AI agents are starting to act on customers' behalf. With the releases of personal AI agents from several of the major AI providers, customers can now automate parts of their interactions with customer service.
At the same time, organizations are integrating AI assistants to their apps, chat, and support channels. Once an assistant can look up an order or issue a refund, it is accessing customer data and taking action on a customer’s account.
Customer Identity and Access Management (CIAM) helps your organization manage customer identities, including how customers register, sign in, access your services, and give consent. It now also needs to account for who or what is acting on their behalf, and what that agent is allowed to access or change.
The customer's agent and your own assistant
AI can carry out tasks on a customer’s account in two different scenarios. A customer may use an external agent, provided by an AI company, bank, or card network, to access your services through login flows and APIs. Your organization may also deploy its own assistant with access to customer data and functions within your systems.
These scenarios carry different risks, but both require clear controls:
Verify the customer’s identity
Identify the agent or assistant acting for them
Limit what it can access and do
Keep a record of its actions
When customers send an AI agent
A key risk is that your systems may not distinguish the customer’s agent from the customer. An agent can sign in with the customer's own password, or click through your website the way a person would. Your systems then see a valid login and cannot tell whether the customer, the agent, or an attacker with stolen credentials is on the other side. That causes three concrete problems:
- Fraud detection becomes harder. An automated login may resemble an account takeover. Blocking it can disrupt authorized use, while relaxing controls can make genuine attacks harder to detect.
- Access can exceed the task. An AI agent asked to reorder groceries may also have permission to change the delivery address or saved payment details, even though the task requires neither.
- Accountability and revocation become difficult. Logs may identify only the customer's account, making a disputed order harder to investigate. Customers may also lack a way to revoke the agent's access separately from their own credentials or active sessions.
Give customer agents clearly defined access
A safe way to approach customer agents is delegated authority: the customer grants the agent limited permissions to act, while your systems identify the agent separately from the customer. The setup could could look like this:
- The customer signs in with a strong login such as Vipps, BankID, MitID, Finnish bank IDs, or other trusted digital identity solutions, and approves specific permissions, such as placing orders within a spending limit for six months.
- The agent receives a short-lived access token that identifies it and the customer it represents. Your systems limit its access to the agreed permissions, excluding sensitive actions such as changing contact or payment details.
- An action outside the agreed scope requires explicit approval on the customer's own device before it can proceed.
- The customer can view the agent's permissions and revoke its access from their profile.
Too many approval requests can make it easy to click yes without a second thought. Help customers understand what they’re agreeing to from the start, then let routine actions run within those limits. Check back with them when an action needs broader permission or an extra security check.
When your own AI assistant helps customers
Your own AI assistant needs clear boundaries too. It may already have access to your systems to look up orders, read invoices, or issue refunds, but it should only access the data and take the actions allowed for the customer it is helping. Without those controls, a carefully worded message could lead it to share another customer's information or make a change the customer has not approved.
Keeping your AI assistant to the right customer
When an AI assistant can do more than its task needs, the risk is known as excessive agency. To keep access within the right boundaries, let your identity and access controls determine who the customer is and what they can do, rather than leaving those decisions to the conversation. Here’s what that looks like in practice:
- Connect each interaction to the signed-in customer. Tie every session and tool call to the customer’s verified identity. An email address or phone number mentioned in a message should not determine whose data the assistant can access.
- Give each tool only the access it needs. Checking an order’s status does not require payment details, and a tool that issues refunds should have a clear refund limit.
- Ask customers to verify their identity again for sensitive actions. Use strong authentication before issuing a refund or changing contact details.
- Keep a clear record of each action. Log which customer, assistant, and tool were involved, along with what happened.
Four questions to help you check both scenarios
Our article on securing AI agents highlights four questions to help you review the current controls you have in place for AI agents. They are just as useful for customer-facing services, whether customers bring their own agents or use your AI assistant:
- Where are your agents?
Which agents and assistants can reach customer accounts, and who approved that access? - What can they do?
Have you or the customer clearly defined what each agent can access and do, and for how long? - What are they doing?
Do your logs show which customer an agent was helping and what action it took? - How do you respond?
Can your team or the customer quickly revoke an individual agent's access without disrupting the customer's own access?
Where to start
Here are five practical steps to help get you started:
- Get to know your assistants. Map the assistants, chatbots, email agents, and voice systems that can access or change customer data. Identify each one’s owner and capabilities.
- Keep access tied to the right customer. Link access to the customer's verified identity and use tokens with narrowly defined permissions. A shared service account alone should never determine whose data an assistant can access.
- Add an identity check where it matters. Decide which actions need extra verification. Where appropriate, use familiar options such as BankID, MitID, Finnish bank IDs, Vipps, or passkeys.
- Make permissions clear and easy to manage. Set out what external agents may do, how customers give permission, and how they can withdraw it.
- Put your safeguards to the test. Check whether attempts through chat, email, and phone can expose another customer’s data, bypass approval, or trigger unauthorized actions.
