Write the rules before writing the prompt. The charter should specify which tasks the agent may complete and which it must decline, defer or escalate.
Copy this pilot-charter structure
| Field | Example for an inbound home-services pilot |
|---|---|
| Business objective | Recover eligible after-hours enquiries currently left unresolved |
| Initial scope | One location; approved routine job types; defined service area |
| Explicit exclusions | Emergency triage, technical safety advice, unapproved pricing and unauthorised discounts |
| Permitted actions | Read approved information; check eligibility and capacity; create an approved booking or callback request |
| Success definition | Correct task completed under policy, with independently verified operational evidence |
| Human fallback | Named destination, coverage hours, acceptance rule and no-answer procedure |
| Sensitive information | Minimum approved fields only; no payment-card collection in the initial workflow |
| Measurement window | Set by task type before launch; include relevant repeat contacts |
| Stop conditions | Wrong-location booking, unauthorised disclosure, unverified confirmation or failed critical escalation |
| Decision owners | Operations, integration, security/privacy and finance |
Separate outcomes that sound similar
| Label | Required evidence |
|---|---|
| Enquiry captured | Required information is recorded accurately in the approved queue |
| Booking requested | A pending request exists; no appointment promise is made |
| Booking confirmed | The correct appointment or job exists in the authoritative system |
| Human-rescued completion | A person completes the task after AI involvement |
| Fulfilled job or attended appointment | Downstream fulfilment evidence exists |
| Appropriate refusal | The caller is correctly identified as outside scope and receives the approved next step |
Report appropriate refusals separately from eligible-task completions. Define exclusions before the pilot so disappointing results cannot be improved simply by relabelling difficult callers.
Build a small, governed knowledge set
For each approved answer, record:
policy_id, topic, location, owner, effective_date,
review_date, approved_answer, prohibited_claims, escalation_rule
Keep operational rules—service area, booking eligibility, appointment duration and permissions—in validated application logic where possible. OWASP’s excessive-agency guidance recommends limiting available functions and permissions and enforcing authorisation outside the language model. A prompt should not be the only protection against an unauthorised action. (genai.owasp.org)