AI support agents that take actions in backend systems, not just answer FAQs, connect to your APIs with write access and change something for the customer: a refund issued, a card frozen, an address updated, a subscription cancelled. Ada, Fin (now part of Salesforce), Lorikeet, Salesforce Agentforce, Decagon, Sierra and Zendesk AI agents all document this on their own sites. The useful differences are how each one limits what the agent may write, how you test write actions without touching real accounts, and how you pay.

Key takeaways

• An FAQ bot reads; an action-taking agent writes. Ask every vendor which of your systems the agent can change, under whose credentials, and how you turn write access off.

• OWASP names excessive functionality, excessive permissions and excessive autonomy as the root causes of "excessive agency", the risk that an LLM app takes damaging actions. Least privilege is the main control.

• Test writes against mock data first. A good platform lets you run the same conversation against mocks, then staging, then live.

• Gartner estimates only about 130 of the thousands of agentic AI vendors are real, warning of "agent washing". Ask to see a live write action on a test account, not a slide.

Which AI support agents take actions in backend systems?

Lorikeet reads and writes through your APIs, webhooks and MCP servers, and you choose read-only or write access for each one in the app. Ada says its agent acts in your systems through Ada Computer, with refunds, entitlements and eligibility computed in sandboxed Python rather than by the model. Fin connects to Stripe, Shopify or internal systems through Data Connectors or MCP and lets you control what data it can access. Salesforce Agentforce reaches other systems through Flows, MuleSoft connectors and Apex. Details and limits for all seven follow.

How we chose and checked these

We included AI support agents whose own pages describe taking actions in a customer's systems, not only answering from a knowledge base. Every vendor fact was checked on the vendor's public pages on 30 October 2026 and is linked where it appears. We did not use analyst contract estimates, review scores or private conversations. "Not published" means we could not find it on the pages we checked. The order reflects how directly each vendor's pages document write actions and the controls around them. It is not a quality score.

Lorikeet publishes this guide and is one of the tools listed. We have tried to describe every product, including our own, using only what each vendor publishes, and we link to the source for each claim.

What counts as a backend action?

A backend action is any call that changes data or triggers a process in a system of record: issuing a refund, cancelling an order, freezing a card, resetting a password, updating an address, opening a dispute or creating a ticket in another team's queue. Reading data, such as order status or account balance, is a lookup. Lookups make answers personal; writes make problems go away.

This matters because the FAQ-only approach has known limits. The CFPB found chatbots "cannot respond to requests outside the scope of their data inputs", and that customers end up in "doom loops" when their issue falls outside the bot's capabilities. The same report counted over 98 million users, about 37% of the US population, using a bank's chatbot in 2022, projected to reach 110.9 million by 2026.

Comparison table

1. Ada: brands that want the model to decide but never calculate

Ada's platform page splits the work cleanly: the reasoning engine "decides the next step" and Ada Computer "carries it out in your systems." The sentence buyers in regulated industries will care about is that "refunds, entitlements and eligibility come from your sandboxed Python, not from the model." When you connect an MCP server, every tool it exposes is discovered but stays off until you turn it on, which is a sensible default for write access. The loop runs decide, act, check, decide until the task is done. Ada also connects to Zendesk, Salesforce and Twilio and deploys across voice, messaging and email, and its Playbooks handle multi-step SOPs with real-time data.

Best for: high-volume consumer brands with engineers who can write the Python that encodes refund and eligibility rules.

Trade-off: pricing is not published on the pages we checked, and the sandboxed-code model assumes you have someone to write and maintain that code.

2. Fin: teams that want support staff to own actions on any major helpdesk

Fin's Procedures connect to tools like Stripe, Shopify or Linear, and to internal systems, through Data Connectors or MCP, and Fin says you control "exactly what data it can access and how it uses it." Its fintech example covers managing subscriptions, processing chargebacks and verifying account information using live data such as transaction history. Inside a Procedure you can add if/else branches and code for strict rules like eligibility or record updates, and Simulations let you test full conversations before launch and rerun them after changes. Procedures work on Intercom or on an existing Zendesk, Salesforce or Freshdesk helpdesk.

Pricing: $0.99 per outcome, including resolutions and Procedures configured to end in a handoff.

Trade-off: Fin's page focuses on what data it can access; ask for detail on per-action approvals and audit logs for write calls, which it does not spell out there.

3. Lorikeet: regulated teams that need fine control over write access

Lorikeet's tools call pre-built integrations, custom integrations for any REST or GraphQL API (including Stripe, Shopify and your own APIs), webhooks, Zapier and MCP servers, and code tools chain several calls in a fixed order. Outbound tools can start a new voice, SMS or WhatsApp conversation from inside a workflow. Controls are specific: read-only or write access per connection, an option to act on behalf of one customer so a conversation can read or write that customer's data only, and environments where write tools return mock data on test tickets. Payments and identity checks run as code the agent can invoke but never alter. The pricing page lists SOC 2 Type 2, ISO 27001 and a DPA or BAA (including HIPAA) on every plan.

On its customer pages, GiveCard runs each payout program's verification steps through its own API, after which the agent can check balance and transaction history, set a PIN or explain a declined transaction; the team built those workflows in two to three days. Arbor connected Zendesk in under 15 minutes and had custom API endpoints deployed within days.

Pricing: Start $2,100 a month, Scale $5,100 a month, paid annually, plus $0.99 or $0.90 per resolution; escalations are not charged. 30-day free trial.

Limits: actions are only as good as your APIs. The docs ask for responses under 3 seconds, and a team with no usable endpoints will need engineering time first. The plan fee is hard to justify at low volume.

4. Salesforce Agentforce: Salesforce-centred service teams

Agentforce agents are built from subagents and actions in Agent Builder. Salesforce says you can use Flows to create automations "across any system", MuleSoft API connectors to connect agents "to any system", and Apex or JavaScript for custom logic. The Atlas Reasoning Engine breaks a request into smaller tasks and proposes a plan until the answer or action is complete, and agents escalate to human agents when an issue is beyond their scope. Data comes from Salesforce CRM and Data 360.

Pricing: Flex Credits or Conversations, or per-user licensing.

Salesforce describes the engine as hybrid reasoning: LLM reasoning combined with deterministic, rules-based execution written in Agent Script, which teams can version and review like code. That gives a Salesforce admin a familiar way to pin down which actions run in which order.

Trade-off: the action layer is the Salesforce platform. That is a strength if your records live there and a project if they do not.

5. Decagon: enterprises that want transactional tasks governed by written procedures

Decagon's own guide to agent capabilities describes transactional tasks as granting an AI agent "decision ownership to directly execute actions and make changes within your core business systems," using Agent Operating Procedures as "a precise rulebook" for sensitive actions such as processing payments or modifying subscriptions. Examples include initiating a refund, calculating the amount and generating a return label. AOPs pull live data and trigger workflows across systems, engineers can version them in Git, and Decagon shows the reasoning behind each decision.

The same guide lists identity verification tasks such as password resets as a separate category, and the AOP page describes guardrails for brand voice, escalations and hallucinations across chat, voice and email. It suits enterprises that want CX teams writing procedures and engineers reviewing them.

Trade-off: pricing is not published on the pages we checked.

6. Sierra: brands that want to pay for outcomes

Sierra's Agent Studio lists 40+ pre-built integrations and custom integrations for proprietary systems, used inside journeys "from taking real-time action on behalf of customers." Its trust page says agent access to systems of record is "deterministic and controlled," and that models are wrapped in supervisory layers. Simulations and a regression suite cover testing, and pricing is outcome-based.

Agent Studio is pitched as no-code, with real-time traces of every decision, tool call and response while you build, so you can see exactly which action fired and why. Sierra covers voice, chat, email and WhatsApp in 59 languages. It suits large consumer brands that want one agent across channels and a vendor paid on results.

Trade-off: outcome rates are not published, so compare on a quote.

7. Zendesk AI agents: Zendesk customers starting with actions

Zendesk lets you give AI agents access to your tools and systems to act and resolve requests independently, "even in legacy environments." The help center describes authorized actions and API integrations alongside generative procedures and scripted dialogues, and automated QA evaluates every interaction. AI agents are included in every Suite and Support plan and billed per automated resolution.

On voice, Zendesk says AI agents handle complex call flows from start to finish and securely take actions across systems. Procedures are described in natural language, so support leads can own them. It is the obvious first test for a team already paying for Zendesk Suite.

Trade-off: best value only inside Zendesk; for other helpdesks Zendesk points to its separate Forethought AI agents.

How do you give an AI agent write access safely?

Give it the narrowest permissions that still let it finish the job, and put a person in front of the actions you cannot undo. OWASP recommends human-in-the-loop approval for high-impact actions. The Model Context Protocol specification says tools "represent arbitrary code execution" and that hosts must obtain explicit user consent before invoking any tool. In practice: scope tokens to the customer in the conversation, keep separate read and write tools, compute amounts in code rather than in the model, log every write, and run every new tool against mocks before live data. NIST's AI Risk Management Framework is a good template for recording those decisions.

What still needs a human?

Keep people on irreversible or discretionary writes: goodwill refunds above a limit, account closures, fraud and hardship decisions, and anything a customer disputes. The agent should gather evidence, run the checks and hand over a complete case, so the human decision takes minutes, not a fresh investigation. Also design your APIs to return a useful message when a lookup fails, such as a misspelled email, so the agent can ask the customer to check it and retry instead of escalating a ticket that never needed a person.

Questions to ask before you pick

1. Which of our systems can the agent write to, and can we set read-only per system?

2. Are amounts and eligibility calculated in code or by the model?

3. Can we run write actions against mock data and staging before live?

4. Whose credentials does the agent use, and can it be scoped to one customer per conversation?

5. Where is the audit log of every action, and who can see it?

Related reading: backend actions versus FAQ bots, securing API and webhook integrations, MCP and API setup for AI support and platforms that execute multi-step resolution. To connect your own systems in a sandbox, start a 30-day free trial.