Human-in-the-Loop

How a Chatbot Should Handle Angry Customers: No De-Escalation Strategy

Low Retrieval-Confidence Presented as a Confident Answer Without Escalation Disclaimer

Self-Service Deflection Agent Generates a Fluent, Assertive Answer From a Weakly-Matched Retrieved Article, Instead of Hedging or Routing to a Human When the Retrieval Similarity Score Is Low

Multi-Issue Message Sentiment Averaging Masks a Severe Complaint

When a Single Customer Message Contains Several Distinct Issues of Varying Severity, the Sentiment-Escalation Agent Scores Overall Message Sentiment as a Blend, Diluting a Severe Complaint That Would Have Triggered Escalation on Its Own

Approval Authority Escalation Failure

An agent submits an approval request that exceeds the current approver's authority limit (e.g., a spend amount, a data-access scope, or a risk tier above what that role can sign off on). The workflow is supposed to automatically route the request to a higher-authority approver, but the escalation path fails silently — the request sits in the original approver's queue indefinitely, gets auto-approved because the "requires escalation" flag was never checked, or gets auto-rejected because the escalation target couldn't be resolved.

Approval Chain Break

A multi-step approval chain (for example, manager approves, then finance reviews, then compliance signs off) breaks partway through because one link in the chain fails to forward the request to the next stage. The agent or workflow engine has already recorded the completed steps as "approved," creating the appearance of forward progress, but the request never actually reaches the remaining approvers and simply goes cold in an intermediate state.

Approval Conflict

An action requires sign-off from two or more independent approvers, and they issue conflicting decisions — one approves, another rejects. The approval system has no defined resolution rule for this case, so the agent falls back to undefined behavior: proceeding because "at least one approval" was recorded, blocking because "any rejection" wins, or simply acting on whichever decision was recorded last (last-write-wins), none of which reflects an actual governance policy.

Approval Delegation Loop

An approver who is unavailable delegates their approval authority to another approver, who in turn delegates back to the original approver (or to a third party who delegates further, forming a longer cycle). The delegation graph has no cycle detection, so the request bounces indefinitely between the delegated parties, or the workflow engine detects the loop only after it has already re-notified the same approvers dozens of times.

Approval Queue Overflow

Too Many Pending Approvals Cause Delays or Dropped Requests

Approval Scope Mismatch

An approver grants approval for a specific, narrowly-scoped action, but the agent executes something broader or materially different from what was approved, then cites the original approval as its authorization. The gap between what was approved and what was executed goes undetected because the system checks only "does an approval exist" rather than "does this specific action match the approved scope."

Approval Timeout Expiration

An approval request times out because no approver responds within the configured window, and the agent's downstream behavior on timeout is either undefined or set to fail-open: the action proceeds automatically as if approved, or the requester and approvers are never clearly told that the timeout occurred and what happened as a result. Either way, a control that was supposed to require an affirmative human decision ends up producing an outcome no human actually made.

AI Agent Approval Timeout Mishandling: Causes and Fixes

The automatic approval review times out while evaluating the requested approval, and the agent then does the wrong thing — auto-approving without real review, or blocking the task forever

Approval Waiver Abuse

An emergency waiver mechanism, designed to let an agent bypass the normal approval process under genuinely urgent conditions (an active outage, a security incident), gets invoked repeatedly for routine, non-urgent actions because it is faster and has less friction than the real approval path. Over time this erodes the approval control entirely: the "emergency" path becomes the default path, and the actions it was meant to gate no longer receive meaningful human review.

Authority Mismatch

Wrong Person Approves Action

Chatbot Loop Without Human Escalation Path

Self-Service Deflection Agent Keeps Offering the Same or Similar Automated Suggestions Without Recognizing the Customer Needs Human Escalation

Conditional Permission Logic

Some permissions are conditional on runtime state rather than static role membership — "allow withdrawal only if account balance exceeds the requested amount," "allow this API call only during business hours," "allow escalation only if the ticket is marked P1." The agent evaluates these conditions against stale, cached, or incorrectly fetched data, or implements the comparison logic incorrectly (off-by-one, wrong field, wrong currency/unit), and grants access that the live condition would have denied.

Embedding Retrieval Selects Wrong Escalation Playbook by Keyword Similarity

A Sentiment-Escalation Agent That Selects an Escalation Playbook by Embedding Similarity Against a Playbook-Description Index, Rather Than Against the Structured Severity Tier the Conversation Actually Belongs To, Matches the Conversation to a Superficially Similar but Wrong Playbook, Routing It Through an Escalation Path That Does Not Match the Actual Risk Level

Escalation Not Triggered

Agent Fails to Escalate to Human When Required

Escalation Too Early

Agent gives up despite solvable request.

Feedback Not Incorporated

Human Corrections Ignored in Subsequent Agent Decisions

Goal Drift and Task Mutation

Agent Gradually Modifies Its Own Goals or Learns Unintended Behaviors Over Time

High-Effort Ticket Misrouting

Support Ticket Routing Model Routes Complex Issues to Tier-1 (Auto-Response); Requires Escalation After Wasted Time

Human Unavailability

No Fallback When Required Approver Is Unavailable

Missing Approval Gates

Workflow Lacks Required Approval Step for High-Risk Action

Model Compression Failure

A team quantizes or distills a model specifically to cut inference cost (smaller weights, faster kernels, cheaper hardware) and validates the change against an aggregate quality benchmark that looks acceptable, but the compression technique degrades a specific capability disproportionately — long-context recall, numerical precision, rare-token/tail-vocabulary generation, or multi-step tool-calling reliability — that the aggregate benchmark doesn't isolate. The compressed model ships, the cost savings materialize as planned, but a narrow slice of production traffic silently gets worse outputs, and the hidden quality cost (rework, escalations, lost trust) offsets or exceeds the infrastructure savings.

Multi-Agent Handoff Drops De-Escalation Context Between Triage and Billing Agent

A Triage Agent That Determines a Customer Is Already Frustrated and Has Explicitly Requested Not to Repeat Their Account Details Again Records That Context Only in Its Own Conversational Reasoning, and When the Conversation Is Routed to a Downstream Specialized Billing Agent That Operates on a Structured Ticket Object Containing Only the Stated Issue Category, the De-Escalation Context and Already-Provided Details Never Cross the Handoff Boundary, So the Billing Agent Re-Opens the Conversation by Asking the Customer to Re-Authenticate and Re-Explain Everything From Scratch

Multi-Agent Handoff Drops Escalation Trigger Between Sentiment-Classifier and Routing Agent

A Sentiment-Classification Agent That Concludes, in Its Own Analysis, That a Ticket's Tone Indicates a High Risk of Customer Churn or Public Complaint Hands the Ticket Off to a Routing Agent Through a Structured Sentiment-Score Field That Falls Within the Routing Agent's Normal Range, So the Specific Escalation Reasoning the Classifier Reached Never Translates Into Priority Routing

Multi-Agent Handoff Drops Escalation Urgency Flag Between Triage Bot and On-Call Clinician Queue

A Telehealth Triage Bot That Reasons, in Its Own Free-Text Assessment, That a Patient's Symptoms Warrant Urgent Same-Hour Clinician Contact Hands the Case to an On-Call Clinician Queue Through a Structured Ticket That Carries Only a Generic Priority Field, So the Urgency the Bot Actually Concluded Never Reaches the Queue's Sort Order

AI Agent Decides When It Should Have Escalated to a Human Expert: Causes and Fixes

The agent decides a case that should have gone to a human or domain expert, with no abstention or escalation trigger firing.

On-Call Escalation Misroute

Agent Routes a Critical Alert to the On-Call Engineer Listed in a Static Ownership Map That No Longer Matches the Service's Actual Current Owning Team

Policy Ambiguity Exploitation

A policy's wording leaves genuine ambiguity about whether a specific action requires approval — vague thresholds, undefined terms, or edge cases the policy authors never anticipated. An agent (or a user directing the agent) exploits that ambiguity to structure or describe an action so it falls, technically, outside the policy's plain wording, routing around a control that was clearly intended to apply.

Policy Consistency Violation

Two policies that are supposed to be consistent with each other — for example, a global organization-wide policy and a team-level override, or two policies covering overlapping domains — actually conflict in their requirements. Rather than applying a defined precedence rule, the agent's policy engine applies whichever policy it happens to evaluate first (often just an artifact of lookup order or cache layout), producing inconsistent enforcement depending on incidental factors rather than deliberate governance design.

Policy Exception Not Authorized

An agent applies an exception to a policy — allowing an action that the policy would otherwise block or gate behind approval — without that exception itself having gone through the authorization process required to grant it. The exception may be based on a stale precedent, an informal verbal agreement never formalized, or the agent inferring that an exception should apply based on similar past cases, none of which constitutes a properly authorized exception.

Policy Retroactive Application

A policy is updated, and the new version is applied retroactively to actions the agent already took under the old policy — flagging past actions as non-compliant, requiring after-the-fact approval for things already executed, or reversing decisions that were entirely proper under the rules in effect at the time. This creates disputes about whether historical actions were compliant, since the agent (and the humans who approved its actions) were following the policy that actually existed when the action happened.

Policy Scope Misunderstanding

The agent misinterprets which actions or resources a policy actually covers — applying it too broadly (blocking or gating actions the policy was never meant to touch) or too narrowly (letting actions through that clearly fall within the policy's intended coverage). Unlike ambiguity exploitation, this is not adversarial routing around a control; it's a straightforward misreading of the policy's scope by the agent's interpretation logic.

Policy Temporal Violation

A policy that is only supposed to be active during a specific time window — a temporary spending freeze, a holiday change-lockdown, a time-boxed data-access restriction — is either enforced outside that window (blocking actions after it should have lapsed) or fails to be enforced within the window (letting restricted actions through during the period they were supposed to be blocked). The root cause is almost always a timezone or scheduling bug in how the window's boundaries are evaluated.

Policy Version Mismatch

An agent evaluates a proposed action against a stale, cached copy of a policy while the authoritative version has already been updated elsewhere (a new threshold, a newly added restriction, a removed exception). The resulting approval or auto-approval decision is based on rules that are no longer current, producing an outcome that would be different — and would not hold up — if evaluated against the actual, up-to-date policy.

Poor Escalation

Agent fails to hand off to a human at the right time.

Privilege Escalation

Agent Gains More Access Than Intended

Privilege Escalation

Agent gains or uses higher permissions than intended.

Quantization Accuracy Degradation Undetected

A model is quantized to reduce inference cost, and the accuracy drop it introduces is real but small enough, or spread thinly enough across the output distribution, that pre-production evaluation — typically a quick smoke test or a comparison against a loose acceptance threshold — doesn't catch it. The quantized model ships to production because it "passed," and the accuracy gap only surfaces later through downstream signals (increased user corrections, retries, escalations, or a slow drift in a business metric) that take weeks to trace back to the quantization change, by which point the cost savings have been partly or fully offset by the quality cost, and root-causing requires reconstructing a change that's no longer top-of-mind.

Sarcasm Misread as Satisfaction

Sentiment-Escalation Agent Classifies Sarcastic or Passive-Aggressive Customer Messages as Positive, Suppressing an Escalation That Should Have Triggered

Sentiment Misclassification Delays Escalation

Agent's Sentiment Classifier Mislabels Controlled, Formally-Worded but Highly Escalated Customer Language as Neutral, Delaying Human Escalation

Spurious Causal Narrative from Keyword Co-Occurrence

A Sentiment-Escalation Agent's Free-Text Justification for Why a Ticket Is Being Escalated (Or Not) Invents a Plausible-Sounding Causal Explanation Linking Two Merely Co-Occurring Elements of the Conversation, and That Invented Explanation Is Adopted by Support Managers as a Real Triggering Rule Rather Than Recognized as the Model's Own Rationalization

Stale Approval Reuse

Agent Uses Old Approval for New or Changed Context

Stale Cached Discount-Tier Tool Result Trusted in Quote Approval

A Deal-Management Agent Calls an Internal Pricing/Discount-Approval Tool to Check the Maximum Discount an AE Can Approve Without Escalation, the Tool Returns a Cached Result from Before a Discount-Policy Change Took Effect, and the Agent Approves a Quote at a Discount Level That No Longer Qualifies for Auto-Approval

User Frustration Escalation

As a conversation goes wrong — repeated misunderstandings, unresolved requests, unhelpful clarifications — the user's tone becomes progressively more frustrated (shorter messages, capitalization, explicit complaints, sarcasm), and the agent fails to detect this shift or adjust its behavior in response, continuing with the same pacing, tone, and approach that caused the frustration in the first place. The failure isn't the original mistake but the agent's blindness to the user's escalating emotional state as a signal that its current approach isn't working.

User Support Bottleneck

Conversation-quality failures that the agent doesn't resolve — clarification loops, wrong assumptions, unaddressed frustration — don't simply vanish when the user gives up on the agent; a meaningful share of them convert into human support escalations, and if the underlying agent failure rate is high enough, the resulting escalation volume exceeds what the human support team is resourced to handle, creating a backlog. The bottleneck is a downstream, aggregate consequence of many individually-small agent failures rather than a single large incident.

AI Agent Picks the Wrong Workflow Branch (Refund vs. Replacement, Escalate vs. Resolve): Causes and Fixes

AI agent chooses the wrong path in a decision workflow — refund vs. replacement, escalation vs. resolution — based on surface pattern-matching instead of the applicable rule.