AI Airline Booking Chatbot

Search, Price and Book Flights in a Conversation, Safely

Design a chat assistant that turns free text into flight searches, books exactly once through airline distribution systems, keeps card numbers out of the chat, and answers policy questions only from the airline's own rules.

Overview

An airline booking chatbot lets a traveler write 'Chicago to New York next Friday, back Sunday, two of us, morning flights' and end with a ticket, instead of filling a long form. It also answers the questions around a trip: how many bags are included, what a change costs, whether a fare is refundable, and it can change or cancel a booking later.

The design splits the work. A large language model (LLM) reads each message and decides what the traveler wants; it can call a fixed set of tools (search flights, price an offer, look up a rule), and it writes the reply. Ordinary code owns everything that must be exact: the booking's state, which offer was chosen, the confirmed price, the payment and the call that creates the booking. The model can suggest; code decides.

This split matters because mistakes here cost money and trust. In Moffatt v. Air Canada (February 2024), a Canadian tribunal held the airline liable for negligent misrepresentation after its website chatbot told a customer that a bereavement fare could be claimed after travel, while the airline's own bereavement page said it could not; the tribunal rejected the idea that the chatbot was a separate legal entity and said it should be obvious the airline is responsible for all the information on its website.

Questions to ask first

Who sells the ticket? — An online seller using a distribution API (a GDS or airline NDC connection)
Which channels? — Web and mobile chat; no voice
Can the bot book without a click? — No: the traveler confirms the exact itinerary and price with a button
How is payment taken? — A payment frame hosted by the card processor; the bot sees a token
Which questions may it answer? — Trip, fare-rule and policy questions, only from the seller's and airline's own rules
Guest or signed in? — Both; changing a booking needs sign-in or the record locator and last name

What you will be able to do

Divide the work between the language model and code, and say why the booking state and the money stay in code.
Resolve airports, dates and passengers into a valid search, asking instead of guessing.
Run search, re-price and book against a distribution API with expiring offers, exactly once.
Keep card numbers out of the chat, the model and the logs.
Answer policy questions only from sources the bot can cite, and resist instructions hidden in text.

Key concepts

Tool calling
Slot filling
Booking state machine
Search, price, book
Offer expiry
Idempotent booking
Hosted payment fields
Grounded policy answers
Prompt injection
Explicit confirmation

Functional requirements

Understand trip requests in free text and ask follow-up questions for anything missing or ambiguous
Search flights, show a few options, and let the traveler compare and choose
Re-price the chosen offer and show the final total before payment
Take payment through processor-hosted fields and book exactly once
Send the confirmation with the record locator in the chat and by email
Answer baggage, change and refund questions from the booked fare's rules and the policy pages
Change or cancel an existing booking after verifying the traveler
Hand off to a human agent on request or when the bot is unsure

Non-functional requirements

First words of a reply within 2 seconds at p95 (a target we chose)
Zero double bookings: every booking call is idempotent
No card number stored in chat logs, prompts or analytics
No money-moving action without an explicit confirmation from the traveler
Every policy answer traceable to a stored source

Interview questions

Why not let the LLM run the whole booking?
How do you handle "London" or "next Friday"?
How do you keep state across 20 turns and two browser tabs?
How do you make sure a flight is booked exactly once?
How do you take payment in a chat without PCI exposure?
How do you stop the bot from inventing policies?
What stops prompt injection from causing damage?