Customer-facing AI without the horror stories: which chatbot guardrails actually work?

The guardrails that work are architectural: answer only from approved documents, allow the bot to say it does not know, keep it away from prices, refunds and promises, hand anything commercial to a human, and review real transcripts every week for the first month.

The chatbot guardrails that actually work are architectural, not cosmetic. The bot answers only from documents you have approved, it is explicitly allowed to say it does not know, it never quotes prices, refunds or commitments on its own authority, and anything commercial or emotional goes to a human with the conversation attached. Add a weekly review of real transcripts for the first month and most of the famous failures become far less likely.

The famous failures are worth studying, because they share a shape: a model pointed at customers, improvising where it should have quoted an approved answer or handed over to a person. It obliges with something fluent and wrong, and the screenshot outlives the apology.

of legal queries general-purpose chatbots got wrong, in earlier research Stanford cites: 58 to 82%; of legal queries general-purpose chatbots got wrong, in earlier research Stanford cites
error rate of the best grounded legal AI tools Stanford tested in 2024: 17%+; error rate of the best grounded legal AI tools Stanford tested in 2024
views of one customer's post showing DPD's chatbot swearing at him: 1.3M; views of one customer's post showing DPD's chatbot swearing at him

The horror stories share a shape

Jan 2024
DPD
After a system update, the parcel firm's chatbot swore at a customer and called DPD the worst delivery firm in the world. DPD disabled the AI element.
Feb 2024
Air Canada
A Canadian tribunal held the airline liable after its chatbot told a grieving passenger he could claim a bereavement fare after travelling.
Mar 2024
New York City
The Markup found the city's official business chatbot telling owners they could take a cut of workers' tips and refuse cash.
Apr 2025
Cursor
A software company's AI support bot invented a usage policy to explain a login bug. The co-founder had to post: "We have no such policy."
Jan 2026
WhatsApp
New Business API terms take effect, barring general-purpose AI assistants but leaving customer-service bots for a business's own customers alone.

Air Canada is the case to remember. According to the tribunal's decision, the bot told Jake Moffatt he could apply for a reduced fare within 90 days of the ticket being issued, even after travel, while linking to a policy page that said the opposite. The airline suggested the chatbot was a separate legal entity responsible for its own actions. The tribunal called that a remarkable submission and found the airline liable for negligent misrepresentation.

While a chatbot has an interactive component, it is still just a part of Air Canada's website.
British Columbia Civil Resolution Tribunal, Moffatt v. Air Canada, 2024 BCCRT 149

Grounding helps. It is not a guarantee

The standard fix is retrieval-augmented generation, or RAG: the bot looks up your documents first and answers from what it finds. It works, within limits. In Stanford's 2024 test of legal research tools built this way, the best still produced incorrect information more than 17% of the time, against 58% to 82% for general-purpose chatbots in earlier research. The researchers found that grounded tools do reduce errors compared with general-purpose models. They do not remove them.

The OWASP project lists misinformation among its top ten risks for applications built on large language models, and recommends grounding, human oversight for critical information, and interfaces that label AI content and state its limits. Anthropic's guidance for its own models adds two cheap techniques: explicitly give the model permission to admit uncertainty, which it says can drastically reduce false information, and instruct it to use only the documents provided, not its general knowledge.

The guardrails that work, and how to test each one

Chatbot guardrails with a test for each
Guardrail	What it prevents	Test it by asking
Answers only from approved documents	Invented policies, as at Cursor	About a policy you do not have
Explicit permission to say "I don't know"	Confident guesses	Something your documents never cover
Hard walls on prices, refunds and commitments	Air Canada-style promises	For a discount or a refund exception
Human handoff with the transcript attached	Angry loops, DPD-style	For a human, twice, impatiently
Clearly labelled as AI	Customers mistaking it for staff	Whether you are talking to a person
Weekly transcript review	Gaps your own testing missed	Nothing: read what real customers asked

Hard walls deserve the most care. Pricing, availability, delivery dates, refunds, medical or legal information and anything contractual should trigger a handoff, not an answer. A hypothetical dental clinic in Kochi can let its bot explain opening hours, parking and what to bring to a first appointment, while every question about treatment cost or a specific symptom gets a polite reply and a callback from the front desk.

Do not give the bot keys it does not need

A bot that only talks can embarrass you. A bot that can act can cost you. OWASP's list also includes prompt injection, where a message or document alters the bot's behaviour in ways you did not intend, and excessive agency, where the system has more functions, permissions or autonomy than its job requires.

Start read-only. Let the bot look up an order status, but not issue the refund. Let it suggest an appointment slot, but have a person or a rule-based system confirm it. Every tool you connect should be scoped to the smallest action that is useful, and anything involving money should need a human click.

The Indian context: WhatsApp, languages and personal data

For many Kerala businesses the bot will live on WhatsApp as much as on the website. Meta's terms, in force since 15 January 2026, bar general-purpose AI assistants from the Business API, but TechCrunch reports that businesses using AI to serve their own customers are not affected. Meta now lets general-purpose assistants in only where the law requires it to, which since March 2026 has meant Brazil and the European Economic Area, not India. Here, a grounded service bot is exactly what the platform allows; a do-anything assistant is not.

Test in the languages your customers actually write in. If they mix English and Malayalam, or type Malayalam in English letters, test exactly that: a bot tried only in formal English will meet questions it has never seen.

Transcripts are personal data. India's DPDP Rules, notified in November 2025, require reasonable security safeguards and breach notification once their core obligations apply 18 months after publication, according to MediaNama. Decide now who can read chat logs, how long you keep them and which vendor stores them.

The first month decides whether it works

Real users find gaps that testing never does. Read a sample of transcripts every week for the first month, and look for three things: questions the bot answered that it should have handed off, questions it handed off that your documents could have answered, and any reply you would not want quoted back to you.

Label the bot honestly from the first message. After its incident, Cursor's co-founder said AI responses used for email support are now clearly labelled as such. Customers forgive a bot that admits it is a bot and passes them to a person. They do not forgive one that pretended to be staff and was wrong.

Before you switch it on

Write or update the documents the bot will answer from: FAQs, policies, service descriptions. If it is not written down, the bot should not say it.
List the topics that always go to a human: prices, refunds, availability, complaints, medical, legal and anything contractual.
Give the bot a polite fallback line and a way to reach a person, and test that the handoff actually reaches someone.
Run the six tests in the table above, in English and in the way your customers really type.
Keep every connected tool read-only until you have a month of clean transcripts.
Book a weekly transcript review for the first four weeks, then monthly.

Deployed this way, a service bot handles the routine questions and makes your human team look faster, not riskier. It is how our AI and automation team builds them, and the same discipline applies if you build your own.

Sources

Facts checked against these sources, as of 15 May 2026.

All insightsAI