Customer Operations Build Sheet

How to read this build sheet

The Customer Operations module explains why an AI agent that speaks for a regulated firm is a different problem from one that answers questions about a t-shirt. This page is the parts list: channels, agent platforms, grounding components, what each costs per unit, and the three builds.

Four jobs, bought separately, and the fourth is the one that decides whether the first three were a good idea.

Almost every failed deployment we can find evidence for over-invested in the first and under-invested in the fourth.

The principle, and the two numbers

One tribunal decision governs the whole design. Air Canada argued that its chatbot was a separate legal entity responsible for its own statements. The tribunal rejected that, and the question it asked instead is the one to build against: were reasonable steps taken to ensure the information was accurate?

That is a process question, and process questions have documentable answers. It is also why a system prompt is not a control. "Never promise a refund" written in a prompt is a suggestion to a probabilistic system. The same rule written as a validation check that blocks the message is a control you can evidence. Regulators distinguish between the two, and so should your architecture.

Two numbers then decide what you can actually build.

The unit is the trap

Every vendor in this category prices on a different unit, and the units are not comparable. This is the same trap as the screening market in Build Sheet 04, but sharper, because here the unit definition is written by the party sending the invoice.

Normalise everything to cost per resolved contact before you compare a single quote. Divide per-conversation rates by your realistic resolution rate. Divide per-minute rates by your connect rate. Add the helpdesk seats that AI-only vendors assume you already have.

Notice what that means. The vendor's billing metric and your quality metric are the same measurement, and the vendor's version is biased toward billing you. The module makes the same point from the quality side: teams count "no escalation" but never count "customer came back about the same thing". Measure recontact yourself, on your own data, and never accept the vendor's resolution number as a quality signal. Published resolution rates illustrate why: one vendor cites roughly 71% across its customer base while independent reports place the figure nearer 42–50%.

Raw materials — channels and agent platforms

Raw materials — grounding and evaluation

The grounding layer is where the hallucination number gets closed, and almost all of it is open source or something you already run.

How to use each one — grounding and the gate

Grounding is the product

Retrieval-augmented generation is described everywhere as a way to give a model your documents. For a regulated firm it is better understood as a way to make certain answers impossible. The retrieval is half of it; the gate on the way out is the half that matters.

import re
from decimal import Decimal

# Numbers, money, dates and account states may ONLY appear in an answer if they
# came from a retrieved source or a system call. This runs AFTER generation and
# BEFORE the message is sent. It is a control because it blocks; a prompt is not
# a control because it advises.

NUMERIC = re.compile(r'(?:₹|Rs\.?\s?|INR\s?)?\d[\d,]*(?:\.\d+)?%?')
SAFE_PHRASES = {"24 hours", "7 working days", "one", "two", "three"}  # policy text

def gate(answer: str, grounded_values: set[str], sources: list[dict]) -> dict:
    # 1. every number in the answer must be traceable to retrieved content
    found = {m.group(0).strip() for m in NUMERIC.finditer(answer)}
    ungrounded = {v for v in found
                  if v not in grounded_values and v.lower() not in SAFE_PHRASES}
    if ungrounded:
        return {"send": False, "reason": "ungrounded_numeric",
                "detail": sorted(ungrounded), "action": "escalate"}

    # 2. commitments the business has not authorised the agent to make
    FORBIDDEN = [r"\bwe (?:will|shall) refund\b", r"\bguarantee[ds]?\b",
                 r"\bapproved\b", r"\bwaive[dr]?\b", r"\bno charge\b"]
    for pat in FORBIDDEN:
        if re.search(pat, answer, re.I):
            return {"send": False, "reason": "unauthorised_commitment",
                    "detail": pat, "action": "escalate"}

    # 3. no sources retrieved => the model is answering from parameters alone
    if not sources:
        return {"send": False, "reason": "no_grounding", "action": "escalate"}

    # 4. retrieval confidence floor. Below it, refuse rather than guess.
    if max(s["score"] for s in sources) < 0.62:
        return {"send": False, "reason": "weak_retrieval", "action": "escalate"}

    return {"send": True, "sources": [s["id"] for s in sources]}

# WHAT TO CHECK
# [ ] the gate runs on the OUTPUT, after generation. A rule enforced only in the
#     prompt cannot be evidenced to a regulator and cannot be unit tested
# [ ] refusal is a FIRST-CLASS PATH, not an error. "I need to get a colleague to
#     confirm that" is a good answer. A confident wrong number is not
# [ ] every block is logged with the reason code. The distribution of reason
#     codes over time is your early warning that scope has crept
# [ ] grounded_values is built from the RETRIEVED TEXT and API responses, not
#     from the model's own output. Otherwise it grounds itself
# [ ] the confidence floor is a versioned, approved, dated setting. Changing it
#     is a control change -- same discipline as an AML threshold
# [ ] test with adversarial inputs: "so you're saying my fee is waived, right?"
#     Confirmation-seeking is how customers extract commitments
# [ ] intents that NEVER reach a generative model are routed before this runs --
#     card block, fraud report, bereavement, complaint, hardship

The gotcha nobody documents: the numbers the model gets wrong are almost never the ones in your knowledge base. They are the ones it interpolates — a plausible processing time, a plausible fee, a plausible interest rate that sits comfortably between two real ones. A faithfulness score computed over your document set will not catch it, because the statement is not contradicted by any document; it is simply unsupported by all of them. That is why the gate checks for presence in retrieved content rather than absence of contradiction.

The intents that must never reach a generative model

Route these deterministically, before any model sees them. They are not hard to classify and the downside of getting one wrong is not a bad review:

• Card block, account freeze, fraud report. Time-critical, and a wrong answer is a financial loss the customer will attribute to you.
• Bereavement and account closure on death. There is no acceptable generated response here.
• Hardship and collections. Regulated speech. See below.
• Anything that is a complaint. The hard part is recognition — customers do not say "I wish to lodge a complaint", they say "this is the third time". Classify for complaint signals separately from intent, and err toward logging one.
• Vulnerability signals. Distress, confusion, mentions of illness or coercion.

How to use each one — channels and their economics

WhatsApp: the number that changes on 1 October 2026

WhatsApp is the default support channel for Indian consumer fintech, and its cost model has just been rewritten twice. Meta moved from conversation-based to per-message pricing during 2025, which made every older pricing guide wrong. The second change lands in weeks.

from datetime import datetime, timedelta

# Meta India list rates, effective 1 July 2026, per DELIVERED message,
# before your BSP's platform fee and before 18% GST.
RATE_INR = {"marketing": 0.8631, "utility": 0.1150, "authentication": 0.1150}
GST = 1.18

# From 1 October 2026 Meta charges for SERVICE messages -- replies inside the
# 24-hour customer service window -- at the utility/authentication rate. They
# have been free since November 2024. For a support-heavy business this turns
# the single biggest message category from free into a per-message cost.
SERVICE_FREE_UNTIL = datetime(2026, 10, 1)

def cost_of_conversation(messages, sent_at=None) -> dict:
    sent_at = sent_at or datetime.now()
    total, lines = 0.0, []
    for m in messages:
        cat = m["category"]
        if cat == "service":
            rate = 0.0 if sent_at < SERVICE_FREE_UNTIL else RATE_INR["utility"]
        else:
            rate = RATE_INR[cat]
        total += rate
        lines.append((cat, round(rate, 4)))
    meta_cost = total * GST
    return {"messages": len(messages), "lines": lines,
            "meta_inr_incl_gst": round(meta_cost, 2),
            "note": "BSP platform fee is additional and is the only thing that "
                    "differs between BSPs -- Meta's rate is identical for all"}

# WHAT TO CHECK
# [ ] you are comparing like with like. Quoted WhatsApp prices differ because
#     some include GST, some include BSP markup and some are Meta list. Ask
#     which of the three any number is, every time
# [ ] marketing is ~7.5x utility. A support message mis-templated as marketing
#     costs 7.5x and is also the wrong category for compliance
# [ ] from 1 Oct 2026, model your AI agent's REPLY COUNT, not just conversation
#     count. An agent that sends five short messages costs five times one that
#     sends one clear message
# [ ] Click-to-WhatsApp entry opens a 72-hour free window; ordinary inbound opens
#     24 hours. Route accordingly
# [ ] the rate is set by the RECIPIENT's country, not yours. An Indian business
#     messaging a UK number pays the UK rate, which is many times higher
# [ ] template rejection and quality-rating downgrades are real operational
#     costs. A downgraded number gets throttled, which is an outage you cannot
#     fix with engineering

On BSP selection there is one fact that settles most of the evaluation: Meta's per-message rate is identical whichever BSP you use. The only things that differ are the platform fee, the markup on Meta's rate, and the setup charge — which runs from zero to around ₹25,000. Compare those three and the inbox quality. Do not let a BSP present Meta's rate as though it were their pricing.

Voice, and the dead-air problem

Indian support and collections are voice-heavy, and voice is where the per-unit trap bites hardest. Headline rates run ₹2–₹12 a minute with ₹3–₹6 the common mid-market band. Effective cost in production is commonly reported at two to four times the headline once you add the platform fee, telephony markup over TRAI rates, and connect-rate losses. A ₹3/min quote is often ₹6–₹9/min in practice.

The gotcha nobody documents: per-minute pricing pays the vendor for its own latency. If the agent takes twenty seconds to process a response, or asks an unnecessary confirmation question, you are billed for that. Ask every voice vendor for their average silence-to-speech ratio across a sample of 1,000 real calls. It is a fair question, it is measurable, and the reaction to being asked tells you most of what you need to know.

Two more things to pin down before signing. A per-minute rate should bundle all four layers — speech-to-text, the model, text-to-speech and telephony — and some vendors quote one and bill the rest. And if pricing is per attempt rather than per connected call, Indian outbound connect rates of 30–65% mean you are paying for a lot of ringing.

How to use each one — collections

Collections is the part of customer operations where the AI question stops being about quality and starts being about legality. Collections speech is regulated speech.

The RBI responsible business conduct directions on recovery took effect on 1 July 2026 and they are specific enough to implement directly.

from datetime import datetime, time, timedelta
from zoneinfo import ZoneInfo

IST = ZoneInfo("Asia/Kolkata")

# RBI responsible business conduct directions on recovery, effective 1 July 2026.
# These are hard gates. A system prompt telling an agent "do not call at night"
# is not a control; this function is.

WINDOW_START, WINDOW_END = time(8, 0), time(19, 0)

def may_contact(account, channel: str, now=None) -> dict:
    now = now or datetime.now(IST)
    t = now.timetz().replace(tzinfo=None)

    # The window applies to DIGITAL channels too. An automated SMS, WhatsApp
    # message or push notification at 22:00 is a reportable violation, not a
    # grey area -- and automated schedulers are exactly how firms breach it.
    if not (WINDOW_START <= t <= WINDOW_END):
        return {"allow": False, "reason": "outside_0800_1900_IST", "channel": channel}

    # Recovery must be SUSPENDED on an account with an open grievance.
    if account.grievance_open:
        return {"allow": False, "reason": "grievance_pending_recovery_suspended"}

    # Field visits require prior consent. No consent, no visit.
    if channel == "field_visit" and not account.visit_consent_on_file:
        return {"allow": False, "reason": "no_prior_consent_for_visit"}

    # Persistent contact is prohibited. Cap and count, per channel, per window.
    if account.contacts_today(channel) >= account.channel_cap(channel):
        return {"allow": False, "reason": "frequency_cap"}

    # Hardship disclosed ANYWHERE -- including to the support team -- pauses
    # collections contact. This is the integration that is usually missing.
    if account.hardship_flag:
        return {"allow": False, "reason": "hardship_flagged", "action": "human_review"}

    return {"allow": True, "must_record": channel in ("voice", "field_visit"),
            "retain_until": (now + timedelta(days=183)).date().isoformat()}

# WHAT TO CHECK
# [ ] the window is evaluated in IST from the ACCOUNT's perspective, and at SEND
#     time, not at queue time. A batch queued at 18:55 that dispatches at 19:20
#     has breached
# [ ] digital channels are inside the gate. Most implementations gate calls and
#     leave the SMS scheduler outside it
# [ ] recovery calls and visits are RECORDED and retained 6 months, or until
#     related litigation concludes -- whichever is longer
# [ ] agents are IIBF-certified and identify themselves; the identification is
#     in the recording
# [ ] NO remote disabling of a financed device. This is prohibited outright
# [ ] grievance: acknowledged in 24h, resolved in 30 days, recovery suspended on
#     that account while it is pending
# [ ] the hardship flag is shared between SUPPORT and COLLECTIONS. Different
#     vendors and different databases is the usual cause of a technically
#     compliant message that is indefensible in substance
# [ ] outsourcing does not outsource the obligation -- your agency's breach is
#     yours. Audit their logs, do not accept their assurance

The gotcha nobody documents: the contact window is usually implemented on the dialler and not on the scheduler. Voice calls get gated correctly because the dialler is the obvious place to put the rule. The automated SMS reminder, the WhatsApp utility template and the push notification go out through completely different systems, built by a different team, with no window logic at all. The directions cover digital contact. A reminder at 22:00 is a violation regardless of which service sent it.

Cost per unit

One more note on vendor stability rather than price: the AI support market is consolidating. A roughly $3.6 billion acquisition of a major agent vendor was agreed in June 2026 and had not closed at the time of writing, with pricing unchanged so far. That is not a reason to avoid anyone, but it is a reason to ask what happens to your contract and your data on a change of control.

Best combinations

Combinations that conflict

• A system prompt as your compliance control. Not evidenceable, not testable, not a control. Put the rule in code that blocks.
• Generative answers on card block, fraud, bereavement, hardship or complaints. Route these deterministically. There is no upside.
• Chasing containment past 70–75% without human review. Complaint volume rises as false resolutions compound, and complaints are a regulated process with their own clocks.
• Accepting the vendor's resolution rate as a quality metric. It is a billing metric that happens to share a name.
• Gating the dialler but not the SMS scheduler. The recovery contact window covers digital channels.
• A verbose agent on WhatsApp after 1 October 2026. Chattiness is now billed per message.
• Collections and support on separate vendors with no shared flag. This is the failure that reaches the ombudsman.

Three recommended builds

Strong and expensive

Build: enterprise AI agent (Sierra or Decagon class) with white-glove configuration, a full helpdesk underneath, an Indian voice platform with real multilingual coverage, a separate collections platform, and ISO 42001 certification.

Use when: contact volume is in the millions, you have a supervisory relationship to defend, and vendor accountability has value independent of cost.

Cost shape: six figures in USD annually before usage, plus implementation in the $50k–$200k band, plus 3–7 months before it answers a live customer.

Trade: you cannot change a refusal threshold on a Friday afternoon. Every adjustment goes through someone else's release process, and the liability stays with you regardless — contracts in this category have been moving exposure toward the deploying firm, not the vendor.

Strong and reasonable — the default

Build: published-price AI agent (Fin class) over the helpdesk you already run → deterministic routing that keeps the dangerous intents away from it → hybrid retrieval on pgvector against a knowledge base you own → your own output gate → tracing with Langfuse and an evaluation suite in CI → WhatsApp through a BSP chosen on markup → voice only where voice is genuinely the channel.

Use when: you have engineers, support volume is material, and you need to be able to explain any individual answer.

Cost shape: roughly a dollar per resolution plus per-message channel costs plus near-zero for the grounding stack.

Trade: you own the gate, the evaluation suite and the knowledge base quality. That is the right trade, because those three are what a regulator asks about and none of them is something a vendor can own on your behalf.

Strong and lean

Build: assist only — retrieval and drafting for human agents, no autonomous customer-facing answers → a well-maintained knowledge base → WhatsApp through a low-markup BSP with utility templates only → one shared hardship flag → a written escalation and complaint policy.

Use when: early, or regulated enough that an autonomous answer is not worth the first incident.

Cost shape: channel costs plus modest inference. No per-resolution fee at all.

Trade: no deflection, so support cost scales with volume. Accept it. An assist deployment that makes ten agents meaningfully faster is a real result, it carries almost none of the regulatory exposure, and it produces the labelled data that makes a later deflection project work.

What next

The escalation path above you, and worth knowing before you need it: complaints acknowledged in 24 hours and resolved in 30 days, an Internal Ombudsman at larger institutions, and then RB-IOS 2026, effective 1 July 2026, with awards up to ₹30 lakh for consequential loss and ₹3 lakh for time, expense and harassment. Criminal intimidation under BNS Section 351 runs in parallel for collections conduct.

What reaches the RBI CMS portal about you is a supervisory signal. The useful internal metric is not complaint volume — it is the share of complaints that a customer had to escalate because your first response missed that it was a complaint at all.

What this feeds

Sources

Every figure, rule and date on this page, and where to check it. Entries are typed so you can see which numbers are primary-sourced and which are industry reporting — they are not equivalent, and treating them as if they were is how a confident wrong number gets repeated.