at top priority. No persona, no upsell, no 'anything else?'. This path gets designed once, reviewed by someone senior, tested in every eval run, and never A/B tested. Work with your team to source jurisdiction-appropriate crisis resources — hotlines and referral lines vary by country and region — so the crisis-resource list you hand the agent is correct for where your customers actually are. Every customer-facing system needs it; almost every team forgets it until the transcript that makes them cold.