Customer Support Chatbot System

AI Answers, Account Actions and Human Handoff

Design a support chatbot platform that answers customers from a company's own help articles, looks up and changes their orders safely, and hands the conversation to a person with full context when it should.

Overview

A customer opens the chat window on a store's site and asks where their order is, how to return a jacket, or why they were charged twice. The chatbot answers from the company's help center, looks up the order when it needs to, performs simple actions like a small refund, and passes the conversation to a human agent when the problem is beyond it or the customer wants a person.

The platform serves many companies at once (tenants). Each has its own help articles, its own order system to call, its own agents, and its own rules. Nothing may leak between them.

The design rests on three parts. Grounded answers: the bot answers only from retrieved articles and says when it does not know (the retrieval machinery is covered in the RAG System topic). Safe actions: the language model may propose calling a tool, but application code decides whether the call is allowed. Handoff: clear rules for when a person takes over, and a summary so the customer does not repeat themselves.

Questions to ask first

One company or a platform for many? — A platform: 5,000 companies, each isolated
What can the bot do beyond answering? — Look up orders; small refunds and address changes within limits
Which channels? — Web chat widget first; email and messaging apps through adapters
Are human agents available? — Yes, some hours; outside them, the bot opens a ticket
How is success judged? — Issues resolved without the customer coming back, and satisfaction scores
What data is sensitive? — Card numbers, IDs, addresses; redact before storing or logging

What you will be able to do

Walk one customer message through redaction, retrieval, the model, tools and the reply.
Keep answers tied to the company's own articles, and explain why that matters legally.
Let the model propose actions while code enforces who may do what, with idempotent execution.
Write escalation rules and route handoffs to the right agent with a queue that is safe under concurrency.
Measure the bot by resolution, not just by how many conversations avoided a person.

Key concepts

Grounded answers (RAG)
Tool calls with permission checks
Escalation rules
Handoff summary
Agent queue (SKIP LOCKED)
Tenant isolation
Prompt injection
PII redaction
Resolution rate

Functional requirements

Answer questions from the company's help articles, with a link to the article used
Keep context across turns in one conversation
Look up the customer's orders and account, and perform allowed actions (small refunds, address changes) after the customer confirms
Escalate to a human agent on request, on policy topics, or when the bot is failing
Route escalations to agents with the right skill, highest priority first, with a summary of the conversation
Open a ticket when no agent is available
Collect a rating at the end; let agents flag wrong bot answers
Admins update articles, tools and rules per company

Non-functional requirements

First words of a reply within about 1.5 s, streamed (a target we chose)
No data crosses from one company to another
Card numbers and similar data redacted before storage and before reaching the model when not needed
Every bot action is authorized by code and logged; money-moving actions are idempotent
If the model provider is down, customers still reach a person or a ticket

Interview questions

How do you stop the bot from making up policies?
The bot needs to issue refunds. How do you make that safe?
When should the bot hand over to a person, and how?
How do agents pick up conversations without two agents taking the same one?
How do you keep one company's data away from another's?
How do you measure whether the bot is good?
What is prompt injection, and how does your design handle it?