Chatbots to AI Agents: Where Humans Stay in Customer Service
Last Updated: September 10, 2026 | By Mihail Sebastian | Agentic AI
Support chatbots became agents that issue refunds and rebook flights. Air Canada's tribunal loss shows why authority limits and human escalation matter.
The customer service chatbot used to be the safest AI a company could deploy. It answered questions from a script, and the worst it could do was frustrate someone into calling the phone line.
That era is over. The current generation of support AI does not just answer questions; it issues refunds, rebooks flights, and changes account settings without a person in the room. The governance question has shifted from “what if it says something wrong” to “what if it does something wrong,” and most deployment playbooks have not caught up.
Three Generations of Support Automation
The first generation was the scripted bot: a decision tree with a chat window on top. It matched keywords to canned answers, walked customers through fixed flows, and handed off the moment anyone typed a sentence its designers had not anticipated. Cheap, predictable, and useless one step outside the script, it defined what most people still picture when they hear chatbot.
The second generation replaced the script with a language model. Built on conversational AI, these systems understand free-form questions, draw answers from a knowledge base, and handle phrasings nobody wrote down in advance. Their failure mode changed accordingly: instead of “I didn’t understand that,” they produce fluent, confident answers that are sometimes wrong.
The third generation is the autonomous support agent, and it is a different kind of system. An AI agent does not just converse; it holds credentials to real systems, so it can look up the order, judge the refund request against policy, issue the refund, and close the ticket end to end. The same pattern now covers rebooking, subscription changes, and account updates, with no human touching the case.
The mechanics matter for governance. The agent works through tool calls: defined connections into the order system, the booking engine, the CRM, each one a capability someone granted it. Every capability on that list is something the agent can get wrong at machine speed, which is why the list itself is the primary control surface.
Your Bot’s Words Are Your Words
The defining legal case of the second generation came from Air Canada. A passenger, Jake Moffatt, asked the airline’s website chatbot about bereavement fares after his grandmother’s death. The chatbot told him he could book at full price and apply for the bereavement discount afterward, which contradicted the airline’s actual policy, published elsewhere on the same site.
When Moffatt claimed the discount, the airline refused and pointed to the policy page. He took the dispute to British Columbia’s Civil Resolution Tribunal, and in February 2024 the tribunal ruled in his favor, finding the airline responsible for the inaccurate information its chatbot gave.
The part worth memorizing is the argument the tribunal rejected. Air Canada suggested the chatbot was a separate entity responsible for its own statements, and the tribunal found that position remarkable: the chatbot was part of the airline’s website, and the airline was accountable for all of it. Your bot’s words are your words, and a disclaimer buried in the footer does not transfer that liability to the software.
What Changes When the Bot Can Act
The Air Canada bot could only mislead. A customer still had to read the answer, act on it, and come back with a claim, which left the company a window to catch the error, even if it handled that window badly.
An agent closes the window. A support agent with refund authority that misjudges a policy does not give bad advice; it moves the money. The risk shifts from wrong words to wrong actions, and wrong actions need a different set of controls.
Three of them do most of the work.
Authority limits define what the agent may do at all: refunds up to a fixed amount, rebooking within the same fare class, never closing an account. Approval thresholds put a human sign-off above the line, so the agent proposes and a person disposes on anything large, irreversible, or unusual. Logging makes every action attributable and reviewable, so a bad decision can be traced, reversed, and learned from.
An agent granted broader permissions than its task requires is the failure mode security researchers call excessive agency, and it is the first thing to check in any agent deployment. The second is guardrails: runtime checks on what goes into the agent and what comes out, enforced outside the model rather than trusted to its training.
Where Humans Stay
The old handoff model treated humans as the fallback: the bot tries, the bot fails, a person cleans up. That design routes conversations by the bot’s confidence, which is exactly the wrong signal, because the Air Canada chatbot was confident.
Escalation should be policy instead. Some classes of conversation route to a person by rule, before the AI has a chance to answer: questions with legal weight (a bereavement fare is a contract term), conversations with emotional stakes (a death, a complaint, a customer in distress), and cases the policy genuinely does not cover. This is human-in-the-loop design applied to support: the person sits at defined points in the workflow, not at the bottom of a failure funnel.
None of this argues for removing the automation. A HubSpot study found that 90% of customers rate an “immediate” response as important or very important when they have a customer service question, and instant answers to routine questions are exactly what the technology delivers well. The design problem is not chatbot versus human; it is drawing the line between them on purpose.
The other half of the split is just as old. Salesforce reported that 84% of customers say being treated like a person, not a number, is crucial to winning their business, and no generation of bot has changed that.
The early hybrid deployments got the shape right: Bank of America’s Erica handles balance checks, transactions, and bill payments, and KLM’s chatbot assists with bookings across languages, with human agents stepping in for complex issues. The pattern that worked for chatbots, routine load automated and judgment kept human, still holds for agents; only the stakes of getting the boundary wrong have grown.
A Deployment Posture
Start with bounded authority. Launch the agent read-only, answering from verified policy with no tool access, then grant it low-value, reversible actions: a refund cap small enough that a wrong call is an annoyance, not an incident. Expand the cap and the action set only when the logs show the agent earning it.
Measure resolution and harm, not deflection. Deflection counts conversations a human never saw, which means it scores the customer who gave up as a success. The numbers that matter are resolved tickets, wrong-answer rate, wrong-action rate, reversals, and how often escalations arrive with enough context for the human to act.
Be honest about what customers are talking to. People should know when the other side of the conversation is an AI, and reaching a person should never require defeating the bot first. Both are trust decisions, and after Air Canada, the second one is also a liability decision.
The companies that get this right will not be the ones with the most autonomous agents. They will be the ones that can say, for every action their AI took, what it was allowed to do, why it did it, and who was accountable when it was wrong. Air Canada established that the answer to that last question is never “the chatbot.”
