# Context Briefer: An AI Agent That Summarises Customers for Support

The Context Briefer is an AI agent assist tool that gives a service agent a short, masked customer summary when a case opens. Support teams run it at read level (L1) on a customer data platform (CDP). Ticket free text stays out of its session, and it never replies to a customer, reveals a masked field or makes a promise.

It follows the [AI agent rails](https://privycdp.org/ai/rails) method, under which a written card sets every limit.

## Rail at a glance

The Context Briefer holds no write tools, so its rail is short. The data view and the panel service enforce each line, whatever a prompt says.

| Field | Value |
|---|---|
| Job | Give a service agent a masked, consent-aware summary of the customer. |
| Trigger | A case opened by an authenticated service agent. |
| Data scope | Masked profile summary in scope, recent interactions by type, and consent flags. Ticket free text is excluded from the session. |
| Tool scope | Read: masked profile view, interaction summary, consent flags. Propose: none. Execute: none. |
| Output contract | A short summary, the consent flags, and a line saying what the summary leaves out. |
| Gate | No approval step, because nothing changes. The service agent decides what to do with the summary. |
| Limits | One customer per run, field projection by purpose, no export. |
| Ledger | Case reference, fields returned, service agent, model version. The summary text is not kept in the ledger. |
| Evaluation | Spot checks by support leads, and tests that masked fields stay masked. |
| Owner and kill switch | The head of customer support owns it. Disabling the summary panel sends service agents back to the normal record view. |

## What it does and who uses it

The Context Briefer saves a service agent from reading several screens to learn who is on the line. It suits contact centres where staff meet unfamiliar customers and the full record shows more than the job needs.

Here is an illustrative run at a telecoms company. A service agent opens a case, and the panel shows this:

> Customer for three to five years. Four contacts in 30 days: three billing, one roaming. Phone marketing: withdrawn. Email marketing: allowed. Not included: case text, payment details, full address.

The service agent reads the case text in the normal ticket view, outside the model session. The phone-marketing flag means they drop the upgrade call their script suggests. Nothing in the panel mentions a goodwill credit or a fix date, so any offer comes from the billing policy and the person applying it.

## Why this level

The Context Briefer stays at L1 because showing a summary changes nothing, and a poor one misleads a single conversation. Reversibility is easy, and the blast radius is one customer per run, with no writes and nothing sent.

The Rule of Two explains why ticket text stays out [3](#source-3). Reading a profile gives the session private data, while ticket text comes from outsiders and would add untrusted input. Without it, and with no tools, the session holds just one of the three properties. Cato Networks showed the danger in June 2025: a crafted support ticket carried instructions that ran with internal privileges when an engineer invoked an AI action such as summarisation [4](#source-4). If you also want a ticket summary, generate it in a separate session.

"Never promises" matters even on an internal panel, because a service agent may repeat what it says. In 2024 a British Columbia tribunal held Air Canada responsible for wrong fare information from its website chatbot [5](#source-5). That was a customer-facing bot, yet it shows why this output contract has no field for outcomes, entitlements or dates.

L1 is also the ceiling, since a reply tool would be a different rail with a different approver.

## Three ways it fails, and the control for each

Each failure below starts with a small, reasonable change to the Context Briefer's data or use, and each control sits in a system outside the model.

| Failure | What it looks like | Control |
|---|---|---|
| Ticket text creeps back | A connector update adds a "last message" or subject field to the interaction summary, so outsider text reaches a session holding profile data. | The data view allow-lists typed fields only. A contract test fails the release if a free-text column appears. |
| The summary reads as a promise | The panel says "likely eligible for a refund", and the service agent repeats it to the customer. | The output schema has no field for outcomes. A rule-based filter holds back such sentences, and the panel has no route to the customer. |
| Support data drifts into marketing | Someone asks to build a "recent billing complainers" segment from the panel's output. | The view is tagged for support use, output is not written back to the profile, and no export exists. GDPR Article 5(1)(b) sets the purpose-limitation principle behind this, so ask your DPO how it applies [1](#source-1). |

## How to evaluate it

The Context Briefer passes only if its summaries are right and its masks hold, and those need separate tests.

- **Masked-field leaks, target zero.** Put canary values in each masked field of test profiles, then scan every test output for them. One leak is an incident, not a rate.
- **Spot checks by support leads.** Score a regular sample for factual errors, missing context such as an open complaint, and any sentence that sounds like a commitment.
- **The "not included" line.** Compare it with the ledger's list of fields returned.
- **Consent flag freshness.** Withdraw consent on a test profile and confirm the next panel shows it. A failed read should display "unknown", never "allowed".
- **Handling time, measured by the team.** The ledger names the service agent so that access can be audited. Reusing it to rank individuals moves towards the worker monitoring listed in AI Act Annex III point 4(b), so take advice first [2](#source-2).

## Where it runs

The Context Briefer runs on a private model inside the customer environment, with no external model for this data. Masking hides values, but a summary tied to a live case still describes a real person, and contact patterns can hint at money trouble or illness. The [boundary architecture patterns](https://privycdp.org/ai/ai-agents-on-customer-data-inside-your-boundary) cover the options. PrivyCDP supports bring-your-own-model in the customer environment, with limits on data access and review of results.

## Related

- [Customer context for support agents](https://privycdp.org/ai/rails/use-cases/customer-context-for-support): the workflow, step by step.
- [AI agents for customer support](https://privycdp.org/ai/rails/functions/customer-support): the playbook for the whole function.
- [Case Classifier](https://privycdp.org/ai/rails/agents/case-classifier) and [Escalation Spotter](https://privycdp.org/ai/rails/agents/escalation-spotter): the support agents that do read case text, with no profile data beside it.
- [Rail card template](https://privycdp.org/tools/agent-rail-card): the ten fields to complete for your own panel.


See the [AI agent rails hub](https://privycdp.org/ai/rails) for the wider method, and download the [rail card template](https://privycdp.org/tools/agent-rail-card) to write this rail for your own support desk.

Rail level: L1 · Risk: medium · Function: customer support

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### Can an AI agent summarise a customer without reading the ticket?

Yes. Profile fields, interaction types and consent flags give useful context with no outsider text in the session. The service agent still reads the ticket in the normal view.

### Is a masked customer summary still personal data?

Assume so unless your DPO advises otherwise. Masking hides values, yet the summary is attached to a case about one identifiable customer.

### Can marketing use what the panel shows?

No. Nothing is written back to the profile and there is no export, so it cannot feed segments. Marketing should work from its own consent-checked data.

## Sources

1. GDPR Article 5, principles including purpose limitation: https://gdpr-info.eu/art-5-gdpr/
2. EU AI Act, Annex III, high-risk uses including employment: https://artificialintelligenceact.eu/annex/3/
3. Meta, practical AI agent security (31 October 2025): https://ai.meta.com/blog/practical-ai-agent-security/
4. Infosecurity Magazine on the Cato Networks proof of concept (19 June 2025): https://infosecurity-magazine.com/news/atlassian-ai-agent-mcp-attack
5. McCarthy Tetrault on Moffatt v. Air Canada, 2024 BCCRT 149: https://www.mccarthy.ca/en/insights/blogs/techlex/moffatt-v-air-canada-misrepresentation-ai-chatbot

This article is general information, not legal advice.

## Further reading

- [AI Agents for Customer Support on Customer Data: The Playbook on Rails](https://privycdp.org/ai/rails/functions/customer-support)
- [Customer Context for Support Agents: Masked Summaries From an AI Agent on Rails](https://privycdp.org/ai/rails/use-cases/customer-context-for-support)
- [Case Classifier: An AI Agent That Proposes Support Queues](https://privycdp.org/ai/rails/agents/case-classifier)
- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)
- [AI Agent Rail Card Template: YAML, Spreadsheet and JSON Schema](https://privycdp.org/tools/agent-rail-card)